Skip to content
OpenSourceSoftware.ai
Authelia logo

Authelia

authelia · Identity & access

GitHub stars

29,440
—Awaiting first sync

Awaiting first sync

No measured star history yet

What is Authelia?

Authelia gives a set of web applications one sign-in page with two-factor checks, without changing the apps themselves. It sits next to your reverse proxy, which asks Authelia before letting each request through. You write plain rules about who can reach which app, from which network and with how many sign-in factors.

Authelia is an open-source authentication and authorisation server that adds single sign-on and two-factor sign-in to web applications through a login portal. It works alongside reverse proxies such as nginx, Traefik, Caddy, HAProxy and Envoy, which ask Authelia whether to allow, deny or redirect each request. It can also act as an OpenID Connect 1.0 provider for apps that support that standard.

Core capabilities

  • Two-factor sign-in with security keys and passkeys, one-time password apps or Duo push notifications.
  • Access rules by domain, user, group, network, path and HTTP method, each set to one or two factors.
  • Works with nginx, Traefik, Caddy, HAProxy, Envoy and common Kubernetes ingress controllers.

A login portal for your reverse proxy

Authelia does not serve your applications itself. Your reverse proxy sends each request to Authelia first, and Authelia allows it, denies it or redirects the user to its login portal. Supported proxies include nginx, Traefik, Caddy, Skipper, Envoy and HAProxy. On Kubernetes it works with ingress-nginx, Traefik, Istio and Envoy Gateway.

  • Reverse proxy
  • Forward auth
  • SSO
  • Kubernetes

Two-factor sign-in and access rules

Second factors include FIDO2 WebAuthn security keys such as a YubiKey, time-based one-time passwords and Duo push notifications, and passkeys allow sign-in without a password. Password reset is verified by email, and repeated failed sign-ins lead to a temporary lockout. Access rules match on domain, user, group, network, path, HTTP method and query, are checked in order, and set each match to bypass, deny, one factor or two factors. Authelia is also OpenID Certified as an OpenID Connect 1.0 provider, a feature the project still describes as an open beta.

  • MFA
  • Passkeys
  • WebAuthn
  • Access control
  • OpenID Connect

Run it as a container or a single binary

Authelia is licensed under Apache-2.0. It is available as a container for Docker or Kubernetes, a static binary, a .deb package, through APT, the AUR and FreeBSD Ports, and as a Helm chart in beta. It must be served over HTTPS and needs a user store (a YAML file or LDAP), a database (SQLite for small setups, or PostgreSQL or MySQL), session settings and a notifier such as SMTP. Redis is recommended for sessions in production, and the project advises pinning a version tag because releases can contain breaking changes.

  • Apache-2.0
  • Docker
  • Helm
  • LDAP
  • PostgreSQL

Where it fits

Use cases

  1. 01

    Put self-hosted apps behind one login

    Run Authelia on its own subdomain over HTTPS, then configure your reverse proxy to check every request with it, for example with Traefik's ForwardAuth middleware or Caddy's forward_auth directive. Set the session cookie domain so that one sign-in at the Authelia portal covers every app under that domain.

  2. 02

    Require two-factor sign-in for sensitive tools

    Write access_control rules with default_policy set to deny, then give each domain a one_factor or two_factor policy, limited to certain users or groups where needed. Users register a security key, passkey or one-time password app, and regulation temporarily locks accounts after repeated failed attempts.

  3. 03

    Give apps an OpenID Connect login

    Register an application such as Grafana, GitLab or Nextcloud as an OpenID Connect client in the Authelia configuration, following the project's integration guide for that app. Users then sign in through the Authelia portal and the app receives a verified identity.