Authelia
This is an authentication and authorization server designed to provide identity and access management (IAM) for web applications. It provides security features such as multi-factor authentication (MFA) and single sign-on (SSO) through a web portal. As an OpenID Connect 1.0 Provider, Authelia enables integrations and acts as a companion for reverse proxies, making it an good solution for both individuals and organizations looking to secure their web infrastructure.
It serves as an intermediary between users and the web applications they wish to access. It authenticates users, authorizes their access based on granular policies, and manages sessions, while ensuring that only legitimate users can reach protected resources. Rather than being directly exposed to the internet, Authelia typically works alongside reverse proxies such as nginx, Traefik, Caddy, Envoy, and HAProxy. This design allows it to intercept authentication requests and enforce security policies without requiring changes to the backend applications themselves.
Written in Go and React, which contributes to its light footprint and high performance. The application can be deployed in various environments, including standalone installations, containers (Docker, Kubernetes), and even package managers for different operating systems. This flexibility ensures that Authelia can be integrated into a wide range of deployment scenarios, from small self-hosted setups to large enterprise infrastructures.
Why Use Authelia?
The primary motivation for using Authelia is to help the security and user experience of web applications. Many self-hosted or legacy web apps lack built-in authentication mechanisms or only offer basic username and password protection. Authelia addresses these shortcomings by providing:
- Single Sign-On (SSO), Users authenticate once through Authelia and gain access to multiple applications without needing to log in repeatedly. This improves convenience and reduces password fatigue.
- Multi-Factor Authentication (MFA), Authelia supports several second-factor methods, including time-based one-time passwords (TOTP), mobile push notifications, and hardware security keys using FIDO2 WebAuthn. This significantly raises the security bar compared to password-only systems.
- Granular Access Control, Administrators can define fine-grained policies specifying which users or groups can access specific resources, domains, or endpoints. These policies can be tailored to enforce one-factor or two-factor authentication as needed.
- Passwordless Authentication, With support for passkeys and WebAuthn, Authelia enables secure, passwordless logins, aligning with modern authentication trends.
- Declarative Configuration, All settings are managed through configuration files rather than a web UI, making it easy to automate deployments and maintain consistency across environments. This approach is particularly beneficial for DevOps workflows and infrastructure-as-code practices.
- Integration with Reverse Proxies, By acting as a companion to reverse proxies, Authelia can protect virtually any web application, even those without native authentication support.