github.com/authelia/authelia @v4.39.20

[][Apache 2.0]

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for your applications via a web portal. It acts as a companion for reverse proxies by allowing, denying, or redirecting requests.

Documentation is available at https://www.authelia.com/.

The following is a simple diagram of the architecture:

Authelia can be installed as a standalone service from the AUR, APT, FreeBSD Ports, or using a static binary, .deb package, as a container on [Docker] or [Kubernetes].

Deployment can be orchestrated via the Helm Chart (beta) leveraging ingress controllers and ingress configurations.

Here is what Authelia's portal looks like:

<img src="https://www.authelia.com/images/light.png" width="400">












<img src="https://www.authelia.com/images/2fa-methods-light.png" width="400">

Features summary

This is a list of the key features of Authelia:

• OpenID Connect 1.0 / OAuth 2.0
• Several second factor methods:
• Security Keys that support [FIDO2] [WebAuthn] with devices like a [YubiKey].
• Time-based One-Time password with compatible authenticator applications.
• Mobile Push Notifications with Duo.
• Passwordless Authentication via WebAuthn (Passkeys)
• Password reset with identity verification using email confirmation.
• Access restriction after too many invalid authentication attempts.
• Fine-grained access control using rules which match criteria like subdomain, user, user group membership, request uri, request method, and network.
• Choice between one-factor and two-factor policies per-rule.
• Support of basic authentication for endpoints protected by the one-factor policy.
• Highly available using a remote database and Redis as a highly available KV store.
• Compatible with Traefik out of the box using the ForwardAuth middleware.
• Curated configuration from LinuxServer via their SWAG container as well as a guide.
• Compatible with [Caddy] using the forward_auth directive.
• Kubernetes Support:
• Compatible with several Kubernetes Ingress Controllers and Gateways:
  • ingress-nginx
  • Traefik Kubernetes CRD
  • Traefik Kubernetes Ingress
  • Istio
  • Envoy Gateway
• Beta support for installing via Helm using our Charts.

For more details take a look at the [Overview](https://www.authelia.co