I've been using Authentik for a while now and absolutely love it. Is it perfect, no, but it's an IdP completely under my control and that definitely makes up for some shortcomings here and there.
this post was submitted on 27 Oct 2026
46 points (100.0% liked)
Selfhosted
63262 readers
465 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
I've been happy with voidauth. It does what I need for the most part.
I'm using authelia for a while now. never had any issues. at some point i was looking into kanidm as more rounded up solution, but i never got around to rest it.
Authentik with passwordless flow. I have two options at login—Sign in with Passkey or Sign in with Google for my family.
Pocket id
Forgejo
Pocket ID is as simple to set up as OIDC can get. I have been using it for around a year without any issues. There is no password option though. It is essentially Passkey only.
Thank you! Gave it a try after finding Authentik a bit too much for what I currently need it for and it is simple and exactly what I needed.
Plus one for Pocket-ID
Dead easy to set up, i don't have to worry about people's weak-shit passwords for local services. Integrates with LDAP if required. Single, tiny (~50 MB) container that uses less than a gig of RAM.
I had 4 services configured, start to finish with automatic account creation if a pocket-id user logged in, within maybe an hour?
Everyone recommends Authelia or Authentik but those are so far and beyond what most self-hosted stuff needs.
I second Pocket ID. I initially set up Authentik, but after discovering Pocket ID and giving it a try, it is way easier to set up and use. Authentik is great if you want to customize everything, but for my needs it was too much. I was able to migrate everything to Pocket ID in an afternoon, whereas Authentik took me several hours over the course of a few days to get set up.
plus one super simple to use. never let me down as oidc for tailscale.
This one, only hard work is to add your services/apps, some of them are easy like immich and some are strange like beszel. Anyway the docs of pocketID have a lot of guides for different services.
Im using Authentik and I'm very happy with it. Ive heard it is a bit clunkier to set up than other options since its meant for enterprise use I think. It was the first option I tried though and I made it work.
Adding my vote for Authentik, it is capable of handling pretty much anything. I have found it a great balance of features and user friendliness.
The documentation is great and Authentik commissioned these great setup videos to walk you through things. https://youtube.com/playlist?list=PLH73rprBo7vSkDq-hAuXOoXx2es-1ExOP
They also have written setup guides for a lot of popular projects. Made it much easier to add OIDC to all my services.
+1 for authentik
Tried it but I was a bit overwhelmed with all of the options. A bit more than I need right now. Thanks for taking the time to reply!
Authelia here
All text config files, so either you love it or hate It
Stable and works fine.
I like it fine until I need to change anything. But I like its relative simplicity.
an admin webui is planned for the future. The only thing that annoyed me thus far was changing existing users emails
I like Authentik, as I really like:
- Support for every auth protocol, particularly OIDC and LDAP
- Invites that can invite multiple people, letting me onboard a room of people at once
- Python based scripting that lets me script some integrations and do API calls when users authenticate
But at the same time, Authentik is very, very complex.
If you just want LDAP and OIDC in the same app, I would probably recommend KanIDM. KanIDM also does invites (although only one user at a time).
If you just want OIDC itself, pocket ID (passwordless /passkey only) and void auth both are really simple OIDC providers (that also support sign ups/invite links. EDIT: Ah, it looks like Void Auth has an experimental read only LDAP server feature. Nice.
I am also paying attention to (some less popular options):
- Rauthy: Fairly minimal, supporting OIDC... but also supports PAM for Linux/Unix integrations
- Casdoor: seems to be feature rich like authentik, but perhaps not as difficult to deploy and configure
- Univention Nubus: An open source, European auth software, that is feature rich, but has an appliance virtual machine that might make it easier to install.
Kanidm!
The project is intended to be secure by default, the documentation is excellent and as kanidm manages authentication they have sensibly adopted a strict anti-LLM policy.
I've used Authelia. I like it because all the config can happen in a config file so I can easily back it up, modify it, and deploy it with Ansible
I have used keycloak for work and home for years and love it. A lot of flexibility, which comes with some additional complexity but there are lots of guides for it.
I've had a decent experience with Authentik so far. I'm definitely no expert, my OIDC experience is limited, but following the Nextcloud guide worked perfectly.
Seconded. It's been great as an OIDC provider, but for services I run which don't support OIDC, it functions great as a reverse proxy auth or LDAP provider too. Was a breeze to migrate users to it from my previous LDAP server
I like Keycloak. It is very configurable, easy to set up, has lots of available examples of configs out there, and has been the most stable for me of any I've tried.
I only wish it had mock-LDAP so I could use it with things that don't do OIDC like OpnSense. Keycloak can use an LDAP server as a source and sync with it, but I don't want want to run a separate LDAP server for one or two systems. They're too much trouble to setup and manage.
I only wish it had mock-LDAP so I could use it with things that don’t do OIDC like OpnSense
KanIDM is probably the simplest auth server that does both OIDC and LDAP in one app. Although Kanidm's LDAP is read only.
I think I tried that one when I was evaluating a few. I really like that Keycloak makes it really easy to configure custom workflows inside the web UI. I have custom user/group permissions flows and some other more complex logic for assigning specific permissions for specific apps built into workflows over the years. So I definitely don't want to switch, but yeah, I'd like a read-only LDAP system that just generates LDAP responses using the existing user data basically like Authentik does. But Authentik was too unstable for my tastes when I tried it for a few months so I ended up back on Keycloak. It was down way more often than it was working and that was without any real major customizing. Plus it wasn't well documented with examples for more complex setups.
i host authelia and use oicd for everything that supports it or autehlia as a middleware if it doesnt, its great
I've been using Keycloak for multiple years now, it has some complexity, because it supports about everything OIDC or SAML offer. I used Authentik before, but ran into limitations with its OIDC token mappers and found its Python codebase to be harder to extend than Keycloak with its properly typed Java API
I started with authelia, but decided I'd rather not fork around with config files all the time ( I didn't have issues with it though ).
Then I switched to voidauth which has more UI. Works well too, but I find the UI a bit confusing to use. It is a bit atypical in the sense that going back and forward between menus is different and bothers me for some reason.
Currently running that in parallel with pocket. I'm charmed by the simplicity of not having to deal with or worry about passwords. It also has a built in dashboard of apps you can access which removes the need ( for me ) to run something else and keep that up to date.
As I already have a nextcloud server in use, I use that as my OIDC provider. Just requires installing the nextcloud app (OIDC Provider) and you can setup clients in the admin dashboard, so people can log into those with their Nextcloud credentials.
I tried athelia and Authentic, and it somehow was not what I was looking for, too much for my needs.
Then I tried tinyauth, which was too little (no User Management at all, users have to be defined in a text file or via Environment variables)
I am now using Voidauth and I am very happy with it. It does what I need perfectly and without a hassle. Which is: Users and Groups, invite links for new users, LDAP server and first of all, it is very easy to use.
I just deployed tinyauth and it actually supports ldap and it can read also ldap groups. Gonna tinker with it more tomorrow, but so far I like the simplicity a lot.
Been using Casdoor for about a year, never had a problem and found it easy enough to set up with good documentation