What auth apps do you use ive seen authelia, authentik, keycloack but whats overall the best

  • Harold@feddit.nlEnglish
    2·
    24 days ago

    Kanidm

    It has a modest UI for end-users to handle self-service scenarios, and an app portal for OpenID Connect configured applications.

    The backend is fully CLI based.

    It is very robust and performant, built on Rust.

    Yet very much in active development, so do not expect full parity with commercial alternatives at a feature level.

    I run it to provision users for my home Linux devices and it supports offline login, my Homelab servers, and my self-hosted web applications through OIDC.

    A nice ‘one stop shop’ for my purposes.

    EDIT: Actually their comparison page might be a worthwhile read considering your question OP.

    • cultist@feddit.dkEnglish
      1·
      24 days ago

      Also switched to Kanidm, and using the Kubernetes operator someone made have made it easy to configure also.

      I have custom resources that create HTTPRoutes and then protect public traffic with Kanidm by creating a a OAuthClient per site.

      Chefs kiss.

  • motogo@feddit.dkEnglish
    1·
    23 days ago

    I use kanidm because the footprint is lower than the alternatives you mention, and it’s written in Rust.

  • lilith267@lemmy.blahaj.zoneEnglish
    1·
    23 days ago

    Its really stange seeing kanidm basically never mentioned in these types of threads dispite how perfect it is for selfhosting: great documentation, incredibly easy to get setup, easy to make a custom themed/setup auth page, lets users name themselves how they prefer instead of requiring “firstname lastname” (why does every service need a lastname when it never gets used?)

    Authelia and authentik are cool but are way more complex then you need for authenticating a couple services and for me at least feel “bloated” for my usecase

    • gajahmada@awful.systemsEnglish
      1·
      23 days ago

      Its really stange seeing kanidm basically never mentioned in these types of threads

      I think the no-nonsense, minimal hype and visual contribute to that. Also, the name didn’t automatically conjure “authentication” like authentik/authelia/pocket-id does, so maybe people just gloss over it.

      I’ll probably tried this over now that I’m aware. Thanks for sharing.

  • The Zen Cow Says Mu@infosec.pubEnglish
    1·
    23 days ago

    I use authentik. It’s probably fairly easy to set up if you use their docker-compose, but I run it as rootless podman, which took a little work to get it converted to a quadlet pod. But now that it’s set up, it works great and handles a variety of self-hosted apps that use saml, oidc, ldap, and forward-auth. It’s one of the few options that handles all the different authentication types natively. I also set up passkeys and standard two-factor time codes.

    There are some very helpful authentik youtube tutorials by Cooptonian.

    • jabberwock@lemmy.dbzer0.comEnglish
      0·
      22 days ago

      Would you be willing to share that Quadlet? I also run rootless Podman on my main VPS and I’m approaching that point where I have enough services to justify a dedicated IDM solution.

      • The Zen Cow Says Mu@infosec.pubEnglish
        1·
        22 days ago
        authentik.pod
[Pod]
PodName=authentik
PublishPort=9000:9000
PublishPort=9443:9443
PublishPort=3389:3389
PublishPort=6636:6636

authenik_db.container
[Unit]
Description=authentik_db
Wants=network-online.target
After=network-online.target

[Service]
Restart=always


[Container]
EnvironmentFile=.env
Pod=authentik.pod
ContainerName=authentik_db
Image=docker.io/library/postgres:17-alpine
AutoUpdate=registry
Volume=authentik_db.volume:/var/lib/postgresql/data:Z
Environment=POSTGRES_USER=authentik
Environment=POSTGRES_DB=authentik

[Install]
WantedBy=default.target

authentik_server.container
[Unit]
Description=authentik_server
Wants=network-online.target
After=network-online.target

[Service]
Restart=always


[Container]
EnvironmentFile=.env
Pod=authentik.pod
ContainerName=authentik_server
Image=ghcr.io/goauthentik/server:2026.5
Exec=server
AutoUpdate=registry
Environment=AUTHENTIK_POSTGRESQL__HOST=authentik_db
Environment=AUTHENTIK_POSTGRESQL__USER=authentik
Environment=AUTHENTIK_POSTGRESQL__NAME=authentik
Volume=authentik_media.volume:/data/media:U,Z
Volume=authentik_data.volume:/data:U,Z
Volume=authentik_templates.volume:/templates:U,Z


[Install]
WantedBy=default.target

authentik_worker.container
[Unit]
Description=authentik_worker
Wants=network-online.target
After=network-online.target

[Service]
Restart=always


[Container]
EnvironmentFile=.env
Pod=authentik.pod
ContainerName=authentik_worker
Image=ghcr.io/goauthentik/server:2026.5
Exec=worker
AutoUpdate=registry
Environment=AUTHENTIK_POSTGRESQL__HOST=authentik_db
Environment=AUTHENTIK_POSTGRESQL__USER=authentik
Environment=AUTHENTIK_POSTGRESQL__NAME=authentik
Environment=AUTHENTIK_LISTEN__HTTP=[::]:9001
Environment=AUTHENTIK_LISTEN__METRICS=[::]:9301
Volume=authentik_media.volume:/data/media:U,Z
Volume=authentik_data.volume:/data:U,Z
Volume=authentik_templates.volume:/templates:U,Z
Volume=authentik_certs.volume:/certs:U,Z
Volume=/run/user/1000/podman/podman.sock:/var/run/docker.sock:z
[Install]
WantedBy=default.target

authentik_ldap.container
[Unit]
Description=authentik_ldap
Wants=network-online.target
After=network-online.target

[Service]
Restart=always


[Container]
Pod=authentik.pod
ContainerName=authentik_ldap
Image=ghcr.io/goauthentik/ldap:2026.5
AutoUpdate=registry
Environment=AUTHENTIK_HOST=https://authentik.mydomain.com/
Environment=AUTHENTIK_INSECURE="false"
Environment=AUTHENTIK_TOKEN=wowthisisquitethelongandsafetokenthatnoonewilleverhack
[Install]
WantedBy=default.target
````___`
  • Evotech@lemmy.worldEnglish
    1·
    23 days ago

    I love authentik

    Now it needs no middleware. Just authentik and postgres

    The ui is great, features are great, great api. Super easy to self host and manage

    Open source, small dedicated team. Can’t ask for more