Authelia ORG

!Docker Pulls
![License][Apache 2.0]

Authelia is an open-source authentication and authorization server providing two-factor authentication and single
sign-on (SSO) for your applications via a web portal. It acts as a companion for [reverse proxies](#proxy-support) by
allowing, denying, or redirecting requests.

Documentation is available at https://www.authelia.com/.

The following is a simple diagram of the architecture:

Authelia can be installed as a standalone service from the AUR,
APT,
FreeBSD Ports, or using a
static binary,
.deb package, as a container on [Docker] or [Kubernetes].

Deployment can be orchestrated via the Helm Chart (beta) leveraging ingress controllers
and ingress configurations.

Here is what Authelia's portal looks like:

Features summary

This is a list of the key features of Authelia:

• [OpenID Connect 1.0 / OAuth 2.0](#openid-connect-10--oauth-20)
• Several second factor methods:

* Security Keys that support [FIDO2] [WebAuthn] with devices like a [YubiKey]. * Time-based One-Time password with compatible authenticator applications. * Mobile Push Notifications with Duo.

• Passwordless Authentication via WebAuthn (Passkeys)
• Password reset with identity verification using email confirmation.
• Access restriction after too many invalid authentication attempts.
• Fine-grained access control using rules which match criteria like subdomain, user, user group membership, request uri,

request method, and network.

• Choice between one-factor and two-factor policies per-rule.
• Support of basic authentication for endpoints protected by the one-factor policy.
• Highly available using a remote database and Redis as a highly available KV store.
• Compatible with Traefik out of the box using the

ForwardAuth middleware.

• Curated configuration from LinuxServer via their

SWAG container as well as a guide.

• Compatible with [Caddy] using the forward_auth

directive.

• Kubernetes Support:

* Compatible with several Kubernetes Ingress Controllers and Gateways: * ingress-nginx * Traefik Kubernetes CRD * Traefik Kubernetes Ingress * Istio * Envoy Gateway * Beta support for installing via Helm using our Charts.

For more details take a look at the Overview.

If you want to know more about the roadmap, follow Roadmap.

OpenID Connect 1.0 / OAuth 2.0

Authelia is [OpenID Certified™] to the Basic OP / Implicit OP / Hybrid OP / Form Post OP / Config OP profiles of the
[OpenID Connect™ protocol]. While this offering is still effectively
on the roadmap as a beta it's very comprehensive and well
implemented already, also allowing us comprehensive certification. Read more about the
[OpenID Certified™] status of Authelia in the
OpenID Connect 1.0 Integration Guide.

Proxy support

Authelia works in combination with [nginx], [Traefik], [Caddy], [Skipper], [Envoy], or [HAProxy].

Getting Started

See the Get Started Guide or one of the curated examples
below.

docker compose

The docker compose bundles act as a starting point for anyone wanting to see Authelia in action. You will have to
customize them to your needs as they come with self-signed certificates.

####

…

Collapse