I was interested in Authentik, but I was perusing the docs and was extremely put off by the way in which Authentik manages itself as well as additional “outposts”.

> The docker integration will automatically deploy and manage outpost containers using the Docker HTTP API.

> This integration has the advantage over manual deployments of automatic updates (whenever authentik is updated, it updates the outposts)

NO. I do not want software I use to update itself automatically in prod. And I especially do not want to give a docker socket to it so that it can automatically add new components.

https://goauthentik.io/docs/outposts/integrations/docker

I’ve been a keycloak advocate since my jboss days (really the only good thing that came out of jboss). I have never heard of authentik and I’m so glad you mentioned it, it looks amazing! I had been contemplating doing a similar project but this would satisfy that need. Thank you.

Just be careful with Athentik, it is an extremely young, rapidly developing project. So expect the odd pitfall

Yeah, needs battle hardening, but I like what they are doing and the features it offers so bookmarked and starred!

Arguably best is to not have proxied oauth at all and instead implement oauth in your software.

This looks awesome! I dropped Keycloak because it's 2 GiB of RAM was too much for me to commit to SSO on my tiny VPS, so I just switched to static htpasswd management. But this looks like it might be a great replacement.

It seems to support groups/selective access to services through group membership, which is great. Does it support username authentication or does it require that an LDAP server or other OIDP is used as a source of truth?

Do note that Authentik, being a Python project, still uses a decent amount of RAM IMO.

I think Keycloak 18 should use less memory? Might be worth a try.

Getting cert errors for me when visiting that link. Using a self signed cert by the looks of it?

Edit: Ok now. Looks like they use Let's Encrypt which will default to a self signed cert if it can't get a LE one for whatever reason IIRC.

Looks like it got the internet hug-o-death or something b/c it looks like it's down.