authentik Identity Provider

authentik is an Identity Provider (IdP) and Single Sign-On (SSO) platform designed for security, flexibility, and versatility. It allows site administrators, application developers, and security engineers to implement authentication across various environments.

Key Capabilities

• Protocol Support: Supports major protocols including OAuth2, SAML, LDAP, and SCIM, allowing integration into existing tech stacks without re-architecting.
• User Management: Provides robust recovery actions, including user profile management, password management (setting new passwords or resetting existing ones), and user impersonation.
• Deployment Options: Available as a forever-free open source project and a source-available Enterprise version with a Support center and additional features.

The authentik Agent is a service designed for installation on Linux, macOS, and Windows devices. It enables endpoint devices to integrate with the authentik identity provider through several key capabilities:

• Device compliance: Reports endpoint device information back to authentik.
• Local device login: Allows users to log in to the physical device using their authentik credentials.
• SSH authentication: Enables connecting to endpoint devices via SSH using authentik credentials.
• CLI application authentication: Allows authenticating to CLI tools like kubectl and AWS using authentik credentials.

authentik Enterprise provides licensed capabilities and commercial support for self-hosted authentik installations.

Key characteristics:

• Installation parity: You install and upgrade authentik using the same methods whether you have an Enterprise license or not.
• Feature unlocking: Enterprise features are unlocked automatically upon the installation of a valid license.
• Support: Includes access to commercial support services.

The @goauthentik/geo package is a build-time utility used to generate the hexworld basemap archive. This archive is used by authentik's events map for rendering.

Note: This package is build-time machinery only; it does not ship to the browser. The actual map elements and styles reside in web/src/elements/maps/.

Most third-party services that support standard authentication protocols can be integrated with authentik. This allows users to authenticate into external services using their authentik credentials.

Supported protocols include:

• SAML
• OAuth
• OpenID Connect (OIDC)

In mid-2023, a professional pentest by Cure53 identified several security issues. These were addressed in authentik versions 2023.4.2 and 2023.5.3.

Key findings included:

• High Severity: Web authentication bypass via key confusion (ATH-01-010) and user-password disclosure via frontend form submission (ATH-01-008).
• Medium Severity: Path traversal on blueprints (ATH-01-001), authentication challenge abuse (ATH-01-014), and SSRF via blueprints (ATH-01-007).
• Low Severity: CSS injection via Mermaid (ATH-01-003) and lack of CSRF protection in the impersonate feature (ATH-01-009).
• Information/Info: Timing-unsafe comparisons in API authentication (ATH-01-005) and information disclosure on the /api/v3/admin/system/ endpoint (ATH-01-004).

The authentik Agent supports several authentication and authorization workflows using authentik credentials to secure endpoint devices and applications:

• Local device login: Enables users to log in to Windows endpoint devices.
• SSH authentication: Facilitates secure connections from one endpoint device to another via SSH.
• CLI application authentication: Allows authenticating CLI-based tools such as aws and kubectl using authentik credentials.

Access to specific devices can be managed and restricted using Device access groups.

authentik offers two enterprise tiers. Both include identity provisioning, security, compliance, and device access features.

Enterprise

• Includes all product features listed in the enterprise documentation.
• Includes ticket-based support for qualifying subscriptions.

Enterprise Plus

Includes everything in Enterprise, plus:

• Dedicated support channels (Slack and/or scheduled calls).
• Assistance with onboarding best practices.
• SLA-backed response times.
• Volume discounts for large teams.
• Auditable FIPS-compliant deployments (for FedRAMP requirements).
• Billing and purchase via invoice.

The WS-Federation provider allows integration with applications and service providers using the WS-Federation protocol (e.g., SharePoint). It uses XML-based token exchange for federated Single Sign-On (SSO).

Key Constraints

• Token Type: authentik only supports the SAML2 token type within WS-Federation providers.
• Entra ID Compatibility: Using the WS-Federation provider with Entra ID is not supported because Entra ID requires a SAML 1.0 token.
• Terminology: In WS-Federation, the Identity Provider (IdP) is referred to as the STS (Security Token Service).

The authentik documentation is split into three primary online resources:

• Technical Documentation: General guides on how to use authentik (docs.goauthentik.io).
• Integration Guides: Specific instructions for using authentik with third-party services (integrations.goauthentik.io).
• API Documentation: Detailed reference for the authentik API (api.goauthentik.io).