Authelia

Definition

Authelia is an open-source authentication and authorization server that adds single sign-on and multi-factor authentication in front of self-hosted web applications, typically deployed alongside a reverse proxy such as Nginx, Traefik, or Caddy. It lets homelab operators and small organizations protect a collection of internal services with one shared login and access policy instead of configuring authentication separately in each application.

Overview

Self-hosters and small teams running several internal web applications, such as dashboards, media servers, or admin panels, often lack a centralized way to require login and enforce access rules before requests reach those services, especially when the applications themselves have weak or no built-in authentication. Authelia addresses this by sitting in front of a reverse proxy and intercepting requests to decide whether a user is authenticated and authorized before the proxy forwards traffic to the protected application. Authelia works as a companion service that a reverse proxy calls via a forward-authentication mechanism: when a request arrives for a protected domain, the proxy asks Authelia whether the request is authenticated, and if not, the user is redirected to Authelia's login portal. After successful authentication, which can include a password plus a second factor such as a time-based one-time code or WebAuthn security key, Authelia issues a session cookie scoped across the protected domains, providing single sign-on across every service behind the same proxy. Access control rules define which users or groups can reach which domains or paths. Within the self-hosted identity space, Authelia is most often compared with Authentik and Keycloak. Authelia is lighter-weight and configuration-file driven, aimed specifically at reverse-proxy-based deployments protecting a set of existing web apps, whereas Keycloak is a fuller, heavier identity provider supporting OAuth2/OIDC client registration for building custom applications, and Authentik sits somewhere between the two with a more full-featured web UI. This separation also makes it straightforward to protect a newly added self-hosted application: pointing its subdomain at the same reverse proxy and adding an access rule is typically all that is required, without modifying the application itself. In practice, homelab operators and small teams use Authelia to add a shared login screen and multi-factor authentication in front of self-hosted tools that otherwise have no authentication or weak built-in login, consolidating security policy in one place rather than configuring it per application. Authelia requires a reverse proxy already in place and configuration files (or a supported database backend) defining users, groups, and access rules, which is more setup than a SaaS identity provider. It is also primarily suited to protecting existing web applications behind a proxy rather than serving as a full OIDC provider for applications that need to natively integrate a login flow, though it has grown limited OIDC provider capability over time. Because policy evaluation happens before a request ever reaches the protected application, a service with no authentication of its own, or a weak one, is treated identically to a properly secured service from Authelia's perspective, since access is enforced entirely at the proxy layer.

Key Features

• Adds single sign-on in front of self-hosted web applications
• Integrates with reverse proxies via forward authentication
• Supports multi-factor authentication including TOTP and WebAuthn
• Defines access control rules by user, group, domain, or path
• Runs as a lightweight, configuration-file-driven service
• Issues session cookies shared across protected domains
• Supports multiple authentication backends including LDAP
• Offers growing OpenID Connect provider capabilities

Use Cases

Alternatives

Frequently Asked Questions

Related in Cybersecurity