Authelia

Authelia answers your reverse proxy on every request

Authelia is an authentication and authorization server written in Go, licensed Apache-2.0, built as a companion to your reverse proxy. The proxy checks with Authelia on every request, and Authelia answers: let it through, block it, or send the user to the login portal. Request payloads never reach Authelia, so a REST or GraphQL API is protected the same way as a web UI. After signing in, the user holds a session cookie that is valid on every subdomain of the protected domain.

Authelia is also an OpenID Connect provider for apps that can hand off their login. It ships as a static binary, a .deb package and a Docker image.

The comparison of self-hosted SSO tools places Authelia among the portals that sit in front of the reverse proxy, next to full identity providers.

Per-request rules and 2FA for apps without a login

• Apps with no login of their own get one at the proxy: ForwardAuth in Traefik, forward_auth in Caddy, auth_request in NGINX. Apps that trust headers receive the user's identity in Remote-User, Remote-Groups, Remote-Name and Remote-Email.
• Per-request access rules: match on subdomain, user, group, path, HTTP method or source network, and require one or two factors per rule.
• A choice of second factors: WebAuthn security keys such as a YubiKey, TOTP codes, Duo push notifications, and passwordless sign-in with passkeys. Too many failed attempts lock the account for a while.

Users live in YAML or LDAP, and HTTPS is mandatory

Authelia does not manage users. Accounts come from one of two places: a YAML file holding hashed passwords, or an external LDAP directory such as OpenLDAP, FreeIPA, Active Directory or LLDAP. The docs are explicit that Authelia has no registration feature. With the file backend, adding a user means editing the file by hand; Authelia picks up the change when watch is enabled. VoidAuth hooks into the proxy the same way, through ForwardAuth, and manages accounts, groups, invitations and sign-ups from a web UI.

Configuration is a file, and there is no admin console. The docs state that the configuration is static and not set through a web GUI. An admin dashboard is on the roadmap.

HTTPS is mandatory, even for a test run. The session cookie only travels over secure connections, so every app protected through the proxy must be served over https too. The team ruled out plain HTTP to avoid misconfiguration.

The docs recommend PostgreSQL, Redis and SMTP for production. The SQL database stores user preferences, second-factor secrets and authentication logs. SQLite is fine for a trial but prevents running more than one instance; MySQL is supported too. Sessions live in memory by default, and Redis is the recommended store for production and high availability. Identity verification emails go out over SMTP, and writing them to a file is meant for testing only. On resources, the project's website claims a compressed image under 20 MB and memory use normally under 30 MB.

Eight reverse proxies are supported, and Apache is not one of them. The docs' support matrix lists Traefik, Caddy, NGINX, NGINX Proxy Manager, SWAG, HAProxy, Envoy and Skipper, and marks Apache and IIS as unsupported. On Kubernetes, the guides cover ingress-nginx, Traefik, Istio and Envoy Gateway.

OpenID Connect is certified yet still beta, and SAML is not available. Authelia is OpenID Certified for the Basic, Implicit, Hybrid, Form Post and Config OP profiles. The roadmap still labels the OIDC provider a beta that may bring breaking changes. SAML 2.0 is at the stage of picking a library. An app that only speaks SAML needs another provider, such as authentik, which covers SAML alongside OIDC, LDAP and RADIUS.

The 4.39 line has been getting patches since March 2025. v4.39.0 shipped on March 16, 2025 and v4.39.28 on September 17, 2026; eight of those 28 patch releases came out between September 3 and 17, 2026. The README warns that the project is still subject to breaking changes and recommends pinning a version tag rather than latest. It also says the team is looking for sponsorship to pay for a code security audit or a penetration test. The Helm chart is still in beta.