Authentik
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| MITPermissive license. Preserve the copyright notice. Applies only to the covered code — your surrounding project can stay under any license. | Open-Core | Active | ✅ | Unlimited | ✅ |
Description
Authentik is a self-hosted identity provider supporting OIDC, OAuth2, SAML, and LDAP. More fully-featured than Rauthy — covering use cases like LDAP for legacy apps, proxy authentication for apps that don't natively support OIDC, and an admin UI with a visual flow builder for custom authentication flows.
Features
- Multi-protocol support — OIDC, OAuth2, SAML, and LDAP, covering apps that don't all speak the same protocol.
- Proxy authentication — acts as a gatekeeper in front of apps with no built-in SSO support at all, not just ones that already speak OIDC.
- Visual flow builder — customise login behaviour, add MFA steps, or create invitation-only flows through an admin UI, not just config files.
Usage patterns
- Heterogeneous app landscape — the more powerful option when SSO needs to cover a mix of apps, some of which don't speak OIDC natively; Authentik can proxy authentication in front of those too.
- Not for straightforward OIDC-only SSO — significantly heavier than Rauthy, with an admin interface and flow builder that take real time to understand — more tool than needed for modern apps that already speak OIDC cleanly.
License and governance
MIT for the core platform, flagged Open-Core in this catalog — some features sit behind a separate enterprise tier within the same codebase.
Conclusion
Why you would — the more powerful option when SSO needs to cover a heterogeneous mix of apps, including ones with no native OIDC support at all — the flow builder and proxy authentication cover cases Rauthy can't.
Why you wouldn't — significantly heavier than Rauthy, with a complex admin interface and an enterprise tier gating some features. For straightforward OIDC SSO across modern apps, it's more tool than needed — Rauthy is the simpler choice there. See Setup for the actual deploy steps and known issues.