What auth apps do you use ive seen authelia, authentik, keycloack but whats overall the best
Developer of VoidAuth here; if you decide to give it a try let me know if you run into any issues during setup, or have any feedback!
Any plans to support FreeBSD in the future? Or mainly focusing on a docker solution?
I did try it out and its great! One issue i had is after logging in it says not found however
Yep switched to aegis a year ago. Works great.
Same. I tried a few other options from F-Droid/Droidify and Aegis was the easiest for me.
I use authentik. It’s probably fairly easy to set up if you use their docker-compose, but I run it as rootless podman, which took a little work to get it converted to a quadlet pod. But now that it’s set up, it works great and handles a variety of self-hosted apps that use saml, oidc, ldap, and forward-auth. It’s one of the few options that handles all the different authentication types natively. I also set up passkeys and standard two-factor time codes.
There are some very helpful authentik youtube tutorials by Cooptonian.
Would you be willing to share that Quadlet? I also run rootless Podman on my main VPS and I’m approaching that point where I have enough services to justify a dedicated IDM solution.
I love authentik
Now it needs no middleware. Just authentik and postgres
The ui is great, features are great, great api. Super easy to self host and manage
Open source, small dedicated team. Can’t ask for more
“The best” depends on what you really need.
Authentik and Authelia are two of the top most quoted solutions, but they aim to be an “everything in one” package, with tons of features a simple homelab will rarely need. They’re aimed more at enterprise-like setups.
On the other end of the spectrum you have e.g. Pocket-ID, which only does OIDC by itself (you can hook up an LDAP server as user database though); but that tradeoff means it uses little to no CPU time, and, in my experience, around 130MB RAM. Given RAM is getting more expensive than gold, one needs to consider memory footprint, especially for older homelab setups. We can’t all be running 256GB nodes after all.
So instead of hunting the mythical “best” solution, decide what features you really need, grab a list of providers that cover those features, and compare them to see what fits your needs best.
I ended up at PocketID. Authentik (and I think authelia too) is good but way more complicated than what I needed for a homelab. A lot of people like VoidAuth, but i didn’t care for the visual style. Don’t think I ever tried keycloak.
my mates and i are also hosting pocketID. it’s solid stuff
Voidauth looks intresting. Thanks!
Authentik is great, super versatile, if not a bit of effort to get it set up initially
I personally run authelia. I prefer the config file over a gui where i have to click everything together. For the actual user storage i got lldap.
But my requirements a possibly different to yours, my main focus was no docker and no javascript backend.
Keycloak is definetly overkill for a homelab. Both in effort to get it to run, and maintaining it.
It has a modest UI for end-users to handle self-service scenarios, and an app portal for OpenID Connect configured applications.
The backend is fully CLI based.
It is very robust and performant, built on Rust.
Yet very much in active development, so do not expect full parity with commercial alternatives at a feature level.
I run it to provision users for my home Linux devices and it supports offline login, my Homelab servers, and my self-hosted web applications through OIDC.
A nice ‘one stop shop’ for my purposes.
EDIT: Actually their comparison page might be a worthwhile read considering your question OP.
Authentik
I used authentik first as it was suggested by a friend with whom we are sharing the vps, and so I kept using that also for another personal vps.
It is a good combination of robustness and flexibility for me, plus we needed a user dashboard or at least a list of apps. Custom workflows, blueprints and stuff were a bit of a pain to understand, so I just copy them between the two install I have because I keep forgetting how everything works. It’s also quite resource-heavy, so I might try something different in the future.
The one built in to Caddy for anything that doesn’t really have authentication. Everything else uses its own and i only have a couple services accessible outside the home.
Most everything is only accessible within my home and my guest wifi is on its own vLAN. Even then I’m the only person who actually uses most things that I setup.
There is no “overall best”, just one that works best for you. I like to keep mine on a managed encrypted server so I use Ente Auth. I think Proton has one as well.
I think they are talking about sso, not 2fa.
Openbao -> keycloak with a TOTP on new devices
The best is pretty subjective and partially relies on what you need.
Keycloak is one of the most feature complete ones I think.
I’ve used authelia before and liked it, but it had a very bare UI and everything was done through config files which forced redeploys on changes. It wasn’t ideal for me.
I’m currently trying out voidauth. It’s got some more Ui features compared to authelia and can apparently also simulate some Active Directory queries to forward your users to third party tools for provisioning ( unless I saw that wrong, I haven’t tested any yet ).
Authentik looked nice, but I haven’t gotten around to checking that one out yet.
