--- title: "Authelia Review 2026: SSO, 2FA & Alternatives | IDSync" description: "Authelia review: free Apache-2.0 SSO, 2FA and OIDC provider for Traefik, NGINX, Caddy and HAProxy; LDAP/AD backends, passkeys, limitations and alternatives." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "SoftwareApplication", "name": "Authelia", "applicationCategory": "SecurityApplication", "applicationSubCategory": "Identity & Access Management", "url": "https://www.authelia.com/", "description": "Authelia is \"an open-source authentication and authorization server and portal fulfilling the identity and access management (IAM) role\" that \"acts as a companion for common reverse proxies\": Traefik, NGINX, Caddy, HAProxy, Envoy, SWAG, NGINX Proxy Manager and Skipper. It provides single sign-on via a session cookie, second factors including one-time passwords, security keys and passkeys (WebAuthn) and Duo/mobile push, granular access-control policies, login regulation against brute force, and an OpenID Connect 1.0 provider. Users come from LDAP (OpenLDAP, OpenDJ, FreeIPA, Microsoft Active Directory) or a YAML file; storage supports PostgreSQL, MySQL and SQLite3. Written in Go and React, it targets a container under 20 MB and memory under 30 MB, and deploys on Docker, Kubernetes or bare metal in high-availability configurations. Licensed Apache 2.0 with about 29k GitHub stars; no commercial edition is offered.", "offers": { "@type": "Offer", "category": "free" }, "dateModified": "2026-09-17T14:54:49.51078+00:00" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is Authelia?", "acceptedAnswer": { "@type": "Answer", "text": "Authelia is \"an open-source authentication and authorization server and portal fulfilling the identity and access management (IAM) role\" that \"acts as a companion for common reverse proxies\": Traefik, NGINX, Caddy, HAProxy, Envoy, SWAG, NGINX Proxy Manager and Skipper. It provides single sign-on via a session cookie, second factors including one-time passwords, security keys and passkeys (WebAuthn) and Duo/mobile push, granular access-control policies, login regulation against brute force, and an OpenID Connect 1.0 provider. Users come from LDAP (OpenLDAP, OpenDJ, FreeIPA, Microsoft Active Directory) or a YAML file; storage supports PostgreSQL, MySQL and SQLite3. Written in Go and React, it targets a container under 20 MB and memory under 30 MB, and deploys on Docker, Kubernetes or bare metal in high-availability configurations. Licensed Apache 2.0 with about 29k GitHub stars; no commercial edition is offered." } }, { "@type": "Question", "name": "Who is Authelia best for?", "acceptedAnswer": { "@type": "Answer", "text": "Self-hosters, homelabs and small platform teams that want free SSO and 2FA in front of web apps behind an existing reverse proxy." } } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Directory", "item": "https://idsync.com/directory" }, { "@type": "ListItem", "position": 3, "name": "Authelia", "item": "https://idsync.com/directory/authelia" } ] } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Directory](/directory) 3. Authelia AU # Authelia Apache-2.0 open-source authentication and authorization server that adds SSO, two-factor and passkey login and access-control rules in front of applications via reverse proxies, and acts as an OpenID Connect 1.0 provider. Last updated today [Visit site](https://www.authelia.com/) Quick answer ## What is Authelia? Short answer Authelia is "an open-source authentication and authorization server and portal fulfilling the identity and access management (IAM) role" that "acts as a companion for common reverse proxies": Traefik, NGINX, Caddy, HAProxy, Envoy, SWAG, NGINX Proxy Manager and Skipper. It provides single sign-on via a session cookie, second factors including one-time passwords, security keys and passkeys (WebAuthn) and Duo/mobile push, granular access-control policies, login regulation against brute force, and an OpenID Connect 1.0 provider. Users come from LDAP (OpenLDAP, OpenDJ, FreeIPA, Microsoft Active Directory) or a YAML file; storage supports PostgreSQL, MySQL and SQLite3. Written in Go and React, it targets a container under 20 MB and memory under 30 MB, and deploys on Docker, Kubernetes or bare metal in high-availability configurations. Licensed Apache 2.0 with about 29k GitHub stars; no commercial edition is offered. Best for Self-hosters, homelabs and small platform teams that want free SSO and 2FA in front of web apps behind an existing reverse proxy. When to choose You run apps behind a reverse proxy, want zero-cost SSO, 2FA and OIDC, and are comfortable operating it yourself. When not to choose You need commercial support, SCIM or lifecycle management, a managed service, or an IdP for thousands of workforce users. Related tools & categories [Ory](/directory/ory)[Zitadel](/directory/zitadel)[Run the IAM Stack Finder](/stack-finder)[Report: The State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) ## Categories ## Common use cases - Adding 2FA and SSO to self-hosted web apps behind Traefik, NGINX or Caddy - Acting as an OpenID Connect provider for internal services - Enforcing per-domain and per-path access rules by user or group - Protecting admin dashboards on homelab and small-business servers ## Strengths - Free, Apache-2.0 licensed with a large community (about 29k GitHub stars) - Lightweight Go binary: sub-20 MB container and sub-30 MB typical memory - Supports TOTP, WebAuthn passkeys and security keys, and Duo push as second factors - Works with most popular reverse proxies and LDAP or Active Directory backends ## Limitations & considerations - No vendor, SLA or paid support; community-supported only - Requires a reverse proxy and, for LDAP, an external directory; the only built-in user store is a YAML file - No hosted or SaaS option; you operate the database, session store and SMTP notifier - Narrow scope versus full IdPs: no user lifecycle, SCIM or admin UI for user management ## Pricing model summary Free and open source (Apache 2.0). No paid tiers, hosted edition or commercial support offering are listed by the project. ## Integrations Traefik NGINX Caddy HAProxy Envoy SWAG NGINX Proxy Manager Skipper LDAP Active Directory FreeIPA OpenLDAP PostgreSQL MySQL SQLite Duo OpenID Connect ## Fit Company size startup, smb Deployment self\_hosted Source open source Pricing model free ## Alternatives & comparisons [Ory](/directory/ory) Open source identity, authorization and zero trust stack (Kratos, Hydra, Keto, Oathkeeper) available self-hosted or as Ory Network SaaS. [Compare Authelia vs Ory →](/compare/authelia-vs-ory) [Zitadel](/directory/zitadel) Open source identity and access platform with built-in multi-tenancy, SSO, MFA and a managed Zitadel Cloud SaaS. [Compare Authelia vs Zitadel →](/compare/authelia-vs-zitadel) [FusionAuth](/directory/fusionauth) FusionAuth is a comprehensive authentication and user management platform offering flexible deployment (self-hosted, private cloud, or FusionAuth Cloud), developer-friendly APIs, and broad feature coverage including SSO, MFA, SAML, OIDC, and multi-tenancy. [Compare Authelia vs FusionAuth →](/compare/authelia-vs-fusionauth) [Keycloak](/directory/keycloak) Keycloak is the most widely deployed open source IAM platform, providing enterprise-grade SSO, MFA, SAML, OIDC, LDAP, and Kerberos support in a self-hosted, Apache 2.0 licensed package maintained by Red Hat. [Compare Authelia vs Keycloak →](/compare/authelia-vs-keycloak) ## Related glossary terms Key identity & access terms relevant to Authelia. [Single Sign-On](/glossary/single-sign-on)[Multi-Factor Authentication](/glossary/multi-factor-authentication)[OpenID Connect](/glossary/openid-connect)[TOTP](/glossary/totp)[WebAuthn](/glossary/webauthn)[Passkeys](/glossary/passkeys)[Lightweight Directory Access Protocol](/glossary/ldap)[Identity Provider](/glossary/identity-provider) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). Authelia and its logo are trademarks of their respective owner. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. ### Take action [Request vendor shortlist](/request-shortlist)[Run the IAM Stack Finder](/stack-finder)[Request vendor intro](/contact)[Docs ↗](https://www.authelia.com/overview/prologue/introduction/) ### Work at Authelia? Claim this profile to keep it current. Claim this profile [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. ### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) ### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) ### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) ### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSYNC® is a registered trademark of TRZ Holdings, Inc. and InnerApps, LLC (U.S. Trademark Registration No. 4,263,864). IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio, part of the TRZ Holdings family. The IDSync® Active Directory synchronizer is a distinct product, now at [identitysyncronizer.com](https://identitysyncronizer.com) — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.