Authelia | Support by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Overview Authelia is an open source authentication and authorization server providing single sign-on and multi-factor authentication for your web applications. It acts as a companion to a reverse proxy: instead of every application implementing its own login, the proxy forwards each request to Authelia, which enforces a per-resource access policy and presents a single, branded login portal with optional two-factor authentication. This image delivers Authelia fully installed and wired into an nginx reverse proxy with a working demo protected application, so a complete forward-authentication gateway is running within minutes of launch.

Application Stack The Authelia server binary installed under /usr/local/bin and run by a dedicated unprivileged service account, bound to loopback so it is never exposed without the proxy. A local SQLite storage database and the file based user database on a dedicated data disk so identity state is independently resizable. An nginx reverse proxy that publishes the Authelia login portal over HTTPS and runs the standard forward-authentication integration. A demo protected location that is guarded by Authelia, so you can see the full redirect-to-portal, log-in, return-to-application flow end to end out of the box.

Forward Authentication The nginx proxy asks Authelia to authorize every request to a protected resource. Unauthenticated requests are redirected to the Authelia portal, the user signs in once, and is returned to the application. The same single sign-on session then satisfies every other application behind the same proxy. Access is governed by a clear per-resource policy: bypass, one factor or two factor.

Secure First Boot On the first boot of your instance a one shot service generates a fresh administrator password, unique to that instance, and fresh cryptographic secrets for the session, the storage encryption key and the identity validation tokens. The password is argon2id hashed into the user database and written to a root only file. No shared or default credentials and no shared secrets ship in the image.

Ready To Use The Authelia portal is served over HTTPS through nginx, and a demo protected page demonstrates the full forward-authentication flow. Sign in with the generated administrator credentials to reach the protected page. Point your own applications at the proxy and add an access control rule to bring them under single sign-on. A simple one line change swaps the bundled demo domain for your own.

cloudimg Support 24/7 technical support by email and chat. Help with deployment, reverse proxy and forward authentication configuration, access control rules, two factor enrolment, LDAP or file user backends, SMTP notifications, TLS and bringing your own applications under single sign-on.

Use Cases A single sign-on and two factor gateway in front of internal web applications. Protecting dashboards, admin panels and home lab services that have no authentication of their own. A self hosted alternative to commercial identity aware proxies. A reference forward-authentication deployment to build your own access controlled stack on.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.