Comparing Authelia, Authentik, Keycloak, and ZITADEL#
If you enjoyed this article, you can support the author by becoming a sponsor on Boosty (link in the contacts section).
Introduction#
Today we’ll compare four popular solutions for SSO and authorization, in simple terms: authentication and authorization servers - Authelia, Authentik, Keycloak, and Zitadel. If you’re building your own home, or maybe even work, infrastructure and don’t know what to choose - this article/video is for you.
When you deploy several services, especially ones exposed to the outside world - Nextcloud, Plex, really any service - the question arises: how do you centrally manage login, passwords, and access rights? SSO - Single Sign-On - lets you authenticate once and use that access everywhere. And you can also add two-factor auth, LDAP, OAuth2, split up roles, and configure access policies. For a breakdown of exactly how TOTP, WebAuthn, and passwordless login differ and which to choose, I have a separate article.
Authelia vs Authentik vs Keycloak vs ZITADEL - what to choose for authentication and SSO?#
If you’re building your own infrastructure and looking for a way to implement centralized authentication, two-factor protection, and SSO (Single Sign-On), you’ve most likely run into solutions like Authelia, Authentik, Keycloak, and ZITADEL. They all solve the same problem - access management - but they do it differently and are aimed at different scenarios.
In this article I’ll compare all four tools in detail and suggest which solution best fits your needs: from a simple self-hosted setup to corporate and/or cloud solutions.
We’ll look at 4 open-source solutions. I’ve ordered them alphabetically, but oddly enough, this split also happens to line up with a split in built-in functionality - present in the first pair but absent in the second.
- Authelia - simple and strict,
- Authentik - beautiful and flexible,
- Keycloak - powerful, strict, corporate,
- Zitadel - cloud-based, with a modern API.
Authelia#
Authelia is a self-hosted reverse proxy companion designed to protect web applications with two-factor authentication and access control. Authelia works as a proxy companion, adding security and SSO on top of NGINX, Traefik, or HAProxy.
Authelia leans more toward being a reverse proxy guard. It’s reasonably simple to install, with YAML-based configuration. It works as an intermediate layer between the user and your services. There’s no full-fledged UI for managing users - everything goes through the config. Good fit if you have 5-10 services and want to keep everything in config-as-code.
I covered a step-by-step installation and setup of Authelia in Docker in a separate article.
Key characteristics of Authelia#
| Characteristic | Description |
|---|---|
| Language | Go, React |
| SSO support | OIDC as a client only (not a full-fledged IdP) |
| 2FA | TOTP, WebAuthn, Duo (including push notifications) |
| UI | Limited (has a web login page, but admin configuration is via YAML) |
| LDAP/AD | Yes, for authorization and groups |
| Reverse-proxy support | Full: Traefik, NGINX, HAProxy |
| Scalability | Yes, supports Redis, MariaDB/Postgres |
| Target audience | Self-hosted homelab environments and small offices |
Authentik#
Authentik is a modern open-source IdP written in Python (Django) that offers full support for OIDC, SAML, SCIM, a UI, and powerful access policies. It’s designed for both home and corporate solutions.
Authentik is a visually pleasant, modular, and flexible solution. Simple to install via Docker, excellent documentation. Supports OAuth2, SAML, LDAP, and many other providers. You can build custom policies, UI flows, and custom login templates.
A detailed review of Authentik’s architecture and capabilities is in a separate article, and step-by-step practical guidance on installation, proxy/OIDC providers, and specific scenarios (invitations, password recovery, 2FA, email notifications, Cloudflare Turnstile) is covered in a series of articles in the SSO category.
Key characteristics of Authentik#
| Characteristic | Description |
|---|---|
| Language | Python (Django) |
| SSO support | OIDC, SAML (as IdP and SP) |
| 2FA | TOTP, WebAuthn, Email OTP, Duo, Push, Social Login |
| UI | Modern interface |
| LDAP/AD | Yes (as a user source) |
| Workflow / Policies | Yes, visual flows, policies, and more |
| Scalability | Yes (Docker, Kubernetes, Redis, PostgreSQL support) |
| Target audience | Self-hosted, SMB (small and medium business), DevOps |
Advantages of Authelia and Authentik#
Both of these solutions have a built-in web proxy. This means that, integrating seamlessly with a reverse proxy, both solutions can work with applications that have no built-in OIDC mechanism or only support basic HTTP authentication.
Keycloak#
Keycloak is an enterprise open-source solution from Red Hat, designed for centralized authentication and authorization. It’s one of the most powerful and flexible IdPs on the market, supporting OIDC, SAML, Kerberos, LDAP, and so on.
Keycloak is a genuine beast. Support for practically every protocol and scenario. Used in enterprise projects, but requires significant expertise. Configuration can be cumbersome at times, the interface is overloaded, but this solution really does have everything - just like in Greece.
I covered step-by-step installation, docker-compose configuration, and the first startup with realm creation in a separate article.
Key characteristics of Keycloak#
| Characteristic | Description |
|---|---|
| Language | Java (Quarkus, previously WildFly) |
| SSO support | OIDC, SAML, Kerberos, Social Login |
| 2FA | TOTP, SMS, Email OTP, WebAuthn |
| UI | Powerful, but some may find it overloaded and confusing |
| LDAP/AD | Yes (broad support) |
| Extensibility | Yes, via SPI, extensions, and the REST API |
| Scalability | Excellent, especially for enterprise |
| Target audience | Large enterprise, government institutions |
Zitadel#
ZITADEL is a modern, open-source, cloud-native Identity & Access Management solution developed in Switzerland. Its main focus is on security, developers, DevOps, and multitenancy. Available both as a cloud platform and as a self-hosted solution.
Zitadel is the youngest of the bunch, but already fairly mature. It has both a cloud version and an open-source version for Docker. Very clean and minimalist UI, a modern API and SDK, well-suited for a dev-first approach. Well documented, though there’s still room for improvement. It’s already being actively and widely adopted.
More details on ZITADEL’s installation and architecture are in a separate article.
Key characteristics of ZITADEL#
| Characteristic | Description |
|---|---|
| Language | Go |
| SSO support | OIDC, SAML, SCIM |
| 2FA | WebAuthn, TOTP, SMS, Email |
| UI | Modern, minimalist, logical, and pleasant |
| LDAP/AD | Only with the enterprise subscription (see documentation) |
| Multi-tenant support | Yes (one of its main features) |
| Scalability | Very high, cloud-first solution |
| Target audience | SaaS platforms, DevOps, developers |
Overall comparison table#
| Characteristic | Authelia | Authentik | Keycloak | ZITADEL |
|---|---|---|---|---|
| Development language | Go | Python (Django) | Java (Quarkus/WildFly) | Go |
| Installation method | Docker, Kubernetes, Binary | Docker, Kubernetes, Binary | Docker, Kubernetes, ZIP distribution | Docker, Kubernetes, Cloud |
| SSO support (OIDC/SAML) | OIDC (as client) | OIDC, SAML (IdP and SP) | OIDC, SAML, Kerberos | OIDC, SAML, SCIM |
| Web UI | Limited | Yes (modern UI) | Yes (rich, but complex) | Yes (minimalist UI) |
| 2FA / MFA support | TOTP, WebAuthn, Duo | TOTP, WebAuthn, Email OTP | TOTP, WebAuthn, Email, SMS | TOTP, WebAuthn, SMS, Email |
| LDAP / AD integration | Authorization via LDAP | Yes (as a user source) | Yes | Enterprise only |
| RBAC / ABAC | Via YAML and policy | Yes (flow-based) | Yes (groups, roles, policies) | Yes (RBAC + conditions) |
| Scalability | Medium | Good | Excellent | Excellent |
| Cloud-ready | No | No | Partial | Yes |
| Open source | Yes (Apache 2.0) | Yes (MIT) | Yes (Apache 2.0) | Yes (GNU Affero GPL v3.0) |
Conclusions#
Authelia is not a full-fledged IdP; rather it serves as an intermediate authentication layer between the user and the application.
Authentik is actively developed and convenient for self-hosted scenarios with a good UI.
Keycloak is powerful but heavy. Suited for corporate use.
ZITADEL is cloud-oriented but has a self-hosted option, with an emphasis on developers and security.
