TiloBox
Back to directory
Authelia project preview
SecurityAlternative to OktaAlternative to Duo Security

Authelia

The Single Sign-On Multi-Factor portal for reverse proxies alternative to Okta.

View on GitHub Visit website
LicenseApache-2.0
GitHub stars28.7k
Last commit1 weeks ago
Tags6 topics
WebauthnSsoAuthenticationReverse Proxy2faGolang
Overview

Why consider Authelia?

Authelia is an open-source authentication server that adds 2FA and Single Sign-On to reverse proxies (Traefik, Nginx, Caddy). It supports TOTP, WebAuthn/Duo, and LDAP.

Guided learning

Learn Authelia by building

Practical setup notes, real use cases, and copy-ready examples in one focused guide.

3 min read 10 sections
In this guide10 sections

What is Authelia?

Authelia is an open-source, high-performance authentication server and Single Sign-On (SSO) gateway written in Go. Designed to integrate seamlessly with reverse proxies like Traefik, Nginx, Caddy, Envoy, and HAProxy, Authelia protects web applications by requiring multi-factor authentication before proxying requests to downstream services.

It serves as a lightweight, on-premises alternative to proprietary enterprise identity and access management tools like Okta, Duo Security, and Cloudflare Access.

Who Is It For?

  • Sysadmins & DevOps Engineers: Protecting internal infrastructure dashboards (Kibana, Proxmox, Sonarr, Grafana) behind multi-factor authentication with minimal resource overhead.
  • Security Teams: Enforcing two-factor authentication policies (WebAuthn hardware tokens, TOTP apps) across distributed microservices.
  • Homelabbers: Implementing seamless Single Sign-On across all private local domain subdomains (*.home.example.com).

Key Features

  • Native reverse proxy Forward Auth integration for Traefik, Nginx, Caddy, HAProxy, and Envoy.
  • Built-in OpenID Connect (OIDC) identity provider server for modern applications with native SSO.
  • Multiple second-factor authentication methods: FIDO2 WebAuthn (YubiKey), TOTP authenticator apps, Duo Push notifications.
  • Flexible user directory backends: File-based YAML, LDAP, or Active Directory.
  • Granular access control policies: Enforce 1FA, 2FA, or bypass rules based on user groups, requested resource paths, or source IP subnets.

Deploying Authelia with Docker Compose

yaml
1version: '3.8'
2
3services:
4 authelia:
5 image: authelia/authelia:latest
6 container_name: authelia
7 restart: unless-stopped
8 volumes:
9 - ./config:/config
10 ports:
11 - 9091:9091
12 environment:
13 - TZ=UTC
14 depends_on:
15 - redis
16
17 redis:
18 image: redis:7-alpine
19 container_name: authelia_redis
20 restart: unless-stopped
21 volumes:
22 - ./redis_data:/data

Create config/configuration.yml specifying your session secrets, user database, and access control rules:

yaml
1jwt_secret: a_very_secure_jwt_secret_string_32_chars
2default_redirection_url: https://auth.example.com
3
4server:
5 host: 0.0.0.0
6 port: 9091
7
8log:
9 level: info
10
11session:
12 name: authelia_session
13 domain: example.com
14 secret: a_very_secure_session_secret_32_chars
15
16storage:
17 local:
18 path: /config/db.sqlite3
19
20notifier:
21 filesystem:
22 filename: /config/notification.txt
23
24access_control:
25 default_policy: deny
26 rules:
27 - domain: "secure.example.com"
28 policy: two_factor

Start the instance:

bash
1docker compose up -d

Practical Use Cases

1. Forward Auth Gateway for Traefik

A DevOps team configures Traefik with an authelia middleware; all requests to *.internal.company.com verify authentication tokens with Authelia before hitting backend services.

2. YubiKey Hardware Token Enforcement

An administrator configures strict policies requiring FIDO2 WebAuthn physical security keys for accessing production deployment control panels.

3. Subnet-Based Access Policy Filtering

A homelabber configures Authelia to allow 1FA password login from the local home Wi-Fi subnet (192.168.1.0/24), but mandate 2FA WebAuthn verification when accessing from external public IPs.

Troubleshooting and Limitations

  • Root Domain Cookie Scope: Ensure the session cookie domain is configured to your top-level domain (example.com) so session authentication persists across all subdomains (app1.example.com, app2.example.com).
  • Notification Provider: For production two-factor onboarding, replace the filesystem notifier with an active SMTP email provider so users receive secure enrollment links.

Official Resources

Related tools

More options with a similar category or technology profile.

boringproxy logo

boringproxy

Simple, self-hosted reverse proxy and tunnel manager for exposing private web services securely.

OWASP ModSecurity logo

OWASP ModSecurity

Open-source Web Application Firewall (WAF) engine providing cross-platform HTTP security inspection.

OpenCTI logo

OpenCTI

Open-source platform for managing cyber threat intelligence knowledge and STIX2 relationships.

Maltrail logo

Maltrail

Malicious traffic detection system utilizing public blacklists and heuristic traffic behavior analysis.

Authelia FAQs

Authelia is listed as a Security tool on TiloBox. Review the overview, features, and official documentation on this page to decide whether it solves your specific workflow.

Start with the project's GitHub repository and official website for supported installation and deployment instructions. Test the setup with representative data or a small project before rolling it out more widely.

Authelia is listed under the Apache-2.0 license. Read the complete license text and the project's notices before using, modifying, or distributing the software.

Production readiness depends on your requirements. Review maintenance activity, security practices, documentation, backup and upgrade procedures, and compatibility with your stack; then validate it in a non-production environment.

Authelia is listed as an alternative to Okta. Compare the core workflow, deployment model, integrations, and licensing against your must-have requirements before switching.