Authelia
Free open-source identity and access management platform with single sign-on, multi-factor authentication, and OpenID Connect support for secure application access.
Authelia is a comprehensive open-source identity and access management (IAM) solution that provides modern authentication and authorization for your applications. As an OpenID Connect 1.0 certified provider, it delivers enterprise-grade security features while maintaining exceptional performance and ease of use.
Key advantages include:
- Lightweight architecture - Container size under 20MB with memory usage typically below 30MB
- Blazing fast performance - Authorization policies execute in milliseconds with 100ms portal loading times
- Energy efficient - Minimal idle usage and under 1% CPU in small business environments
- Security by design - Built with comprehensive security considerations from the ground up
Core features:
- Single Sign-On (SSO) - Users login once to access multiple applications via session cookies
- Multi-factor authentication - Support for TOTP, WebAuthn, Duo, and passwordless authentication
- Granular authorization policies - Control user and group access to specific resources and domains
- Login regulation - Prevent brute force attacks with configurable attempt limits and lockout periods
- Password reset functionality - Built-in LDAP and internal password reset with email validation
- Identity validation - Email verification required for users without second-factor devices
- High availability - Designed for scalable deployment on platforms like Kubernetes
The intuitive web portal provides a transparent user experience while administrators benefit from flexible policy configuration and comprehensive integration options.
Supports FIDO2 security keys and passkeys so users can register multiple WebAuthn credentials and authenticate with a passkey
Sessions can be configured with custom expiration, inactivity and remember‑me lifetimes allowing long‑lived sessions
Provides translations of the login portal and a language picker with support for multiple locales
Can authenticate users against LDAP directories including Active Directory by configuring the authentication backend to use LDAP
Provides fine‑grained control over bearer tokens including required scopes, audiences and access control rules, ensuring tokens only access permitted resources
Provides integration guides for numerous applications and reverse proxies and supports OpenID Connect and trusted header SSO integration
Provides a Prometheus metrics exporter that allows external monitoring of Authelia's health and performance
Similar to Authelia:
Descope
