What auth apps do you use ive seen authelia, authentik, keycloack but whats overall the best
It has a modest UI for end-users to handle self-service scenarios, and an app portal for OpenID Connect configured applications.
The backend is fully CLI based.
It is very robust and performant, built on Rust.
Yet very much in active development, so do not expect full parity with commercial alternatives at a feature level.
I run it to provision users for my home Linux devices and it supports offline login, my Homelab servers, and my self-hosted web applications through OIDC.
A nice ‘one stop shop’ for my purposes.
EDIT: Actually their comparison page might be a worthwhile read considering your question OP.
Also switched to Kanidm, and using the Kubernetes operator someone made have made it easy to configure also.
I have custom resources that create HTTPRoutes and then protect public traffic with Kanidm by creating a a OAuthClient per site.
Chefs kiss.
Developer of VoidAuth here; if you decide to give it a try let me know if you run into any issues during setup, or have any feedback!
I did try it out and its great! One issue i had is after logging in it says not found however
Using VoidAuth here, really good software and documentation. Thanks for that piece of freedom !
I use kanidm because the footprint is lower than the alternatives you mention, and it’s written in Rust.
I use authentik. It’s probably fairly easy to set up if you use their docker-compose, but I run it as rootless podman, which took a little work to get it converted to a quadlet pod. But now that it’s set up, it works great and handles a variety of self-hosted apps that use saml, oidc, ldap, and forward-auth. It’s one of the few options that handles all the different authentication types natively. I also set up passkeys and standard two-factor time codes.
There are some very helpful authentik youtube tutorials by Cooptonian.
Would you be willing to share that Quadlet? I also run rootless Podman on my main VPS and I’m approaching that point where I have enough services to justify a dedicated IDM solution.
authentik.pod [Pod] PodName=authentik PublishPort=9000:9000 PublishPort=9443:9443 PublishPort=3389:3389 PublishPort=6636:6636 authenik_db.container [Unit] Description=authentik_db Wants=network-online.target After=network-online.target [Service] Restart=always [Container] EnvironmentFile=.env Pod=authentik.pod ContainerName=authentik_db Image=docker.io/library/postgres:17-alpine AutoUpdate=registry Volume=authentik_db.volume:/var/lib/postgresql/data:Z Environment=POSTGRES_USER=authentik Environment=POSTGRES_DB=authentik [Install] WantedBy=default.target authentik_server.container [Unit] Description=authentik_server Wants=network-online.target After=network-online.target [Service] Restart=always [Container] EnvironmentFile=.env Pod=authentik.pod ContainerName=authentik_server Image=ghcr.io/goauthentik/server:2026.5 Exec=server AutoUpdate=registry Environment=AUTHENTIK_POSTGRESQL__HOST=authentik_db Environment=AUTHENTIK_POSTGRESQL__USER=authentik Environment=AUTHENTIK_POSTGRESQL__NAME=authentik Volume=authentik_media.volume:/data/media:U,Z Volume=authentik_data.volume:/data:U,Z Volume=authentik_templates.volume:/templates:U,Z [Install] WantedBy=default.target authentik_worker.container [Unit] Description=authentik_worker Wants=network-online.target After=network-online.target [Service] Restart=always [Container] EnvironmentFile=.env Pod=authentik.pod ContainerName=authentik_worker Image=ghcr.io/goauthentik/server:2026.5 Exec=worker AutoUpdate=registry Environment=AUTHENTIK_POSTGRESQL__HOST=authentik_db Environment=AUTHENTIK_POSTGRESQL__USER=authentik Environment=AUTHENTIK_POSTGRESQL__NAME=authentik Environment=AUTHENTIK_LISTEN__HTTP=[::]:9001 Environment=AUTHENTIK_LISTEN__METRICS=[::]:9301 Volume=authentik_media.volume:/data/media:U,Z Volume=authentik_data.volume:/data:U,Z Volume=authentik_templates.volume:/templates:U,Z Volume=authentik_certs.volume:/certs:U,Z Volume=/run/user/1000/podman/podman.sock:/var/run/docker.sock:z [Install] WantedBy=default.target authentik_ldap.container [Unit] Description=authentik_ldap Wants=network-online.target After=network-online.target [Service] Restart=always [Container] Pod=authentik.pod ContainerName=authentik_ldap Image=ghcr.io/goauthentik/ldap:2026.5 AutoUpdate=registry Environment=AUTHENTIK_HOST=https://authentik.mydomain.com/ Environment=AUTHENTIK_INSECURE="false" Environment=AUTHENTIK_TOKEN=wowthisisquitethelongandsafetokenthatnoonewilleverhack [Install] WantedBy=default.target ````___`You a real one, much appreciated
The best is pretty subjective and partially relies on what you need.
Keycloak is one of the most feature complete ones I think.
I’ve used authelia before and liked it, but it had a very bare UI and everything was done through config files which forced redeploys on changes. It wasn’t ideal for me.
I’m currently trying out voidauth. It’s got some more Ui features compared to authelia and can apparently also simulate some Active Directory queries to forward your users to third party tools for provisioning ( unless I saw that wrong, I haven’t tested any yet ).
Authentik looked nice, but I haven’t gotten around to checking that one out yet.
I’ll second Pocket-ID.
I originally had Authentik setup. It worked well enough. However, their packaging constantly broke and no-one seemed to care.
Switched to Pocket-ID and won’t be looking back. Passkey-based OAuth was all I wanted anyways. (Also, the logins themselves are noticeably faster!)
I would third this. I only came across pocket id a few days ago and hooked it up to a few containers for testing and it’s really impressed me.
I ended up at PocketID. Authentik (and I think authelia too) is good but way more complicated than what I needed for a homelab. A lot of people like VoidAuth, but i didn’t care for the visual style. Don’t think I ever tried keycloak.
Voidauth looks intresting. Thanks!
I second PocketID if all you’re looking for is Passkeys + forward-auth. The others are overkill.
Authentik
I use Authentik - works well - but I’m prepping to switch to Authelia for the config-based setup.
I updated Authentik across 2 versions (they did 2 month-long supported tags, missed one; now they do 3 month-long supported tags) and it destroyed itself. Had to recover the DB from a backup (and then step through the version I tried to skip), and while I was doing that I was like “wait why does this have only a DB? Should just be a config file cause that’s all the depth I do with it” and lo that’s what Authelia is.
Authentik is audited and Authelia has not been. Initially while I chose Authentik. But config-file robustness in the face of Authentik’s GUI-setup DB imploding swayed me not to care, it’d take so long and be so tedious to redo all my proxies and auths through the GUI. Plus I always forget what to click in the GUI when I come back to add some new program in 4 months.
Authentik is great, super versatile, if not a bit of effort to get it set up initially
I like Ente, and according to their docs you can spin up your own host.
I use Stratum on android and GNOME Authenticator on Linux desktop
I tried authelia when it was new and could get it to work right, so switched to keycloak.
I used authentik first as it was suggested by a friend with whom we are sharing the vps, and so I kept using that also for another personal vps.
It is a good combination of robustness and flexibility for me, plus we needed a user dashboard or at least a list of apps. Custom workflows, blueprints and stuff were a bit of a pain to understand, so I just copy them between the two install I have because I keep forgetting how everything works. It’s also quite resource-heavy, so I might try something different in the future.
I personally run authelia. I prefer the config file over a gui where i have to click everything together. For the actual user storage i got lldap.
But my requirements a possibly different to yours, my main focus was no docker and no javascript backend.
Keycloak is definetly overkill for a homelab. Both in effort to get it to run, and maintaining it.
