Authelia must be integrated with a compatible reverse proxy for proxy-based application protection.
The buyer must operate and configure both components, including forwarding the expected request headers.
Evidence source ↗
Authelia
Authelia is open-source, self-hosted identity software that adds authentication and access policies to web applications through a reverse proxy. It supports MFA, SSO, LDAP or file-based users, and an OpenID Connect provider.
Editorial overview
Aggregated Overview
Documentation verifies MFA, proxy-based access policies, LDAP and file authentication, and an OpenID Connect provider. Self-hosting avoids a software subscription but requires configuration and ongoing administration. No reliable public review scores or review themes were verified.
This profile combines documented product information and independent evidence where available. It is not a hands-on test unless TechZella explicitly identifies one.
Authelia Decision Snapshot
A quick way to understand who this product may suit, where its limits matter, and which facts are most relevant before you compare alternatives.
Best suited to
Technically capable teams and self-hosters that operate a reverse proxy and want centralized authentication, MFA, and access rules for web applications.
Look elsewhere if
Buyers seeking a managed identity service, a credential vault, or a supported enterprise directory with provisioning and lifecycle automation should assess other products. Authelia is self-hosted, and its OpenID Connect provider is documented as open beta, and should evaluate alternatives such as Authentik or Keycloak instead.
Platforms
Docker, Kubernetes, Linux, Self-hosted, Web
TechZella assessment
7.0/10
Overview
Authelia is an open-source identity and access service for web applications. It works with a reverse proxy, which sends authorization requests to Authelia before allowing users to reach protected services.
It supports first-factor authentication through LDAP or a local user file, along with second-factor methods and access policies. It is not a password-manager vault: its password functions concern account authentication, changes, and resets.
Authelia — What Sets It Apart?
These are the product-specific differences that may matter when deciding whether the software fits your workflow. They are based on documented evidence rather than a universal ranking.
- Combines reverse-proxy authorization with a user-facing authentication portal, rather than requiring the proxy to implement the full login experience.
- Can authenticate against LDAP directories, including Microsoft Active Directory, or a local file containing users and hashed passwords.
- Provides a self-hosted OpenID Connect provider as well as proxy authorization endpoints.
6 key claims verifiedOur editorial team checked this profile against vendor documentation, company information, product documentation. Supported by 6 documented sources.
Authelia Pros & Cons
Pros
- Free and self-hosted, with no software subscription listed.
- Supports existing LDAP directories and a local-file option.
- Works with several documented reverse-proxy implementations.
- Combines proxy authorization, MFA, and an authentication portal.
- Offers OpenID Connect provider functionality for compatible clients.
Cons
- Requires operators to deploy and maintain the service and compatible proxy.
- OpenID Connect provider is documented as open beta.
- Does not act as an OpenID Connect relying party.
- Does not include an internal user-registration system.
- Not a password vault or consumer password manager.
Authelia Gotchas & Operational Limits
These are documented constraints or practical friction points that may matter before you adopt the product.
The OpenID Connect provider is marked open beta, and the relying-party role is not supported.
Teams should verify client compatibility and beta suitability before making it a dependency for production sign-in.
Evidence source ↗The project advises pinning a version and reviewing release notes because changes can be breaking.
Unplanned automatic upgrades may require configuration or migration work.
Evidence source ↗Authelia Pricing & Plans
Open-source self-hosted software
$0
No software subscription or trial was found. Hosting, configuration, maintenance, and support are operator responsibilities.
Check current pricing →Pricing may change. Verify current plans on the vendor's website.
Authelia Competitors & Alternatives
Compare similar products directly, then see which alternatives may make more sense when your requirements differ.
Direct competitors
These products address broadly similar requirements. The descriptions focus on documented reasons a buyer might compare them with Authelia.
Authelia Features
Authentication
- LDAP authentication, including Microsoft Active Directory
- File-based user database with hashed passwords
- Multi-factor authentication
- WebAuthn and passkey-related support
- Password change and reset options
Access and federation
- Reverse-proxy authorization endpoints
- Resource-level access policies
- OpenID Connect provider for registered clients, documented as open beta
- User and group attributes for identity policies
Operations
- Docker deployment
- Kubernetes deployment options
- SQLite, MySQL, and PostgreSQL storage options
- Command-line utilities and configuration by file or environment variables
Demo & Screenshots
Authelia Specifications
| License and pricing | Open-source software; project reports no monetization model |
|---|---|
| Deployment | Self-hosted; Docker, Kubernetes, standalone packages and binaries |
| Authentication backends | LDAP or local file |
| Storage | SQLite, MySQL, PostgreSQL |
| Reverse proxy support | Traefik, Caddy, Envoy, NGINX, HAProxy, and others; support varies |
| API | HTTP proxy authorization and OpenID Connect endpoints; no general-purpose admin REST API verified |
| Free trial | Not applicable; software is free to deploy |
| Identity lifecycle | No internal user registration; external registration service can be linked |
| OpenID Connect status | Provider role documented as open beta; relying-party role unsupported |
Deployment & System Footprint
Verified installation, hosting, administration, or environment details that can affect implementation.
| Hosting | Self-hosted service, deployable with Docker, Kubernetes, or supported standalone packages and binaries. Source ↗ |
|---|---|
| Authentication backend | LDAP directory or a local file with user records and hashed passwords. Source ↗ |
| Persistent storage | Local SQLite, MySQL, or PostgreSQL storage can hold user preferences, second-factor data, and authentication logs. Source ↗ |
Migration & Lock-In
Documented portability, standards, export, or switching considerations. No switching-cost score is shown unless the evidence supports one.
User directory
Authelia can use an existing LDAP directory or a file-based user database. The documentation does not establish a general migration service for moving users from another identity product.
Evidence source ↗Database upgrades
Authelia automatically checks and upgrades its storage schema on startup; downgrading may require a supported manual schema downgrade.
Evidence source ↗Our evidence-based assessment
TechZella Score
A proprietary editorial score based on product capabilities, usability, value, performance, support and user sentiment evidence.
7.0/10Moderate confidence
Documentation verifies MFA, proxy-based access policies, LDAP and file authentication, and an OpenID Connect provider. Self-hosting avoids a software subscription but requires configuration and ongoing administration. No reliable public review scores or review themes were verified.
Methodology v1.0. The assessment weighs feature coverage (25%), ease of use (15%), value for money (20%), performance (15%), support (10%) and user sentiment (15%), using researched product evidence and verified review evidence where available. It is a TechZella editorial assessment, not a direct user-review average.
Editorial transparency
Our Review Methodology
Key claims are linked to the sources used to verify them. This evidence record is separate from third-party user ratings.
TechZella evaluates software using documented product capabilities, pricing information, usability and value considerations, independent user evidence where available, and competitive context. The assessment is an editorial review, not a hands-on test unless one is explicitly identified. Our editorial assessment is based on 6 documented sources.
What TechZella adds
- Combines reverse-proxy authorization with a user-facing authentication portal, rather than requiring the proxy to implement the full login experience.
- Can authenticate against LDAP directories, including Microsoft Active Directory, or a local file containing users and hashed passwords.
- Provides a self-hosted OpenID Connect provider as well as proxy authorization endpoints.
Important limitations
- Requires administrators to deploy and configure the service alongside a compatible reverse proxy.
- The OpenID Connect provider is documented as an open beta, and Authelia does not support the OpenID Connect relying-party role.
- Authelia does not provide internal user registration; its registration setting can link to a separately operated service.
- No commercial plan, vendor support tier, or free-trial offer was verified.
Evidence-backed claimsAuthelia is an open-source authentication and authorization server designed to work with reverse proxies. Authelia supports LDAP and file-based authentication backends. The OpenID Connect provider is open beta, and the relying-party role is unsupported. Authelia documents integration support for several reverse proxies. Authelia is a community project, not an incorporated company, and states it has no monetization model. Authelia provides OpenID Connect authorization and user-information endpoints for registered clients.
The project describes its role as providing MFA and SSO for applications through a web portal and companion reverse-proxy workflow.
View source ↗Verified 2026-10-08The authentication documentation identifies LDAP directories and a local YAML user file with hashed passwords as backend choices.
View source ↗Verified 2026-10-08The provider documentation states both its beta status and that Authelia does not support acting as an OpenID Connect relying party.
View source ↗Verified 2026-10-08The proxy support table lists Traefik, Caddy, Envoy, NGINX, HAProxy, and other implementations, with support varying by feature and deployment context.
View source ↗Verified 2026-10-08The project's about page describes its volunteer contributors and says it is not a company or incorporated entity.
View source ↗Verified 2026-10-08Its integration guide documents endpoints and configuration for OpenID Connect clients, including a WordPress example.
View source ↗Verified 2026-10-08Community feedback
Reviews
No reviews yet. Be the first to share your experience.
Write a Review
Please log in to submit a review.
FAQ
Is Authelia a password manager? No. It authenticates users and applies access policies; it does not function as a vault for storing and autofilling website credentials.
Does it support LDAP and Active Directory? Yes. Its LDAP backend documentation includes Active Directory among directory options.
Does Authelia have an API? It documents HTTP authorization endpoints for reverse proxies and OpenID Connect endpoints for clients. This should not be confused with a general-purpose administrative REST API.
Can it run in Docker or Kubernetes? Yes. The project documents Docker deployment and supports Kubernetes-oriented deployment options, with some Helm material identified as beta.
Is there a free trial? No trial is listed because the software is free and self-hosted. Users can deploy it themselves.
Recently added software
- OwnID · Identity and Access Management
- Passage by 1Password · Identity and Access Management
- Yubico Authenticator · Multi-Factor Authentication
- Whois.com Lookup Tool · Developer Tools
- Spyse · Cybersecurity Software
- Lean Domain Search · Web Development
- Bulk Whois Lookup (by NirSoft) · Developer Tools
- CheckDomain · Developer APIs