Skip to main content

Authentik

LicenseFOSS problemsMaintenanceSSOUsersTested
MITPermissive license. Preserve the copyright notice. Applies only to the covered code — your surrounding project can stay under any license.Open-CoreActive✅Unlimited✅

Evaluation​

What it is​

Authentik is a self-hosted identity provider supporting OIDC, OAuth2, SAML, and LDAP. It's more fully-featured than Rauthy — covering use cases like LDAP for legacy apps, proxy authentication for apps that don't natively support OIDC, and an admin UI with a visual flow builder for custom authentication flows.

Why it could be useful​

If the app landscape includes services that don't speak OIDC natively, Authentik can proxy authentication in front of them — acting as a gatekeeper even for apps with no built-in SSO support. The flow builder makes it possible to customise login behaviour, add MFA steps, or create invitation-only flows. It's the more powerful option when SSO needs to cover a heterogeneous mix of apps.

Why not to go for it​

Authentik is significantly heavier than Rauthy and has an enterprise tier — some features are paywalled. The admin interface is complex; the flow builder is powerful but takes time to understand. For straightforward OIDC SSO across modern apps, it's more tool than needed. Rauthy is a simpler choice in that case.

Setup​

  1. Add a DNS record pointing auth.<domain> to the server:

    • A record: auth → <ipv4>
    • AAAA record: auth → <ipv6>

  2. In Coolify, go to New Resource → Service, search for Authentik, set the domain, then deploy.

  3. Open https://auth.<domain>/if/flow/initial-setup/ and set the password for the default admin user akadmin.

SMTP​

Set the following environment variables on the Authentik server container in Coolify:

VariableValue
AUTHENTIK_EMAIL__HOST{{team.DEFAULT_SMTP_HOST}}
AUTHENTIK_EMAIL__PORT{{team.DEFAULT_SMTP_PORT}}
AUTHENTIK_EMAIL__USERNAME{{team.DEFAULT_SMTP_USERNAME}}
AUTHENTIK_EMAIL__PASSWORD{{team.DEFAULT_SMTP_PASSWORD}}
AUTHENTIK_EMAIL__FROM{{team.DEFAULT_SMTP_FROM}}
AUTHENTIK_EMAIL__USE_TLStrue

Restart the container after saving.

Branding​

Authentik's user portal shows an icon per application. For a custom brand icon, go to Applications → Applications → [app] → Edit and paste a base64 data URI into the Icon field. A simple SVG with initials works well:

data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij48cmVjdCB3aWR0aD0iNjQiIGhlaWdodD0iNjQiIGZpbGw9IiMxYTFhMmUiIHJ4PSI4Ii8+PHRleHQgeD0iNTAlIiB5PSI1MCUiIGZvbnQtZmFtaWx5PSJBcmlhbCwgc2Fucy1zZXJpZiIgZm9udC13ZWlnaHQ9ImJvbGQiIGZvbnQtc2l6ZT0iMjgiIGZpbGw9IndoaXRlIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBkb21pbmFudC1iYXNlbGluZT0iY2VudHJhbCI+Uko8L3RleHQ+PC9zdmc+

This renders "RJ" in bold white on a dark navy background with rounded corners.

Permission error on redeploy​

Hit a PermissionError on /templates/if/error.html after a redeploy following a migration, even though that directory (restored from the old server) was already correctly owned by authentik, UID 1000. The real cause was one level up: Coolify creates a fresh scaffold directory per service on redeploy (/data/coolify/services/<uuid>/), owned by its own internal UID (9999), mode 700 — Authentik's UID 1000 couldn't even traverse into it to reach the correctly-owned subdirectories underneath. Fixed by opening traversal on the scaffold directory itself, without touching its ownership:

chmod o+x /data/coolify/services/<uuid>/

Then restarted (not full redeploy) the container, and it came up clean.