Nacho
Authelia IAM Provider
Authelia is a community-driven, open-source (Apache 2.0) 2FA and single sign-on authentication server. It is a forward-auth companion for reverse proxies (nginx, Traefik, Caddy, Envoy, HAProxy, Skipper), authenticating against a file or LDAP backend and issuing access-control decisions to protect self-hosted applications, with an optional built-in OpenID Certified OpenID Connect 1.0 Provider. There is no commercial edition or SaaS offering; the project is entirely community-maintained.
Features
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for Authelia’s OpenID Connect protocol compatibility? View Authelia on the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does Authelia support Username and Password authentication method?
Authelia supports Username and Password authentication method. First-factor authentication against a file (YAML) or LDAP backend, with Argon2id (default) or SHA512 password hashing. Read more
Does Authelia support Social Sign-in authentication method?
Authelia does not support Social Sign-in authentication method. No built-in social/OAuth identity provider login; Authelia is itself an identity provider, not a relying party.
Does Authelia support Passkey authentication method?
Authelia supports Passkey authentication method. Passwordless logins via Passkeys, supported since v4.39.0, in addition to multi-credential WebAuthn security keys. Read more
Does Authelia support Email Passwordless authentication method?
Authelia does not support Email Passwordless authentication method. No email-OTP/magic-link passwordless first factor; password reset and identity verification use emailed links, not authentication itself.
Does Authelia support Phone Passwordless authentication method?
Authelia does not support Phone Passwordless authentication method.
Does Authelia support Magic Link authentication method?
Authelia does not support Magic Link authentication method.
Does Authelia support Anonymous / Guest authentication method?
Authelia does not support Anonymous / Guest authentication method. Access control supports a bypass policy for unauthenticated routing, but there is no anonymous/guest user session concept.
Does Authelia support Time-based One-Time Password (TOTP) MFA?
Authelia supports Time-based One-Time Password (TOTP) MFA. Read more
Does Authelia support HMAC-based One-Time Password (HOTP) MFA?
Authelia does not support HMAC-based One-Time Password (HOTP) MFA. Only TOTP is supported for one-time password second factor; HOTP is not documented.
Does Authelia support Universal 2nd Factor (U2F) MFA?
Authelia partially supports Universal 2nd Factor (U2F) MFA. Legacy FIDO U2F is superseded by FIDO2/WebAuthn security key support. Read more
Does Authelia support WebAuthn MFA?
Authelia supports WebAuthn MFA. FIDO2/WebAuthn hardware security keys (e.g. YubiKey), with multiple credential registration since v4.38.0. Read more
Does Authelia support Email Code MFA?
Authelia does not support Email Code MFA.
Does Authelia support Phone Code MFA?
Authelia does not support Phone Code MFA.
Does Authelia support Push Notification MFA?
Authelia supports Push Notification MFA. Duo Push mobile app second factor, via the third-party Duo API. Read more
Does Authelia support Cisco Duo MFA?
Authelia supports Cisco Duo MFA. Read more
Does Authelia support Step-Up Authentication MFA?
Authelia does not support Step-Up Authentication MFA. OAuth 2.0 Step-up Authentication Challenge is listed as unsupported in the OIDC support chart, though access control policies can require two_factor per route/domain. Read more
Does Authelia support OpenID Connect (OIDC) integration protocol?
Authelia supports OpenID Connect (OIDC) integration protocol. OpenID Certified OpenID Connect 1.0 Provider. Read more
Does Authelia support SAML 2.0 integration protocol?
Authelia does not support SAML 2.0 integration protocol. SAML 2.0 Profile for OAuth 2.0 is listed as unsupported; Authelia does not implement a SAML IdP. Read more
Does Authelia support WS-Federation integration protocol?
Authelia does not support WS-Federation integration protocol.
Does Authelia support Machine-to-Machine (M2M) Authentication integration protocol?
Authelia supports Machine-to-Machine (M2M) Authentication integration protocol. OAuth 2.0 client_credentials grant for statically configured confidential clients. Read more
Does Authelia support OpenID Connect (OIDC) Federation identity federation?
Authelia does not support OpenID Connect (OIDC) Federation identity federation. Authelia is an OIDC Provider only; it does not act as a relying party federating to upstream OIDC IdPs.
Does Authelia support SAML 2.0 Federation identity federation?
Authelia does not support SAML 2.0 Federation identity federation.
Does Authelia support Active Directory / LDAP identity federation?
Authelia supports Active Directory / LDAP identity federation. LDAP authentication backend, with tested implementations for Active Directory, OpenLDAP, LLDAP, FreeIPA, and others. Read more
Does Authelia support Azure Active Directory (Entra ID) identity federation?
Authelia does not support Azure Active Directory (Entra ID) identity federation. Not documented; LDAP integration targets Active Directory/LDAP servers directly, not Azure AD/Entra ID over OIDC/SAML federation.
Does Authelia support Bulk User Import user management?
Authelia does not support Bulk User Import user management. The file backend is manually edited YAML with no bulk import tool; the LDAP backend is managed externally, and no SCIM API exists (open feature request). Read more
Does Authelia support Bulk User Export user management?
Authelia does not support Bulk User Export user management.
Does Authelia support Bulk User Update / Delete user management?
Authelia does not support Bulk User Update / Delete user management.
Does Authelia support Upsert on Import user management?
Authelia does not support Upsert on Import user management.
Does Authelia support MFA Enrollment Import user management?
Authelia does not support MFA Enrollment Import user management.
Does Authelia support Inbound SCIM Provisioning user management?
Authelia does not support Inbound SCIM Provisioning user management. SCIM 2.0 support is an open feature request, not implemented. Read more
Does Authelia support Outbound SCIM Provisioning user management?
Authelia does not support Outbound SCIM Provisioning user management.
Does Authelia support SCIM Groups Provisioning user management?
Authelia does not support SCIM Groups Provisioning user management.
Does Authelia support Just-In-Time (JIT) User Provisioning user management?
Authelia does not support Just-In-Time (JIT) User Provisioning user management. Users must already exist in the file or LDAP backend; Authelia does not create accounts on first login.
Does Authelia support Lazy / Trickle Migration from Legacy Database user management?
Authelia does not support Lazy / Trickle Migration from Legacy Database user management.
Does Authelia support Self-Service Profile Management Portal user management?
Authelia supports Self-Service Profile Management Portal user management. Self-service password reset and WebAuthn/TOTP device registration, gated by emailed identity verification links. Read more
Does Authelia support User Account Linking user management?
Authelia does not support User Account Linking user management.
Does Authelia support User Blocking / Banning user management?
Authelia partially supports User Blocking / Banning user management. Regulation (brute-force ban) temporarily bans a user/IP after repeated failed attempts; there is no persistent admin-triggered account disable in the file/LDAP backends themselves. Read more
Does Authelia support User Metadata user management?
Authelia partially supports User Metadata user management. The file backend supports standard attributes (email, display name, groups) but no arbitrary custom user metadata schema. Read more
Does Authelia support Application Metadata user management?
Authelia does not support Application Metadata user management.
Does Authelia support User Search user management?
Authelia does not support User Search user management. No admin UI or API for searching users; management is via the backing file/LDAP store directly.
Does Authelia support Role-Based Access Control (RBAC) user management?
Authelia partially supports Role-Based Access Control (RBAC) user management. Access control rules match on user/group subjects, domains, resources, methods and networks to assign bypass/one_factor/two_factor/deny policies; this is policy-based rather than a formal role hierarchy. Read more
Does Authelia support Organizations (Multi-Tenancy B2B) user management?
Authelia does not support Organizations (Multi-Tenancy B2B) user management. No multi-organization/tenant model; each deployment is a single instance.
Does Authelia support Password Strength Policies user management?
Authelia supports Password Strength Policies user management. Standard policy (min length, character classes) or zxcvbn-based strength metering. Read more
Does Authelia support Progressive Profiling / Forms user management?
Authelia does not support Progressive Profiling / Forms user management.
Does Authelia support Attribute-Based Access Control (ABAC) access control?
Authelia partially supports Attribute-Based Access Control (ABAC) access control. Access control rules can condition policies on network/subject attributes, but there is no general-purpose attribute-based policy engine beyond the built-in rule matcher. Read more
Does Authelia support Fine-Grained Authorization (FGA / ReBAC) access control?
Authelia supports Fine-Grained Authorization (FGA / ReBAC) access control. Per-domain, per-resource-path, per-method, per-network access control rules with bypass/one_factor/two_factor/deny policies. Read more
Does Authelia support API Authorization (Scopes / Permissions) access control?
Authelia supports API Authorization (Scopes / Permissions) access control. Forward-auth gate for reverse-proxied APIs, plus OAuth 2.0 scopes/audience for OIDC-protected APIs. Read more
Does Authelia support Audit Log Retention security feature?
Authelia supports Audit Log Retention security feature. Structured logs of authentication and authorization events; retention is operator-configured. Read more
Does Authelia support Audit Log Streaming security feature?
Authelia partially supports Audit Log Streaming security feature. Logs can be written to file or stdout for collection by external log shippers/SIEM; no native streaming integration. Read more
Does Authelia support Security Center (Threat Monitoring Dashboard) security feature?
Authelia does not support Security Center (Threat Monitoring Dashboard) security feature.
Does Authelia support Encryption at Rest security feature?
Authelia supports Encryption at Rest security feature. Sensitive fields (TOTP secrets, WebAuthn keys, OIDC session data) are encrypted in the storage backend using a configured HMAC/encryption secret. Read more
Does Authelia support Encryption in Transit security feature?
Authelia supports Encryption in Transit security feature. TLS for the web portal and SMTP notifier, with certificate validation. Read more
Does Authelia support Customer Managed Keys (BYOK) security feature?
Authelia supports Customer Managed Keys (BYOK) security feature. Full key/secret management control via self-hosted deployment, including OIDC JWKS signing keys. Read more
Does Authelia support Bot Detection security feature?
Authelia does not support Bot Detection security feature.
Does Authelia support Brute Force Protection security feature?
Authelia supports Brute Force Protection security feature. Regulation module bans a user after a configurable number of failed attempts within a time window, plus adaptive minimum-delay authentication timing to resist username enumeration. Read more
Does Authelia support Suspicious IP Throttling security feature?
Authelia supports Suspicious IP Throttling security feature. Token-bucket rate limiters on authentication-sensitive endpoints, configurable per use case. Read more
Does Authelia support Breached Password Detection security feature?
Authelia does not support Breached Password Detection security feature. Not documented; password policy covers strength (standard rules or zxcvbn), not breach-corpus checks.
Does Authelia support Tenant Access Control List (IP ACL) security feature?
Authelia does not support Tenant Access Control List (IP ACL) security feature.
Does Authelia support Per-Organization Branding multi-tenancy?
Authelia does not support Per-Organization Branding multi-tenancy. Single-instance deployment; no multi-organization branding model.
Does Authelia support Per-Organization MFA Policy multi-tenancy?
Authelia partially supports Per-Organization MFA Policy multi-tenancy. Second-factor requirements are set per access-control rule (domain/resource/network), not per organization. Read more
Does Authelia support Hosted / Universal Login Page branding feature?
Authelia supports Hosted / Universal Login Page branding feature. Read more
Does Authelia support Embedded / Native Login Components branding feature?
Authelia does not support Embedded / Native Login Components branding feature. Authentication happens on Authelia's own portal; no embeddable widget/SDK-driven inline login.
Does Authelia support White-Label / Full Brand Removal branding feature?
Authelia partially supports White-Label / Full Brand Removal branding feature. Built-in light/dark/auto themes and a configurable logo; full CSS/branding overrides require disabling the default Content-Security-Policy, which the docs discourage. Read more
Does Authelia support Localization / i18n branding feature?
Authelia supports Localization / i18n branding feature. The portal UI is translated into numerous community-contributed languages. Read more
Does Authelia support Prebuilt UI Components (SDK) branding feature?
Authelia does not support Prebuilt UI Components (SDK) branding feature.
Does Authelia support Login / Auth Analytics Dashboard analytics?
Authelia does not support Login / Auth Analytics Dashboard analytics. No built-in analytics dashboard; structured logs can feed external tooling.
Does Authelia support SOC 2 Type II Certification compliance?
Authelia does not support SOC 2 Type II Certification compliance.
Does Authelia support ISO 27001 / 27017 / 27018 Certification compliance?
Authelia does not support ISO 27001 / 27017 / 27018 Certification compliance.
Does Authelia support HIPAA Business Associate Agreement (BAA) compliance?
Authelia does not support HIPAA Business Associate Agreement (BAA) compliance.
Does Authelia support PCI DSS Compliance compliance?
Authelia does not support PCI DSS Compliance compliance.
Does Authelia support CSA STAR Certification compliance?
Authelia does not support CSA STAR Certification compliance.
Does Authelia support FedRAMP Authorization compliance?
Authelia does not support FedRAMP Authorization compliance.
Does Authelia support GDPR: Data Export (Portability) compliance?
Authelia does not support GDPR: Data Export (Portability) compliance. No built-in data export tooling; self-hosted operators have direct access to the backing store.
Does Authelia support GDPR: Right to be Forgotten (User Deletion) compliance?
Authelia does not support GDPR: Right to be Forgotten (User Deletion) compliance. No built-in account deletion API; erasure is a manual operation on the file/LDAP/database backend.
Does Authelia support Consent Management compliance?
Authelia supports Consent Management compliance. OpenID Connect consent screen (pre-configured or interactive) per client/scope. Read more
Does Authelia support Region Deployment compliance?
Authelia supports Region Deployment compliance. Self-hosted in any region; no managed hosting offering exists. Read more
Does Authelia support Private Cloud Deployment compliance?
Authelia supports Private Cloud Deployment compliance. Deployable via Docker, Kubernetes, or bare-metal binary, with SQLite/MySQL/PostgreSQL storage and Redis for HA session state. Read more
Does Authelia support SDK Coverage developer integration?
Authelia does not support SDK Coverage developer integration. No official client SDKs; integration is via standard OAuth 2.0/OIDC libraries or the forward-auth proxy contract.
Does Authelia support Management API developer integration?
Authelia does not support Management API developer integration. No REST management API; configuration is file-based (YAML) with environment variable/secret overrides.
Does Authelia support Authentication API Rate Limits developer integration?
Authelia supports Authentication API Rate Limits developer integration. Configurable per-endpoint rate limiters for authentication-sensitive routes. Read more
Does Authelia support Actions / Extensibility Pipeline developer integration?
Authelia does not support Actions / Extensibility Pipeline developer integration. No scripting/custom-code extensibility hooks; behavior is driven entirely by declarative YAML configuration.
Does Authelia support TypeScript Support in Extensibility developer integration?
Authelia does not support TypeScript Support in Extensibility developer integration.
Does Authelia support Custom Domain developer integration?
Authelia supports Custom Domain developer integration. Self-hosted on any domain, with multi-cookie-domain support for protecting multiple root domains from one instance. Read more
Does Authelia support Deploy CLI (Infrastructure as Code) developer integration?
Authelia supports Deploy CLI (Infrastructure as Code) developer integration. authelia CLI binary and Docker/Kubernetes manifests for configuration validation and deployment; no interactive admin CLI beyond config management. Read more
Does Authelia support Terraform Provider developer integration?
Authelia does not support Terraform Provider developer integration. No official Authelia Terraform provider; configuration is plain YAML, which can be templated by generic Terraform file/template resources.
Does Authelia support Custom Database Connections developer integration?
Authelia supports Custom Database Connections developer integration. SQLite, MySQL/MariaDB, or PostgreSQL storage backends, plus Redis/Redis Sentinel for session/cache high availability. Read more
Does Authelia support Native Webhook Support developer integration?
Authelia does not support Native Webhook Support developer integration. Notification system modernization (webhook notifier) is an open feature request, not yet implemented. Read more
Does Authelia support Universal Login / Hosted Login Page Customization developer integration?
Authelia partially supports Universal Login / Hosted Login Page Customization developer integration. Logo and theme are configurable; deeper HTML/CSS customization requires relaxing the built-in Content-Security-Policy. Read more
Does Authelia support Custom Email Provider (SMTP) developer integration?
Authelia supports Custom Email Provider (SMTP) developer integration. SMTP notifier (with a filesystem notifier for testing only). Read more
Does Authelia support Email Templates developer integration?
Authelia supports Email Templates developer integration. HTML and plaintext notification templates (password reset, WebAuthn/TOTP registration) are overridable per template_path. Read more
Does Authelia support Custom OIDC Claims / Token Enrichment developer integration?
Authelia supports Custom OIDC Claims / Token Enrichment developer integration. Per-client claims_policy configuration maps custom scopes/claims onto ID tokens and userinfo responses. Read more
Does Authelia support No-Code Auth Flow Builder / Orchestration feature?
Authelia does not support No-Code Auth Flow Builder / Orchestration feature.
Does Authelia support Identity Verification / Document Proofing feature?
Authelia does not support Identity Verification / Document Proofing feature.
Does Authelia support Decentralized / Verifiable Credentials feature?
Authelia does not support Decentralized / Verifiable Credentials feature.
Does Authelia support Built-in Billing / Subscription Management feature?
Authelia does not support Built-in Billing / Subscription Management feature.
Does Authelia support Agentic AI / MCP Server Authentication feature?
Authelia does not support Agentic AI / MCP Server Authentication feature. No documented support for AI agent/workload identity tokens beyond standard OAuth 2.0 client_credentials.
Does Authelia support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature?
Authelia does not support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature. No evidence found of ML-DSA/Dilithium, SLH-DSA/SPHINCS+, or FN-DSA/Falcon support for OIDC ID token or JWT signing. Targeted GitHub searches of authelia/authelia issues/discussions for quantum-related terms returned no results. Read more
Does Authelia support Post-Quantum Token & Data Encryption post-quantum cryptography feature?
Authelia does not support Post-Quantum Token & Data Encryption post-quantum cryptography feature. No public evidence found that the provider supports ML-KEM or HPKE (RFC 9180) for encrypting JWE tokens, SAML assertions, or user secrets.
Does Authelia support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature?
Authelia does not support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature. No public evidence found of post-quantum or hybrid X.509 digital certificate support for mTLS client authentication or federation endpoints.
Does Authelia support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature?
Authelia does not support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature. No public evidence found of NIST SP 800-208 stateful hash-based signature scheme support (LMS/HSS, XMSS).
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.