authentik
An open-source identity provider supporting SAML, OAuth2/OIDC, LDAP, RADIUS, and SCIM for self-hosted single sign-on across applications
It takes care to curate a safe software space. Help us do more.
&
| + | Multi-Protocol Support free | Provides OIDC/OAuth2, SAML2, LDAP, RADIUS, SCIM, Kerberos, and proxy-based providers to connect applications regardless of the protocol they speak. |
|---|---|---|
| + | Visual Flow Builder free | Assembles custom login, MFA, recovery, and enrollment journeys from modular stages using a visual editor or YAML blueprints. |
| + | Passwordless MFA free | Supports TOTP and WebAuthn/passkey hardware authenticators for phishing-resistant login. |
| + | Self-Service Portal free | Lets users reset passwords, manage their own profiles, and enroll authenticators without contacting IT. |
| + | Remote Access Gateway free | Provides browser-based RDP, SSH, and VNC access to internal servers through the RAC provider, removing the need for a VPN. |
| + | Self-Hosted Deployment free | Runs on infrastructure the operator controls via Docker Compose, Kubernetes Helm charts, or AWS CloudFormation templates. |
| + | Google Workspace Integration enterprise | Connects directly to Google Workspace for provisioning and single sign-on. |
| + | Microsoft Entra ID Integration enterprise | Connects directly to Microsoft Entra ID for provisioning and single sign-on. |
| + | mTLS Authentication enterprise | Authenticates users through client certificates as part of a configurable login flow. |
...6 more features/limitations. Contact us to get a complete list of features and system requirements.
System Requirements
| # | Minimum |
|---|---|
| 1 | Linux host running Podman or Docker Compose v2 |
| 2 | 2 CPU cores |
| 3 | 2GB |
| 4 | Redis, a required container in the deployment stack for caching, sessions, background tasks, and WebSocket handling until its removal in release 2025.10 |
Ratings
Not available, but we appreciate help! You can help us improve this page by contacting us.
Developer
Written in
Python, TypeScript, Go, Rust
Initial Release
2020-01-02
Alternatives
Notes
- Variants:
| Feature / Aspect | Open Source | Enterprise | Enterprise Plus |
|---|---|---|---|
| Ideal For | Homelab users and simple use cases | Organizations requiring advanced authentication & compliance features | Enterprises requiring custom contracts, expert support, & FedRAMP |
| Core Protocols | OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, and Proxy | Everything in Open Source, plus: • Client certificate authentication (mTLS) • OAuth2 authentication in SCIM • Radius EAP-TLS | Everything in Enterprise |
| Directory Sync & Integrations | Basic OIDC/SAML | • Google Workspace integration • Microsoft Entra ID integration • Embed external OAuth/SAML sources | Everything in Enterprise |
| Device Trust & Endpoints | Basic | • Chrome Enterprise Device Trust connector • Windows local device login (in preview) • Advanced device compliance (in development) | Everything in Enterprise |
| Security, Signals, & Compliance | Standard security controls | • Shared Signals Framework (ABM) support • Password history compliance checks • Enhanced audit logging for compliance | Everything in Enterprise, plus: • FIPS compliance for FedRAMP requirements |
| Access & Use Cases | • Web-based RDP/SSH access • Covers B2B and B2C use cases | Yes | Yes |
| Deployment & Reporting | Single instance; basic logs | Exportable CSV reports | Support for multi-instance deployments |
| Billing & Procurement | Free | Standard subscription | • Billing and purchase via invoice • Volume discounts at thousands of users |
| Support Plan | Community Discord (No official support) | Ticket-based support (for subscriptions over a certain amount) | Dedicated, customized support and SLAs |
- No hosting is provided on authentik’s servers.