Authelia

Authelia is an open-source authentication and authorization server that provides identity and access management (IAM) for web applications. It commonly sits behind a reverse proxy to enforce single sign-on (SSO), multi-factor authentication (MFA), and fine-grained access policies.

Key Features

• OpenID Connect 1.0 provider (OpenID Certified) with OAuth 2.0 support for SSO integrations
• Reverse-proxy companion mode to allow, deny, or redirect requests based on authentication state
• Multiple MFA methods including TOTP and WebAuthn/FIDO2 security keys
• Granular authorization policies based on users, groups, domains, and resources
• Brute-force protection and login regulation/lockout controls
• Password reset flows (including LDAP or internal users) with email validation
• High availability-oriented design suitable for running multiple instances

Use Cases

• Protect internal tools and self-hosted apps behind a reverse proxy with SSO and MFA
• Provide an OIDC identity layer for applications that support OAuth2/OIDC login
• Enforce access control policies for different user groups across multiple domains

Authelia is a lightweight, security-focused IAM component that can centralize authentication and authorization for many web applications. It is particularly well-suited for homelabs and organizations that want modern SSO and MFA without adopting a full enterprise directory suite.