Authentik Identity Provider on Linux for SSO and MFA

Authentik is a flexible open-source identity provider for SSO, MFA, and application proxy flows. If you already run multiple self-hosted apps with separate logins, Authentik centralizes authentication with OIDC/SAML and gives you policies that Authelia-style forward-auth setups often outgrow.

Prerequisites

• Linux host with Docker Compose and at least 4 GB RAM
• DNS for auth.example.com
• SMTP optional but recommended for invites and password recovery

Step 1: Bootstrap Authentik Compose Stack

mkdir -p /opt/authentik && cd /opt/authentik
curl -sL https://goauthentik.io/docker-compose.yml -o docker-compose.yml
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
echo "AUTHENTIK_ERROR_REPORTING__ENABLED=false" >> .env
chmod 600 .env
docker compose pull
docker compose up -d
[...]

Step 2: Create the Initial Admin

# Visit http://YOUR_IP:9000/if/flow/initial-setup/ once
# Create akadmin with a strong password, then stop publishing 9000 publicly.
# Prefer binding only localhost and putting Nginx in front.

Step 3: TLS Reverse Proxy

sudo tee /etc/nginx/sites-available/authentik >/dev/null <<'EOF'
server {
    listen 80;
    server_name auth.example.com;
    location / {
        proxy_pass http://127.0.0.1:9000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
[...]

Step 4: Create an OIDC Application

In Authentik Admin → Applications → Create with Provider. Choose OAuth2/OpenID Provider, set redirect URIs for your app (for example Gitea or Grafana), and copy client ID/secret into the application config. Attach a policy that requires MFA for privileged groups.

# Example app redirect URIs
https://git.example.com/user/oauth2/authentik/callback
https://grafana.example.com/login/generic_oauth

Step 5: Enforce MFA

• Create a stage prompting TOTP or WebAuthn enrollment.
• Bind the stage to the authentication flow for admin and ops groups.
• Keep a break-glass local recovery account offline and documented.

Step 6: Backup

cd /opt/authentik
docker compose exec -T postgresql pg_dump -U authentik authentik > /var/backups/authentik-$(date +%F).sql
cp .env /var/backups/authentik-env-$(date +%F).bak
# Media and custom assets live in Docker volumes — include them in your backup set.

Production Checklist

• Treat Authentik as a tier-0 service: monitor uptime and certificate expiry.
• Protect AUTHENTIK_SECRET_KEY and database credentials.
• Disable public registration unless you intentionally run a community IdP.
• Use groups and policies instead of one shared admin account for all apps.
• Test SSO login and logout flows after every Authentik upgrade.

"SSO reduces password sprawl only when the identity provider itself has MFA, backups, and a recovery plan."