Authentik

Overview

Authentik is an open-source identity provider focused on being approachable to self-host while still covering enterprise protocols. It supports OIDC, SAML, LDAP, SCIM, and a forward-auth proxy, and is popular in homelab and SMB settings for its clean admin interface and flexible, flow-based authentication engine.

Capability deep-dive

Authentik's strengths are authentication and SSO breadth with low setup friction. Its configurable login flows (stages you chain together) make complex MFA and conditional logic approachable, and the built-in proxy lets you put SSO in front of apps that have no native auth. Protocol coverage including SCIM and LDAP is good for the category. Weaknesses: fine-grained authorization is basic compared with Ory Keto, the project leans on a single company so the contributor base and partner ecosystem are smaller than Keycloak's, and some enterprise features and support sit in the paid edition. Scaling and HA are doable but require your own work. A strong, friendly option that is still maturing on the governance and authorization fronts.

Pricing

Open source and free to self-host. A paid Enterprise edition adds support, RBAC enhancements, and other features; a managed cloud option is also offered.

Bottom line

The most user-friendly self-hosted IdP for small teams and homelabs, with surprisingly broad protocol support. Look elsewhere if you need deep authorization or a big enterprise ecosystem.