A place to share, discuss, discover, assist with, gain assistance for, and critique self-hosted alternatives to our favorite web apps, web services, and online tools.
Authentik and Authelia does it matter ?
I'll preface this all with I'm using Unraid, I have no clue what I'm doing - I have decades old linux knowledge that has a lot of rust on it ... as I've been playing with Unraid I realize I need to learn docker-compose for a variety of reasons.
So I've followed IBRACORP's guides on both Authelia and Authentik; I get them 99.9% setup but can never seem to accomplish the last .1% to actually make them work. It's not all terrible, knocking off a lot of rust .. however, this makes me think of my use-case and the actual need.
I have an 8 x 20tb server, servicing plex, backup's and a myriad of other files ... I like storage. I also "off-site" the most important files to a backup service. I'm the only person (my son eventually) that will access/"work on"/manage the server. I have a password manager I use at all times regardless, so is either A/A worth it ? Is it really needed in my case despite my inability to get them fully working .... I will eventually, when I have time to sit down and learn docker-compose I'll break away from these unraid templates that I think are mostly broken anyway.
Long story short, just looking for opinions on whether Authentik or Authelia are worth it for my use-case.
Cheers!
The way I see it, if it’s one or two applications that you plan to host and use, using their built-in auth is fine, particularly if they have MFA, but for more services than that SSO becomes a lot more useful, especially in cases where the application itself doesn’t offer any form of authentication.
Personally I use keycloak (an alternative to authelia and authentik, and apparently a bit heavier/more complex, but went with what I knew at the time), but I also have around 12 services in my docker environment. All of my services are behind a cloudflared tunnel, and I proxy to my services through the tunnel using cloudflare DNS & Zero Trust. Means I can access my services externally without a VPN, and without port forwarding. On cloudflare I then protect my endpoints using Cloudflare access which sends all authentication requests to keycloak, so I only have to sign in once to access all of my services.
My setup is very likely overkill, but it works well. Like I said though, if you’re comfortable with basic with that your applications offer you, then SSO isn’t strictly necessary.
Thanks for the insight! I’ll look into keycloak too.
My biggest issue is having a newborn, so I think a lot of my issues stem from not having enough uninterrupted screen time to work issues
Depends on your goals to accomplish.
Usually, SSO rollout makes sense if there are many end users accessing services and you want to streamline the onboarding process as well as management of those users. Here, keycloak and authentik are good choices, as they support various protocols to sync and do the auth flows (LDAP, OIDC, SAML etc.).
However, to really make use of it you would typically run some form of directory service (Active Directory, LLDAP, Azure AD) to manage your users, which are then using the IdP to proof their identify and access services.
Note though, that your proxied services must support SSO too. Otherwise, you just have another auth layer in front of the authentication scheme of the proxied service. So you would authenticate via Authentik/Authelia/Keycloak and then also have to login into the actual application again with new creds as no SSO is supported.
If you are the single user of your services, then using the normal username + password logins may be easier then setting up SSO and configuring all corresponding applications for it. Also, as most selfhosted apps do not support SSO.
If you are unsure about SSO and setting it up, it may also be better to not use in production directly due to security reasons. Maybe try it out first on local lan and not rely on it heavily e.g. when exposing stuff.
At my job we are running authentik in conjunction with MS Azure. In my homelab I am using Authelia though, as I do not have many users to manage or sync. You can just create your few users in the Authelia config file and call it a day. Password resets and 2FA via Yubikeys work flawlessly. OIDC works too, setup bit more complex.
Random side facts:
Authelia + LLDAP do not allow for password resets by the users itself. So if you plan to have many users, better use Authentik or Keycloak.
I recommend starting with Authelia and see how it runs and works with your setup and apps.
That sounds like a good idea! I’ll have to set up a test server and play around, I’ve got some smaller equipment I can just load up solely to tinker with. Thanks for the idea!
Having used both, authentik is better, authelia is easier.
Pick your poison
I use Authentik for my office and home lab authentication. Authentik / Keyclock does have a lot of features when compared to Authelia . Try everything and pick whichever fits your needs .
There's a much simpler alternative. Use NPM (Nginx Proxy Manager) as reverse proxy (which you should probably do anyway for publicly exposed services) and use vouch-proxy with it. You can install NPM and vouch-proxy in their own separate containers. Making them work together will take a bit of fiddling but it should be easier than Authentik/Authelia and it will make you learn docker better which you wanted to do anyway.
Getting the reverse proxy going is not simple but I think it's an essential learning experience for a self-hoster. Here's an overview to get you started.
It's unfortunately the case that most self hosted applications don't consume identities from an identity provider, if they even acknowledge multi-user setups at all. So, no not really useful.
The idea is great. That you'll bootstrap accounts on ten services with the cost of only setting up one account on the IP. But the reality is that you'll end up with 11 accounts, signing in twice to each service.
You’re looking at it the wrong way.
Even if the service doesn’t support oauth, saml,oidc — you can still secure it with whatever account you choose.
Configure forward-auth/external-auth in your reverse proxy, and then setup whatever groups and account ACL’s you need in Authentik.
Your reverse proxy will forward the request to your auth service. If that service responds with a 200, then your reverse proxy allows the original request to the backend. Otherwise it will return a 401.
You can secure any service you like, with any account you like, even if it isn’t natively supported.
Comment deleted by user