authentik
gunkanmaki.authentik
A Docker Compose file for authentik alone, generated from the catalog and checked by the safety inspector. No account needed.
Identity provider and single sign-on server supporting OAuth2, OIDC, SAML, LDAP and proxy-based authentication, with a flow engine that composes login, enrolment and recovery as editable stages.
authentik models every user-facing process — login, enrolment, password recovery, multi-factor setup — as a flow made of ordered stages, so an authentication journey is configured rather than coded. It acts as an identity provider over OIDC, SAML and LDAP, and as an outpost proxy that puts authentication in front of applications with no native support for it. Directory sources can be federated from LDAP, Active Directory and social providers, with mapping expressions written in Python. A first deployment creates the initial administrator through the one-time setup flow, then registers one application and its provider.
You know it worked when
- The interface loads and the initial administrator can sign in.
- An application and its provider appear in the applications list.
- A test client completes an OIDC authorisation and receives a token.
- A user assigned to the application can reach it and one not assigned cannot.
- Multi-factor enrolment completes through its flow.
Known sharp edges
- A secret key plus PostgreSQL and Redis backing services must be configured before first start, and the server will not initialise without them.
- The initial administrator is created through a setup URL that is only reachable while no user exists; missing that window means recovering through the database.
- Flows are freely editable and it is possible to save a configuration that locks every account out of the interface, including the administrator.
- Outpost proxies run as separate containers and must reach the core over a URL that resolves identically from inside the deployment network.