Authelia

• Self-hosted authentication and authorization platform for web applications (identity and access).
• SSO support across multiple upstream applications via a central portal (identity federation).
• Multi-factor authentication workflows with configurable second factors (access security).
• Policy-driven access control based on user attributes, groups, and resources (policy enforcement).
• Integration with reverse proxies and standard identity directories for centralized access management (access management).

More About Authelia

Authelia is an open-source authentication and authorization server (identity and access) designed to sit in front of web applications, typically behind a reverse proxy, to provide centralized SSO and multi-factor authentication (MFA). It addresses the problem of inconsistent or absent authentication across self-hosted and enterprise web services by acting as a unified identity layer that controls access before traffic reaches upstream applications.

The core capability of Authelia is a dedicated authentication portal (identity federation) that supports single-factor and multi-factor login flows. It enforces configurable policies and grants or denies access through integration with reverse proxies that handle the actual Hypertext Transfer Protocol (HTTP) routing. Access control policies (policy enforcement) can be defined per domain, subdomain, or resource path, with rules that account for user identity, group membership, and required security level, such as whether Multifactor Authentication (MFA) is required.

Authelia integrates with external user directories and identity stores (directory integration), such as LDAP-based directories, to manage user accounts and groups. It supports standard authentication factors (access security), including password-based authentication combined with second factors like time-based one-time passwords (TOTP) or compatible out-of-band mechanisms, depending on what is documented on its official site. Configuration is file-driven, with environment variables also used for containerized deployments.

In enterprise or institutional environments, Authelia is typically deployed alongside reverse proxies (web access gateway), where the proxy authenticates users against Authelia before forwarding requests to protected services. This architecture allows organizations to place internal tools, administrative consoles, or user-facing applications behind a consistent login and MFA layer without modifying the applications themselves. Authelia’s role in this setup is to act as the central decision point for authentication and authorization while the reverse proxy enforces those decisions at the HTTP level.

Authelia’s technical footprint spans identity and access management, reverse-proxy authentication offload, and policy-based access control. It supports deployment via containers and standard web infrastructure components, making it applicable for on-premises (on-prem) and private cloud environments where self-hosted SSO and MFA are required. Within a directory or catalog of enterprise technologies, Authelia fits into the identity and access management category, with specific alignment to web SSO gateways, self-hosted MFA solutions, and reverse-proxy-integrated authentication services.