~/ossroster.com
≡
hometoolsarticlescategoriesalternativesabout
~/tools/authelia
Authelia
tool

Authelia

Authelia is an open source authentication and SSO server you self-host — a lightweight Keycloak alternative that adds single sign-on, two-factor auth, and access control in front of your apps through your reverse proxy.

visit website ↗ repository ↗

What is Authelia?

Authelia is an open source authentication and authorization server that adds single sign-on (SSO) and multi-factor authentication to apps behind your reverse proxy. It runs as a companion to proxies like Traefik, nginx, and Caddy, intercepting requests and gating access through a login portal before traffic ever reaches your services.

What is Authelia best for?

Authelia is best for homelabbers and small teams who want a consistent login and 2FA layer in front of self-hosted apps without running a heavyweight identity platform. It shines when your apps already handle their own users and you just need an authentication gate — configured as code, ideal for GitOps and reverse-proxy setups.

What can Authelia do?

  • Provide single sign-on across all apps behind your reverse proxy
  • Enforce multi-factor auth: FIDO2/WebAuthn security keys, TOTP one-time passwords, and Duo push
  • Support passwordless login with WebAuthn passkeys
  • Apply fine-grained, per-domain and per-path access control rules
  • Act as a certified OpenID Connect 1.0 / OAuth 2.0 provider for apps that speak OIDC
  • Integrate out of the box with nginx, Traefik, Caddy, Envoy, HAProxy, and Skipper
  • Authenticate against LDAP/Active Directory or a flat file, with built-in password reset
  • Regulate brute-force attempts with login throttling and run highly available with Redis and a remote database

Is Authelia free?

Yes — Authelia is completely free and open source under the Apache 2.0 license. There is no paid tier, managed cloud, or open-core upsell: you self-host it and pay only for the server it runs on. The container is under 20MB and typically uses less than 30MB of memory, so it runs comfortably on modest hardware.

Where does Authelia fall short?

  • It is not a full identity provider. There is no admin UI for managing users — accounts live in YAML or an LDAP backend, so it assumes you bring your own user store.
  • Configuration is file-driven (configuration.yml), which is great for GitOps but a steeper start than a click-through dashboard.
  • It depends on a reverse proxy to do its job; it is not a standalone app gateway, and the proxy integration is where most setup mistakes happen.

What does Authelia replace?

Authelia is a self-hosted alternative to hosted identity platforms like Auth0 and Okta, giving you SSO and MFA without per-active-user pricing or sending auth data to a third party. It also overlaps heavily with Keycloak — Authelia trades Keycloak’s full user-management and federation features for a far lighter footprint and config-as-code simplicity.

FAQ

Is Authelia open source? Yes. Authelia is licensed under Apache 2.0, a permissive OSI-approved license, and its full source is public and auditable on GitHub.

Can I self-host Authelia for free? Yes — self-hosting is the only way to run it, and it is entirely free. You install it via Docker, Kubernetes, a binary, or your package manager and pay only for your own infrastructure.

Is Authelia a good Keycloak alternative? For lightweight SSO and 2FA in front of existing apps, yes — it is dramatically smaller and simpler. If you need full identity management, user self-service, and broad federation, Keycloak remains the more complete choice.

What do I need to run Authelia? A supported reverse proxy (nginx, Traefik, Caddy, and others), a user backend (LDAP/Active Directory or a file), and optionally Redis plus a database like PostgreSQL for session storage and high availability.