Authelia
Identity & accessOne login with two-factor checks in front of your self-hosted web apps.
Authelia gives a set of web applications one sign-in page with two-factor checks, without changing the apps themselves. It sits next to your reverse proxy, which asks Authelia before letting each request through. You write plain rules about who can reach which app, from which network and with how many sign-in factors.
- Two-factor sign-in with security keys and passkeys, one-time password apps or Duo push notifications.
- Access rules by domain, user, group, network, path and HTTP method, each set to one or two factors.
- Works with nginx, Traefik, Caddy, HAProxy, Envoy and common Kubernetes ingress controllers.
What people use it for
Put self-hosted apps behind one login
Run Authelia on its own subdomain over HTTPS, then configure your reverse proxy to check every request with it, for example with Traefik's ForwardAuth middleware or Caddy's forward_auth directive. Set the session cookie domain so that one sign-in at the Authelia portal covers every app under that domain.
Require two-factor sign-in for sensitive tools
Write access_control rules with default_policy set to deny, then give each domain a one_factor or two_factor policy, limited to certain users or groups where needed. Users register a security key, passkey or one-time password app, and regulation temporarily locks accounts after repeated failed attempts.
Give apps an OpenID Connect login
Register an application such as Grafana, GitLab or Nextcloud as an OpenID Connect client in the Authelia configuration, following the project's integration guide for that app. Users then sign in through the Authelia portal and the app receives a verified identity.