# authentik > Bring all of your authentication into a unified platform. This file contains the full text of all authentik documentation pages, following the llmstxt.org convention. Related: [Documentation](https://docs.goauthentik.io/llms.txt) ## Integrate with Applications # Applications Most third-party services that support authentication protocols such as SAML, OAuth, and OpenID Connect can be integrated with authentik, allowing users to log in to these services using their authentik credentials. If you don't see an application you're looking for, let us know. You can reach us on [GitHub](https://github.com/goauthentik/authentik), [Discord](https://goauthentik.io/discord), or via email to [hello@goauthentik.io](mailto\:hello@goauthentik.io). You can also add your own documentation for a new application integration following [these instructions](#add-a-new-application). All documented app integrations will have one of these badges: - : Community maintained. - : Supported by the vendor. - : Regularly tested by the authentik team. - : Deprecated and may be removed. ### Add a new application To add documentation for a new application (with support level Community or Vendor), please use the integration template [`service.md`](https://github.com/goauthentik/authentik/blob/main/website/integrations/template/service.md) file from our GitHub repo. You can download the template file using the following command: ```shell wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/integrations/template/service.md ``` --- ## Integrations overview ## What is an integration? An integration is how authentik connects to third-party applications, directories, and other identity providers. Integrations can cover application access, source authentication, directory synchronization, provisioning, and operational workflows such as log forwarding. ### Applications Applications include vendor tools such as Google Workspace, GitHub, Slack, or AWS. These applications can be integrated with authentik to provide single sign-on, provisioning, policy-based access, or other workflow-specific connections. If you want to integrate an application that isn't listed, authentik can be configured to work with most applications that support authentication protocols such as [SAML](/docs/add-secure-apps/providers/saml), [OAuth and OpenID Connect](/docs/add-secure-apps/providers/oauth2). To learn more, refer to the [Applications](./applications.mdx) page. ### Federated and social sources Sources let authentik use external user credentials for authentication. Supported source integrations include federated directories like Active Directory and social logins such as Facebook and Twitter. These integrations support all major protocols, including [LDAP](/docs/users-sources/sources/protocols/ldap), [SCIM](/docs/users-sources/sources/protocols/scim), [SAML](/docs/users-sources/sources/protocols/saml), and [OAuth and OpenID Connect](/docs/users-sources/sources/protocols/oauth). To learn more, refer to the [Sources](/docs/users-sources/sources) page. ### Operational integrations Operational integrations connect authentik to systems that support administration, monitoring, compliance, and automation. These guides can include log forwarding, machine-to-machine identity, or product-specific configuration that is not limited to user authentication. --- ## Integrate with AFFiNE ## What is AFFiNE? > AFFiNE is an open-source, self-hostable workspace for documents, whiteboards, and databases. > > \-- [https://affine.pro/](https://affine.pro/) ## Preparation The following placeholders are used in this guide: - `affine.company` is the FQDN of the AFFiNE installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of AFFiNE with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://affine.company/oauth/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## AFFiNE configuration 1. Log in to AFFiNE as an administrator. 2. Click your profile picture and navigate to **Admin Panel** > **Settings** > **OAuth**. 3. Under **OIDC OAuth provider config**, set the following JSON data: ```json { "args": {}, "issuer": "https://authentik.company/application/o/", "clientId": "", "clientSecret": "" } ``` 4. Save the changes. ## Configuration verification To confirm that authentik is properly configured with AFFiNE, open AFFiNE and log in using the **Continue with OIDC** login option. You should be redirected to authentik for authentication and then redirected back to AFFiNE. ## Resources - [AFFiNE OAuth 2.0 documentation](https://docs.affine.pro/self-host-affine/administer/oauth-2-0#oidc) - [AFFiNE OIDC provider source](https://github.com/toeverything/AFFiNE/blob/canary/packages/backend/server/src/plugins/oauth/providers/oidc.ts) --- ## Integrate with ChatGPT ## What is ChatGPT? > ChatGPT is OpenAI's conversational AI platform that provides chat-based assistance across the web and desktop applications. > > \-- [https://chatgpt.com](https://chatgpt.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ChatGPT supports SSO with either OIDC or SAML. Choose one protocol and follow the matching tab throughout this guide. ## authentik configuration To support the integration of ChatGPT with authentik, you need to create an application/provider pair in authentik. In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. ### Create an OIDC property mapping ChatGPT expects a `family_name` claim in the OIDC profile data. Create a dedicated profile scope mapping so authentik sends the claim together with the standard profile values. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**. 3. Select **Scope Mapping** and set the following values: - **Mapping Name**: enter a descriptive name, such as `ChatGPT OIDC profile`. - **Scope name**: `profile` - **Expression**: ```py title="ChatGPT OIDC profile scope mapping" name = request.user.name or request.user.username name_parts = name.split(" ", 1) given_name = request.user.attributes.get("given_name", name_parts[0]) family_name = request.user.attributes.get( "family_name", name_parts[1] if len(name_parts) > 1 else "", ) return { "name": name, "given_name": given_name, "family_name": family_name, "preferred_username": request.user.username, } ``` 4. Click **Finish** to save the property mapping. ### Create an OIDC application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Temporarily add a **Redirect URI** of type `Strict` `Authorization` as `https://temp.temp`. - Select any available **Signing Key**. - Under **Advanced protocol settings**, in **Scopes**, replace `authentik default OAuth Mapping: OpenID 'profile'` with the ChatGPT profile scope mapping that you created. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. ### Create a SAML application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** to `https://temp.temp`. - Under **Advanced protocol settings**, set **Signing Certificate** to use any available certificate. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the SAML signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section. 3. Under **Related objects** > **Download signing certificate**, click **Download**. This downloaded file is required in the next section. ## ChatGPT configuration ChatGPT only enables SSO setup after you verify ownership of your domain. Domain verification and domain mapping are outside the scope of this guide. Refer to the [OpenAI SSO configuration documentation](https://help.openai.com/en/articles/9534785-configuring-sso) for more details. ### Configure ChatGPT with OIDC 1. Log in to the [OpenAI Identity page](https://admin.openai.com/settings/identity) as a Global Admin. 2. In the **Single Sign-On** section, click **Set up SSO**, then select **Custom OIDC** as the identity provider. 3. Complete the Custom OIDC wizard: - **Identity Provider Name**: enter a descriptive name, such as `authentik`. - **Create an Application**: copy the **Login redirect URI** that ChatGPT displays. - **Add Claims**: confirm ChatGPT lists the required claims. The authentik provider created in the previous section sends `sub`, `email`, `given_name`, and `family_name`. - **OIDC Configuration**: - **Client ID**: enter the Client ID from authentik. - **Client Secret**: enter the Client Secret from authentik. - **Discovery endpoint**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Application Link**: review the direct sign-in link that ChatGPT generates; share it with users if needed. - **Test Single Sign-On**: run the built-in test. ChatGPT should redirect you to authentik for authentication and report success. ## Update the OIDC provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon of the newly created ChatGPT provider. 3. Under **Protocol settings**, add a **Redirect URI** of type `Strict` `Authorization` as the **Login redirect URI** value from ChatGPT. 4. Click **Update**. ### Configure ChatGPT with SAML 1. Log in to the [OpenAI Identity page](https://admin.openai.com/settings/identity) as a Global Admin. 2. In the **Single Sign-On** section, click **Set up SSO**, then select **Custom SAML** as the identity provider. 3. Complete the Custom SAML wizard: - **Identity Provider Name**: enter a descriptive name, such as `authentik`. - **Create a SAML Application**: copy the **Single sign-on URL** and **Audience URI** values that ChatGPT displays. - **Attribute Mapping**: confirm that ChatGPT lists an email address attribute. The default authentik SAML mappings include `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`. - **IdP Metadata**: select the manual configuration option and enter the following values: - **Entity ID**: `https://authentik.company/application/saml//metadata/` - **Sign-in URL**: `https://authentik.company/application/saml//` - **X.509 Certificate**: paste the contents of your certificate file. - **Application Link**: review the direct sign-in link that ChatGPT generates; share it with users if needed. - **Test Single Sign-On**: run the built-in test. ChatGPT should redirect you to authentik for authentication and report success. ## Update the SAML provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon of the newly created ChatGPT provider. 3. Under **Protocol settings**, set the following required configurations: - **ACS URL**: set to the **Single sign-on URL** from ChatGPT. - **Audience**: set to the **Audience URI** from ChatGPT. 4. Click **Update**. ## Configuration verification To verify that authentik is correctly integrated with ChatGPT, open ChatGPT, enter your email address, and click **Continue**. You should be redirected to authentik and, after a successful login, redirected back to ChatGPT. ## Resources - [OpenAI Help - Configuring SSO](https://help.openai.com/en/articles/9534785-configuring-sso) - [OpenAI Help - SSO for ChatGPT Business - FAQ](https://help.openai.com/en/articles/11489188-sso-for-chatgpt-business-faq) - [OpenAI Help - SSO Overview](https://help.openai.com/en/articles/10468051-sso-overview) - [OpenAI Help - Global Admin Console](https://help.openai.com/en/articles/12289294-global-admin-console) --- ## Integrate with Discourse ## What is Discourse? > Discourse is an open-source platform for community discussion, including forums and real-time chat. > > \-- [https://www.discourse.org/](https://www.discourse.org/) ## Preparation The following placeholders are used in this guide: - `discourse.company` is the FQDN of the Discourse installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. The OpenID Connect plugin is included with self-hosted Discourse. For sites hosted by Discourse, the plugin is available on the Business and Enterprise plans. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Discourse with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` with a value of `https://discourse.company/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Discourse configuration ### Configure OpenID Connect 1. Log in to Discourse as an administrator and open the Discourse Admin interface. 2. Navigate to **Settings** and search for `openid_connect`. 3. Configure the following settings: - **openid connect enabled**: enable this setting. - **openid connect discovery document**: `https://authentik.company/application/o//.well-known/openid-configuration` - **openid connect client id**: Client ID from authentik - **openid connect client secret**: Client Secret from authentik - **openid connect authorize scope**: `openid email profile` 4. Save the changes. ### Enable single logout *(optional)* To end the user's authentik session when they log out of Discourse, configure RP-initiated logout: 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and open the provider that you created for Discourse. 2. Add a **Redirect URI** of type `Strict` `Post Logout` with a value of `https://discourse.company/`. 3. Click **Update** to save the provider. 4. Return to the OpenID Connect settings in Discourse and configure the following settings: - **openid connect rp initiated logout**: enable this setting. - **openid connect rp initiated logout redirect**: `https://discourse.company/` 5. Save the changes. ### Skip account confirmation *(optional)* By default, Discourse asks a new user to confirm their account details after the first successful OpenID Connect login. To create the account without this additional step, navigate to **Admin** > **All site settings** > **Login** and enable **auth skip create confirm**. ## Configuration verification To confirm that authentik is properly configured with Discourse, open Discourse and click **Login with OpenID Connect**. You should be redirected to authentik and returned to Discourse after authentication. ## Resources - [Discourse Meta - OpenID Connect plugin](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632) - [Discourse Meta - Auto-provision user accounts with external authentication](https://meta.discourse.org/t/auto-provisioning-user-accounts-when-sso-is-enabled/399917) - [Discourse - OAuth 2.0 and OpenID Connect support](https://www.discourse.org/plugins/oauth.html) --- ## Integrate with EspoCRM ## What is EspoCRM? > EspoCRM is a CRM (customer relationship management) web application that allows users to store, visualize, and analyze their company's business-related relationships such as opportunities, people, businesses, and projects. > > \-- [https://www.espocrm.com/](https://www.espocrm.com/) This guide covers OIDC login for the primary EspoCRM interface. For team mapping or portal-specific OIDC configuration, refer to EspoCRM's [OIDC documentation](https://docs.espocrm.com/administration/oidc/). ## Preparation The following placeholders are used in this guide: - `espocrm.company` is the FQDN of the EspoCRM installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of EspoCRM with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://espocrm.company/oauth-callback.php`. - Select any available signing key. - Under **Advanced protocol settings**, set **Subject mode** to **Based on the User's username**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## EspoCRM configuration 1. Log in to EspoCRM as an administrator. 2. Navigate to **Administration** > **Authentication** and select **OIDC** as the authentication method. 3. Configure the following settings: - **OIDC Client ID**: enter the Client ID from authentik. - **OIDC Client Secret**: enter the Client Secret from authentik. - **OIDC Authorization Endpoint**: `https://authentik.company/application/o/authorize/` - **OIDC Token Endpoint**: `https://authentik.company/application/o/token/` - **OIDC UserInfo Endpoint**: `https://authentik.company/application/o/userinfo/` - **OIDC JSON Web Key Set Endpoint**: `https://authentik.company/application/o//jwks/` - **OIDC Scopes**: select or add `openid`, `profile`, and `email`. - **OIDC Logout URL**: `https://authentik.company/application/o//end-session/` - **Allow OIDC login for admin users** *(optional)*: enable this setting if EspoCRM administrators should be able to log in with OIDC. 4. Confirm that the read-only **OIDC Authorization Redirect URI** matches `https://espocrm.company/oauth-callback.php`. 5. Save the configuration. This configuration uses EspoCRM's username claim setting together with authentik's username-based subject mode. Existing EspoCRM users should have usernames that match their authentik usernames, unless you intentionally use a different claim mapping. ## Configuration verification To confirm that authentik is properly configured with EspoCRM, log out, open EspoCRM, click **Login**, and log back in via authentik. ## Resources - [EspoCRM administrator documentation on OpenID Connect authentication](https://docs.espocrm.com/administration/oidc/) --- ## Integrate with grommunio ## What is grommunio? > grommunio is an open-source groupware server and collaboration platform offering email, calendar, contacts, tasks, video conferencing, and file sync. It is fully compatible with Microsoft Outlook via MAPI/RPC, EWS, and ActiveSync. > > \-- [https://grommunio.com/](https://grommunio.com/) ## Preparation The following placeholders are used in this guide: - `grommunio.company` is the FQDN of the grommunio installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To integrate authentik with grommunio, you will need to create an application and provider pair in authentik. grommunio Web uses Keycloak-compatible OIDC endpoints. Because authentik does not use Keycloak's `/realms/` endpoint structure, this guide configures an nginx bridge on the grommunio server. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name (e.g., `grommunio`), an optional group, and the policy engine mode. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name, the authorization flow to use, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://grommunio.company/web`. - Set **Signing Key** to an available RSA key. - Under **Advanced protocol settings**: - Add the `authentik default OAuth Mapping: OpenID 'offline_access'` scope to **Selected Scopes**. - **Configure Bindings** *(optional)*: create a binding to manage access. 3. Click **Submit** to save the new application and provider. ### Download certificate file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section. 3. Under **Related objects** > **Download signing certificate**, click on **Download**. This downloaded file is your certificate file and it will be required in the next section. ## grommunio configuration ### Configure gromox JWT verification On the grommunio server, extract the public key from the certificate that you downloaded from authentik: ```bash openssl x509 -pubkey -noout -in /path/to/authentik-signing-certificate.pem > /etc/gromox/bearer_pubkey ``` After creating the public key file, restart gromox: ```bash systemctl restart gromox-http ``` ### Create keycloak.json grommunio Web uses a Keycloak-compatible OIDC configuration file at `/etc/gromox/keycloak.json`: ```json title="/etc/gromox/keycloak.json" { "realm": "grommunio", "auth-server-url": "https://grommunio.company/sso/", "ssl-required": "external", "resource": "", "credentials": { "secret": "" } } ``` ### Add the nginx SSO bridge grommunio Web expects Keycloak-style OIDC endpoint paths under `/sso/realms/`. Add a custom nginx location file to proxy these to authentik. ```nginx title="/etc/grommunio-common/nginx/locations.d/sso-authentik.conf" location = /sso/realms/grommunio/protocol/openid-connect/auth { return 302 https://authentik.company/application/o/authorize/$is_args$args; } location = /sso/realms/grommunio/protocol/openid-connect/token { proxy_pass https://authentik.company/application/o/token/; proxy_ssl_server_name on; proxy_set_header Host authentik.company; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location = /sso/realms/grommunio/protocol/openid-connect/token/introspect { proxy_pass https://authentik.company/application/o/introspect/; proxy_ssl_server_name on; proxy_set_header Host authentik.company; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location = /sso/realms/grommunio/protocol/openid-connect/userinfo { proxy_pass https://authentik.company/application/o/userinfo/; proxy_ssl_server_name on; proxy_set_header Host authentik.company; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location = /sso/realms/grommunio/protocol/openid-connect/logout { return 302 https://authentik.company/application/o//end-session/$is_args$args; } ``` Then reload nginx: ```bash nginx -t && nginx -s reload ``` ### Patch class.keycloak.php grommunio Web's OIDC client does not request the `email` or `offline_access` scopes by default. Without these scopes, grommunio cannot map the authentik user from the access token or refresh the session after login. Open `/usr/share/php-mapi/class.keycloak.php` and update the two scope strings from `openid` to `openid email offline_access`. There should be one occurrence in the authorization URL builder and one in the token request. Example diff: ```diff title="/usr/share/php-mapi/class.keycloak.php" - $params['scope'] = 'openid'; + $params['scope'] = 'openid email offline_access'; - return $this->realm_url . '/protocol/openid-connect/auth?scope=openid&client_id=' . urlencode((string) $this->client_id) . '&state=' . urlencode($uuid) . '&redirect_uri=' . urlencode($redirect_url) . '&response_type=code'; + return $this->realm_url . '/protocol/openid-connect/auth?scope=openid%20email%20offline_access&client_id=' . urlencode((string) $this->client_id) . '&state=' . urlencode($uuid) . '&redirect_uri=' . urlencode($redirect_url) . '&response_type=code'; ``` After saving, reload PHP-FPM: ```bash systemctl reload php-fpm ``` ## Configuration verification Log out of grommunio Web completely, then open grommunio Web. You should be redirected to the authentik login page. After authenticating, you will be returned to grommunio Web and logged in automatically. To verify single logout, click the logout button in grommunio Web. You should be redirected to the authentik session invalidation flow. ## Resources - [grommunio Web - login template](https://github.com/grommunio/grommunio-web/blob/master/server/includes/templates/login.php) - [grommunio Web - Keycloak authentication flow](https://github.com/grommunio/grommunio-web/blob/master/server/includes/core/class.webappauthentication.php) - [grommunio mapi-header-php - Keycloak client](https://github.com/grommunio/mapi-header-php/blob/master/class.keycloak.php) - [Gromox - bearer token verification](https://github.com/grommunio/gromox/blob/master/exch/authmgr.cpp) --- ## Integrate with HedgeDoc ## What is HedgeDoc? > HedgeDoc lets you create real-time collaborative markdown notes. > > \-- [https://hedgedoc.org/](https://hedgedoc.org/) ## Preparation The following placeholders are used in this guide: - `hedgedoc.company` is the FQDN of the HedgeDoc installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of HedgeDoc with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://hedgedoc.company/auth/oauth2/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## HedgeDoc configuration Set the following environment variables in your HedgeDoc deployment: ```yaml CMD_OAUTH2_PROVIDERNAME: "authentik" CMD_OAUTH2_CLIENT_ID: "" CMD_OAUTH2_CLIENT_SECRET: "" CMD_OAUTH2_SCOPE: "openid email profile" CMD_OAUTH2_USER_PROFILE_URL: "https://authentik.company/application/o/userinfo/" CMD_OAUTH2_TOKEN_URL: "https://authentik.company/application/o/token/" CMD_OAUTH2_AUTHORIZATION_URL: "https://authentik.company/application/o/authorize/" CMD_OAUTH2_USER_PROFILE_ID_ATTR: "sub" CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR: "preferred_username" CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR: "name" CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR: "email" ``` Restart HedgeDoc for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with HedgeDoc, open HedgeDoc, select the **authentik** login option, and complete the authentik sign-in flow. A successful authentication should return you to HedgeDoc as a signed-in user. ## Resources - [HedgeDoc documentation - Configuration](https://docs.hedgedoc.org/configuration/) - [HedgeDoc documentation - OAuth](https://docs.hedgedoc.org/guides/auth/oauth/) --- ## Integrate with Joplin Server ## What is Joplin Server? > Joplin is an open source note-taking app. Capture your thoughts and securely access them from any device. > > \-- [https://joplinapp.org/](https://joplinapp.org/) Joplin Server is the self-hosted sync service for Joplin clients. ## Preparation The following placeholders are used in this guide: - `joplin.company` is the FQDN of the Joplin installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Joplin with authentik, you need to create property mappings and an application/provider pair in authentik. ### Create property mappings Joplin requires SAML assertions to include `email` and `displayName` attributes. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create two **SAML Provider Property Mapping**s with the following settings: - **Display name mapping**: - **Name**: Choose a descriptive name - **SAML Attribute Name**: `displayName` - **Expression**: ```py return request.user.name ``` - **Email mapping**: - **Name**: Choose a descriptive name - **SAML Attribute Name**: `email` - **Expression**: ```py return request.user.email ``` ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Set the **Launch URL** to `https://joplin.company/login/sso-saml`. Note the application **Slug** because you will use it later as ``. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **ACS URL**: `https://joplin.company/api/saml` - **Audience**: `` - Under **Advanced protocol settings**, select an available **Signing Certificate**, enable **Sign assertions** and **Sign responses**, and add the two property mappings created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the Joplin provider created in the previous section. 3. In the **Related objects** section, under **Metadata**, click **Download** to save the metadata XML file. You will use this file as the Joplin IdP configuration. ## Joplin configuration To configure Joplin with authentik, create two SAML configuration files and set the appropriate environment variables. ### Create the Service Provider configuration file 1. Log in to your Joplin server and create a Service Provider (SP) configuration file. Set `entityID` to the authentik application slug. 2. Create the following file in a location that Joplin Server can read, such as a mounted volume: ```xml title="/path/to/joplin-sp.xml" urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress ``` 3. Transfer the metadata XML file downloaded from authentik to your Joplin server, for example as `/path/to/joplin-idp.xml`. ### Configure Joplin environment variables 1. Set the following environment variables. Replace `/path/to/` with the file paths where you saved the SAML configuration files. Joplin Server requires `APP_BASE_URL` and `API_BASE_URL` to use the same URL when SAML is enabled. ```env title=".env" SAML_ENABLED=true SAML_IDP_CONFIG_FILE=/path/to/joplin-idp.xml SAML_SP_CONFIG_FILE=/path/to/joplin-sp.xml APP_BASE_URL=https://joplin.company API_BASE_URL=https://joplin.company DELETE_EXPIRED_SESSIONS_SCHEDULE= LOCAL_AUTH_ENABLED=false ``` 2. Restart Joplin to apply the changes. ## Configuration verification To confirm that authentik is properly configured with Joplin Server, open Joplin and sign in with SSO. After a successful authentik login, you should be returned to Joplin with access to your notes. ## Resources - [Joplin Server – SAML configuration](https://joplinapp.org/help/apps/server/saml/) --- ## Integrate with Kanboard ## What is Kanboard? > Kanboard is a free and open source Kanban project management software. > > \-- [https://kanboard.org](https://kanboard.org) ## Preparation The following placeholders are used in this guide: - `kanboard.company` is the FQDN of your Kanboard installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Kanboard with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://kanboard.company/oauth/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Kanboard configuration Integrating Kanboard with authentik requires enabling the plugin system and installing the OAuth2 plugin. ### Enable plugin management To enable plugin management through the web interface, add the following line to your Kanboard `config.php` file. Kanboard reads this file from the project root or the `data` folder. For Docker installations, the data folder is typically `/var/www/app/data/`. ```php define('PLUGIN_INSTALLER', true); ``` Then, restart your server to apply the updated configuration. ### Install and configure the plugin 1. Log in to Kanboard as an administrator and navigate to your **Profile Icon** > **Settings** > **Plugins**. 2. Locate the **OAuth2** plugin in the list and click **Install**. 3. After the installation is complete, navigate to **Profile Icon** > **Settings** > **Integrations**. 4. Under **OAuth2 Authentication**, configure the following settings: | Setting | Value | | -------------------------- | ----------------------------------------------------- | | **Callback URL** | `https://kanboard.company/oauth/callback` (prefilled) | | **Client ID** | Client ID from authentik | | **Client Secret** | Client secret from authentik | | **Authorize URL** | `https://authentik.company/application/o/authorize/` | | **Token URL** | `https://authentik.company/application/o/token/` | | **User API URL** | `https://authentik.company/application/o/userinfo/` | | **Scopes** | `openid profile email` | | **Username Key** | `preferred_username` | | **Name Key** | `name` | | **Email Key** | `email` | | **User ID Key** | `sub` | | **Allow Account Creation** | Toggled | 5. Click **Save** to apply your configuration. ## Configuration verification To confirm that authentik is properly configured with Kanboard, log out of Kanboard and log back in using the **OAuth2 login** option. You should be redirected to authentik for authentication and then redirected back to Kanboard. ## Resources - [Kanboard OAuth2 plugin](https://github.com/kanboard/plugin-oauth2) --- ## Integrate with Kimai ## What is Kimai? > Kimai is a free and open source time-tracking application for recording work time and reporting it by customer, project, activity, and user. > > -- https://www.kimai.org/ ## Preparation The following placeholders are used in this guide: - `kimai.company` is the FQDN of the Kimai installation. - `authentik.company` is the FQDN of the authentik installation. - `admin.group` is the name of the authentik group whose members should receive the Kimai administrator role. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Kimai with authentik, you need to create an application/provider pair in authentik. Kimai imports SAML users during their first login. To assign Kimai roles from authentik group membership, configure the role mappings in the Kimai `local.yaml` file in the next section. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://kimai.company/auth/saml/acs`. - Set the **SLS URL** to `https://kimai.company/auth/saml/logout`. - Set the **SLS Binding** to `Redirect`. - Set the **Logout Method** to `Front-channel (Iframe)`. - Set the **Audience** to `https://kimai.company/`. - Set the **Service Provider Binding** to `Post`. - Under **Advanced protocol settings**: - Select an available **Signing certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Set **Default NameID Policy** to **Email address**. - **Configure Bindings** _(optional)_: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to control which users can access the Kimai application from the **Application Dashboard** page. 3. Click **Submit**. ### Download the signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the newly created Kimai provider. 3. Under **Related objects** > **Download signing certificate**, click **Download**. The certificate content is required in the next section. ## Kimai configuration Paste the following block in your `local.yaml` file, after replacing the placeholder values from above. The file is usually located in `/opt/kimai/config/packages/local.yaml`. For `x509cert`, open the authentik signing certificate in a text editor and paste the full certificate, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. ```yaml title="/opt/kimai/config/packages/local.yaml" kimai: saml: provider: authentik activate: true title: Log in with authentik mapping: - { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, kimai: email, } - { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name, kimai: alias, } roles: resetOnLogin: true attribute: http://schemas.xmlsoap.org/claims/Group mapping: # Insert your roles here (ROLE_USER is added automatically) - { saml: admin.group, kimai: ROLE_ADMIN } connection: idp: entityId: "https://authentik.company/application/saml//metadata/" singleSignOnService: url: "https://authentik.company/application/saml//" binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" singleLogoutService: url: "https://authentik.company/application/saml//" binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" x509cert: | -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- sp: entityId: "https://kimai.company/" assertionConsumerService: url: "https://kimai.company/auth/saml/acs" binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" singleLogoutService: url: "https://kimai.company/auth/saml/logout" binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" # privateKey: "" # only set baseurl, if auto-detection doesn't work baseurl: "https://kimai.company/auth/saml/" strict: false debug: true security: nameIdEncrypted: false authnRequestsSigned: false logoutRequestSigned: false logoutResponseSigned: false wantMessagesSigned: false wantAssertionsSigned: false wantNameIdEncrypted: false requestedAuthnContext: true signMetadata: false wantXMLValidation: true signatureAlgorithm: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" digestAlgorithm: "http://www.w3.org/2001/04/xmlenc#sha256" contactPerson: technical: givenName: "Kimai Admin" emailAddress: "admin@example.com" organization: en: name: "Kimai" displayname: "Kimai" url: "https://kimai.company" ``` Afterwards, rebuild the Kimai cache or restart the Docker container. ### Enable single logout _(optional)_ Kimai's SAML logout endpoint is only reachable through the Symfony firewall. By default, Kimai points the firewall's logout path at its own local logout route, so `https://kimai.company/auth/saml/logout` never processes the logout request that authentik sends, and the Kimai session survives. Kimai also enables `always_remember_me` by default. Even after the logout request is processed correctly, Kimai reissues its `REMEMBERME` cookie during the logout redirect, which signs the user back in on their next request and makes the logout appear to have no effect. To let authentik end Kimai sessions, add the following block to the same `local.yaml` file. This changes the firewall's logout path to the SAML route and stops Kimai from issuing a persistent login cookie: ```yaml title="/opt/kimai/config/packages/local.yaml" security: firewalls: secured_area: logout: path: /auth/saml/logout target: homepage enable_csrf: false remember_me: secret: "%kernel.secret%" lifetime: 604800 path: / always_remember_me: false ``` Restart Kimai, then confirm that both settings applied: ```bash php bin/console debug:config security firewalls ``` The `logout` section should report `path: /auth/saml/logout`, and the `remember_me` section should report `always_remember_me: false`. Disabling `always_remember_me` means users are no longer kept signed in to Kimai across browser sessions. If you need persistent logins, keep the setting enabled and accept that authentik cannot fully end a Kimai session. Changing the firewall's logout path also changes what Kimai's own **Log out** button does, because both use the same path. Kimai's local logout route no longer has a controller behind it and returns an error when opened directly. ## Configuration verification To confirm that authentik is properly configured with Kimai, open Kimai, log out, and click **Log in with authentik**. You should be redirected to authentik to log in and then redirected back to Kimai. If you configured single logout, log out of authentik. Your browser passes through the Kimai logout endpoint on the way, and reloading Kimai returns you to its login page. ## Resources - [Kimai SAML documentation](https://www.kimai.org/documentation/saml.html) - [Kimai Authentik SAML documentation](https://www.kimai.org/documentation/saml-authentik.html) - [Kimai discussion on configuring the SAML logout path](https://github.com/kimai/kimai/discussions/3206) --- ## Integrate with mailcow ## What is mailcow? > mailcow is a Dockerized, open-source groupware and email suite based on Docker. It relies on many well-known and long-used components, which, when combined, result in a comprehensive email server solution. > > \-- [https://mailcow.email/](https://mailcow.email/) ## Preparation The following placeholders are used in this guide: - `mailcow.company` is the FQDN of the mailcow installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of mailcow with authentik, you need to create property mappings, set user attributes, and create an application/provider pair in authentik. ### Create property mappings mailcow requires users to have an email address. The custom email scope mapping returns the `email_verified` claim from a user attribute, and the `mailcow_template` scope mapping lets mailcow select a mailbox template when creating or updating mailboxes. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**. 3. Select **Scope Mapping** as the property mapping type. Use `email` as the scope name, and copy the user attribute expression from [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification). 4. Click **Create**. 5. Create another **Scope Mapping** using the following values: - **Name**: `mailcow_template` - **Scope name**: `mailcow_template` - **Expression**: ```python return { "mailcow_template": request.user.attributes.get("mailcow_template", "default"), } ``` 6. Click **Create**. ### Set user attributes 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Users** and select a user that will use the mailcow integration. 3. Click **Edit User**. 4. Add the following attributes to the **Attributes** field: ```yaml email_verified: true mailcow_template: default ``` 5. Click **Save Changes**. Repeat these steps for all users that need to use the mailcow integration. The user's email address in authentik must match the mailcow mailbox address for existing mailboxes. If mailcow creates the mailbox during first login, the email domain must already exist in mailcow. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://mailcow.company`. - Select any available signing key. - Under **Advanced protocol settings**: - Remove the `authentik default OAuth Mapping: OpenID 'email'` scope from **Selected Scopes**. - Add the custom `email` scope mapping to **Selected Scopes**. - Add the `mailcow_template` scope mapping to **Selected Scopes**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## mailcow configuration To configure mailcow with authentik, log in as an administrator and navigate to **System** > **Configuration**. Then, go to **Access** > **Identity Provider**, select `Generic-OIDC` as the identity provider, and enter the following information in the form: - **Authorization endpoint**: `https://authentik.company/application/o/authorize/` - **Token endpoint**: `https://authentik.company/application/o/token/` - **User info endpoint**: `https://authentik.company/application/o/userinfo/` - **Client ID**: `` - **Client Secret**: `` - **Redirect URL**: `https://mailcow.company` - **Attribute Mapping**: - **Attribute**: `default` - **Template**: Select the mailbox template that should be used for users with `mailcow_template: default`. To let existing mailboxes log in with authentik, navigate to **E-Mail** > **Configuration** > **Mailboxes**, edit the mailbox, set **Identity Provider** to `Generic-OIDC`, and save the changes. For users who do not already have mailboxes, mailcow can create a mailbox when the user signs in. Enable **Auto-create users on login** and configure either **Default Template** or an **Attribute Mapping** that matches the `mailcow_template` claim returned by authentik. Users who log in with Generic-OIDC can create passwords for external mail clients from the mailcow UI by opening **Mailbox Settings** and using the **App Passwords** tab. ## Configuration verification To confirm that authentik is properly configured with mailcow, open mailcow and log in via authentik. ## Resources - [mailcow documentation - Generic-OIDC](https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-generic-oidc/) --- ## Integrate with mailcow Logs Viewer ## What is mailcow Logs Viewer? > A modern, self-hosted dashboard for monitoring, analyzing, and managing your mailcow mail server. Track email delivery, investigate spam, manage quarantine, detect bounce-based abuse, and validate DNS configurations, all from a single interface. > > \-- [https://github.com/ShlomiPorush/mailcow-logs-viewer](https://github.com/ShlomiPorush/mailcow-logs-viewer) ## Preparation The following placeholders are used in this guide: - `mailcow-logs-viewer.company` is the FQDN of the mailcow Logs Viewer installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of mailcow Logs Viewer with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://mailcow-logs-viewer.company/api/auth/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## mailcow Logs Viewer configuration To configure mailcow Logs Viewer to use authentik, add the following environment variables to your mailcow Logs Viewer deployment: ```env title=".env" OAUTH2_ENABLED=true OAUTH2_PROVIDER_NAME=authentik OAUTH2_ISSUER_URL=https://authentik.company/application/o// OAUTH2_CLIENT_ID= OAUTH2_CLIENT_SECRET= OAUTH2_REDIRECT_URI=https://mailcow-logs-viewer.company/api/auth/callback SESSION_SECRET_KEY= ``` Then restart mailcow Logs Viewer to apply the changes. The same settings can also be configured through the mailcow Logs Viewer web UI under **Settings** > **OAuth2** when `SETTINGS_EDIT_VIA_UI_ENABLED=true`. Values set through environment variables override values set through the web UI. ## Configuration verification To confirm that authentik is properly configured with mailcow Logs Viewer, open mailcow Logs Viewer and log in using the **Login with authentik** button. You should be redirected to authentik for authentication and then redirected back to mailcow Logs Viewer. ## Resources - [mailcow Logs Viewer OAuth2 configuration guide](https://github.com/ShlomiPorush/mailcow-logs-viewer/blob/main/documentation/OAuth2_Configuration.md) - [mailcow Logs Viewer OAuth2 client source](https://github.com/ShlomiPorush/mailcow-logs-viewer/blob/main/backend/app/services/oauth2_client.py) --- ## Integrate with Mastodon ## What is Mastodon? > Mastodon is free and open-source software for running self-hosted social networking services. It has microblogging features similar to Twitter. > > \-- [https://joinmastodon.org/](https://joinmastodon.org/) ## Preparation The following placeholders are used in this guide: - `mastodon.company` is the FQDN of the Mastodon installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Mastodon with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because you will use it later as ``. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://mastodon.company/auth/auth/openid_connect/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Mastodon configuration Configure Mastodon's `OIDC_` settings by editing `.env.production` and adding the following values: ```env title=".env.production" OIDC_ENABLED=true OIDC_DISPLAY_NAME=authentik OIDC_DISCOVERY=true OIDC_ISSUER=https://authentik.company/application/o// OIDC_SCOPE=openid,profile,email OIDC_UID_FIELD=preferred_username OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_REDIRECT_URI=https://mastodon.company/auth/auth/openid_connect/callback OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED=true ``` This configuration uses the authentik `preferred_username` claim as the Mastodon user identifier so that new Mastodon usernames match authentik usernames. Disable the [**Allow users to change username** setting](/docs/sys-mgmt/settings#allow-users-to-change-username) in authentik to prevent authentication issues after username changes. Alternatively, you can set `OIDC_UID_FIELD=sub` to use authentik's stable subject identifier instead of the username. Restart the Mastodon web service for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with Mastodon, open Mastodon and log in using the **authentik** login option. ## Resources - [Mastodon documentation - Configuring your environment](https://docs.joinmastodon.org/admin/config/#external-authentication) - [Mastodon source - OmniAuth initializer](https://github.com/mastodon/mastodon/blob/main/config/initializers/3_omniauth.rb) - [Mastodon source - authentication routes](https://github.com/mastodon/mastodon/blob/main/config/routes.rb) --- ## Integrate with Matrix Synapse ## What is Matrix Synapse? > Synapse is an open source Matrix homeserver implementation, written and maintained by Element. Matrix is the open standard for secure and interoperable real-time communications. > > \-- [https://github.com/element-hq/synapse](https://github.com/element-hq/synapse) ## Preparation The following placeholders are used in this guide: - `matrix.company` is the public FQDN where Matrix clients reach Synapse. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Matrix Synapse with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://matrix.company/_synapse/client/oidc/callback`. - Select any available RSA-based **Signing Key**. Matrix Synapse does not support ECC keys for authentik. - Leave **Encryption Key** empty. - Under **Advanced protocol settings**, set **Logout URI** to `https://matrix.company/_synapse/client/oidc/backchannel_logout` and **Logout Method** to `Back-channel`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Matrix Synapse configuration Synapse's Docker images and Debian packages include the OIDC dependencies. If you installed Synapse in a virtual environment, install the OIDC extras before enabling this configuration: ```shell /path/to/env/bin/pip install matrix-synapse[oidc] ``` Add the following configuration to your Synapse configuration file: ```yaml title="homeserver.yaml" oidc_providers: - idp_id: authentik idp_name: authentik discover: true backchannel_logout_enabled: true issuer: "https://authentik.company/application/o//" client_id: "" client_secret: "" scopes: - "openid" - "profile" - "email" user_mapping_provider: config: localpart_template: "{{ user.preferred_username }}" display_name_template: "{{ user.preferred_username|capitalize }}" jwt_config: enabled: true secret: "" algorithm: "RS256" ``` The `display_name_template` line can use `{{ user.name|capitalize }}` if your authentik users have names and you want Synapse display names to use those values. Restart Synapse to apply the configuration. ## Configuration verification To confirm that authentik is properly configured with Matrix Synapse, open your Matrix client, choose your Synapse homeserver, and sign in with authentik. You should be redirected to authentik for authentication and then redirected back to your Matrix client. ## Resources - [Synapse OpenID Connect configuration](https://element-hq.github.io/synapse/latest/openid.html) - [Synapse `oidc_providers` configuration reference](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#oidc_providers) - [Synapse `jwt_config` configuration reference](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#jwt_config) --- ## Integrate with Mattermost ## What is Mattermost? > Mattermost is an open source collaboration platform for team messaging, workflow orchestration, and integrations. > > \-- [https://mattermost.com/](https://mattermost.com/) ## Preparation The following placeholders are used in this guide: - `mattermost.company` is the FQDN of the Mattermost installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## Configuration methods Mattermost Team Edition can use OAuth 2.0. SAML is available only in Mattermost Enterprise Edition. This guide explains both options. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Mattermost Team Edition with authentik, you need to create a property mapping and an application/provider pair in authentik. ### Create a property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **Scope Mapping** with the following settings: - **Name**: `mattermost-read-user` - **Scope Name**: `read_user` - **Description**: `Mattermost Team Edition user profile` - **Expression**: ```python username = request.user.username return { "id": request.user.pk, "username": username, "login": username, "preferred_username": username, "email": request.user.email, "name": request.user.name or username, } ``` Mattermost requires the `id` and `email` values from the user profile response. Ensure that users who log in to Mattermost have an email address in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add the following **Redirect URIs**: - `Strict` `Authorization`: `https://mattermost.company/login/gitlab/complete` - `Strict` `Authorization`: `https://mattermost.company/signup/gitlab/complete` - Under **Advanced protocol settings**, ensure the `openid` scope and the `mattermost-read-user` scope mapping are selected. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Mattermost configuration Mattermost Team Edition supports the GitLab OAuth 2.0 authentication path. This guide configures Mattermost's GitLab authentication settings to use authentik as the OAuth provider. GitLab is not required. Mattermost displays this sign-in method as GitLab in some areas of the System Console. The login button text can be changed in `config.json`. If you are using a hosted Mattermost deployment without filesystem access to `config.json`, you cannot complete this setup. Mattermost Team Edition does not let you freely set all required GitLab OAuth endpoint values in the System Console. Edit the Mattermost `config.json` file directly and update the `GitLabSettings` object. ```json showLineNumbers title="/opt/mattermost/config/config.json" "GitLabSettings": { "Enable": true, "Secret": "", "Id": "", "Scope": "", "AuthEndpoint": "https://authentik.company/application/o/authorize/", "TokenEndpoint": "https://authentik.company/application/o/token/", "UserAPIEndpoint": "https://authentik.company/application/o/userinfo/", "ButtonText": "Log in with authentik" } ``` Restart Mattermost after saving the file. Leave `Scope` empty as shown so authentik can issue the scopes selected on the provider. If new Mattermost users should be created on first login, log in to Mattermost as an administrator, open the product menu, select **System Console**, and navigate to **Authentication** > **Signup**. Ensure account creation is enabled, or create Mattermost users before they log in with authentik. ## authentik configuration authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. To support the integration of Mattermost Enterprise Edition with authentik via SAML, you need a certificate-key pair for Mattermost and an application/provider pair in authentik. ### Prepare a Mattermost certificate-key pair Use an existing certificate-key pair from authentik, or generate one if you do not already have one available. To generate one: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **System** > **Certificates** and click **Generate**. 3. Configure the following settings: - **Common Name**: `mattermost.company` - **Private key Algorithm**: `RSA` 4. Click **Generate**. 5. Click the caret next to the certificate-key pair you will use for Mattermost, then click **Download Certificate** and **Download Private key**. These files will be required in the Mattermost configuration. Keep them safe. Mattermost uses the private key for request signing and assertion decryption. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://mattermost.company/login/sso/saml`. - Set the **Audience** to `https://mattermost.company/login/sso/saml`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Enable **Sign responses**. - Set the **Verification Certificate** to the Mattermost certificate-key pair. - Set the **Encryption Certificate** to the Mattermost certificate-key pair. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the authentik signing certificate 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider you created earlier. 2. Under **Related objects** > **Download signing certificate**, click **Download**. This certificate file will be required in the next section. ## Mattermost configuration 1. Log in to Mattermost as an administrator. 2. Open the product menu, select **System Console**, and navigate to **Authentication** > **SAML 2.0**. 3. Configure the following settings: - **Enable Login With SAML 2.0**: enable this setting. - **Identity Provider Metadata URL**: `https://authentik.company/application/saml//metadata/` - Click **Get SAML Metadata from IdP** to populate the Identity Provider fields from authentik metadata. - **Identity Provider Public Certificate**: upload the authentik signing certificate you downloaded earlier if it was not populated from metadata. - **Verify Signature**: enable this setting. - **Service Provider Login URL**: `https://mattermost.company/login/sso/saml` - **Service Provider Identifier**: `https://mattermost.company/login/sso/saml` - **Enable Encryption**: enable this setting. - **Service Provider Private Key**: upload the Mattermost private key downloaded from authentik. - **Service Provider Public Certificate**: upload the Mattermost certificate downloaded from authentik. - **Sign Request**: enable this setting. - **Signature Algorithm**: `RSAwithSHA256` - **Email Attribute**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` - **Username Attribute**: `http://schemas.goauthentik.io/2021/02/saml/username` - **Id Attribute**: `http://schemas.goauthentik.io/2021/02/saml/uid` 4. Click **Save**. Ensure that users who log in to Mattermost have both an email address and username in authentik. ## Configuration verification To confirm that authentik is properly configured with Mattermost, log out and log back in via authentik. ## Resources - [Mattermost Docs - Editions and offerings](https://docs.mattermost.com/product-overview/editions-and-offerings.html) - [Mattermost Docs - GitLab Single Sign-On](https://docs.mattermost.com/administration-guide/onboard/sso-gitlab.html) - [Mattermost Docs - SAML Single Sign-On](https://docs.mattermost.com/administration-guide/onboard/sso-saml.html) - [Mattermost Docs - Authentication configuration settings](https://docs.mattermost.com/administration-guide/configure/authentication-configuration-settings.html) - [Mattermost GitLab OAuth provider implementation](https://github.com/mattermost/mattermost/blob/master/server/channels/app/oauthproviders/gitlab/gitlab.go) --- ## Integrate with Mautic ## What is Mautic? > Mautic provides free and open source marketing automation software available to everyone. Free email marketing and lead management software. > > \-- [https://mautic.org/](https://mautic.org/) ## Preparation The following placeholders are used in this guide: - `mautic.company` is the FQDN of the Mautic installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Mautic with authentik, create two SAML property mappings and an application/provider pair in authentik. ### Create property mappings Mautic requires first name and last name attributes in the SAML response. Create two [SAML provider property mappings](/docs/users-sources/sources/property-mappings): 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** and click **Next**. 4. Configure the property mapping with the following settings: - **Name**: `SAML-FirstName-from-Name` - **SAML Attribute Name**: `FirstName` - **Friendly Name**: leave blank. - **Expression**: ```python names = request.user.name.split(" ", 1) if len(names) == 1: return request.user.name return names[0] ``` 5. Click **Finish** to save the property mapping. 6. Again, navigate to **Customization** > **Property Mappings** and click **Create**. 7. Select **SAML Provider Property Mapping** and click **Next**. 8. Configure the property mapping with the following settings: - **Name**: `SAML-LastName-from-Name` - **SAML Attribute Name**: `LastName` - **Friendly Name**: leave blank. - **Expression**: ```python return request.user.name.split(" ", 1)[-1] ``` 9. Click **Finish** to save the property mapping. ### Create an application and provider pair authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it is required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to `https://mautic.company/s/saml/login_check`. - Set **Audience** to `https://mautic.company`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Enable **Sign responses**. - Add `SAML-FirstName-from-Name` and `SAML-LastName-from-Name` to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the metadata 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created. 2. Under **Metadata**, click **Download** to save the metadata XML file. This file is required in the next section. ## Mautic configuration If Mautic runs behind an SSL-terminating reverse proxy, first navigate to **Configuration** > **System Settings** in Mautic and make sure that: - the **Site URL** starts with `https://` - **Trusted proxies** includes the IP address of the reverse proxy Then configure SAML in Mautic: 1. Log in to Mautic as an administrator. 2. Click the settings cogwheel in the top-right corner. 3. Navigate to **Configuration** > **User/Authentication Settings**. 4. In **SAML SSO Settings**, set the following values: - **Entity ID for the IDP**: select `https://mautic.company`. - **Identity provider metadata file**: upload the metadata XML file from authentik. - **Default role for created users**: select the role to assign to users created through SAML login. Leave this empty only if all SAML users already exist in Mautic. - **Email**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` - **Username**: `http://schemas.goauthentik.io/2021/02/saml/username` - **First name**: `FirstName` - **Last name**: `LastName` 5. Click **Save**. Leave **X.509 certificate** and **Private key** unset unless you intentionally configure Mautic with its own SAML certificate and stricter SAML trust options. Those fields are for a Mautic-owned certificate and private key, not for authentik's signing key. If you configure them, also configure the matching verification and encryption settings in authentik. ### Common SAML errors The following errors usually indicate a mismatch between authentik and Mautic configuration: - `Uncaught PHP Exception TypeError: "Mautic\UserBundle\Entity\User::getUserIdentifier(): Return value must be of type string, null returned"`: Mautic did not receive the expected email or username attribute. Check the **Email**, **Username**, **First name**, and **Last name** attribute names in Mautic and the selected property mappings in authentik. - `Unable to verify Signature`: the metadata file uploaded to Mautic does not match the signing certificate currently used by the authentik SAML provider. Download the provider metadata again and upload the new file to Mautic. - `Assertions must be signed`: the authentik SAML provider does not have a **Signing Certificate** selected, or **Sign assertions** is not enabled. - `Private key is invalid. It should begin with -----BEGIN RSA PRIVATE KEY----- or -----BEGIN ENCRYPTED PRIVATE KEY-----`: Mautic rejected a private key uploaded to its **Private key** field. Leave the field unset unless you intentionally configure Mautic with its own SAML certificate and stricter SAML trust options. ## Configuration verification To confirm that authentik is properly configured with Mautic, open Mautic in a new incognito/private window or another browser and log in. Using a separate browser session lets you keep access to the Mautic configuration interface if the SAML login fails. ## Resources - [Mautic documentation - SAML/SSO settings](https://docs.mautic.org/en/7.0/configuration/settings.html#saml-sso-settings) - [Mautic documentation - Authentication](https://docs.mautic.org/en/4.x/authentication/authentication.html#saml) --- ## Integrate with Memos ## What is Memos? > Memos is an open-source, self-hosted note-taking application for quick notes, daily logs, links, and snippets. > > \-- [https://usememos.com/](https://usememos.com/) ## Preparation The following placeholders are used in this guide: - `memos.company` is the FQDN of the self-hosted Memos installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Memos with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Set the **Launch URL** to `https://memos.company`. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://memos.company/auth/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Memos configuration 1. Log in to Memos as an administrator and open **Settings**. 2. Under **Admin**, select **SSO**, and then click **Create**. 3. Configure the basic settings: - **Type**: `OAUTH2` - **Template**: `Custom` - **Provider ID**: `authentik` - **Name**: `authentik` 4. Confirm that the displayed **Redirect URL** is `https://memos.company/auth/callback`. 5. Configure the OAuth settings: - **Client ID**: enter the client ID from authentik. - **Client secret**: enter the client secret from authentik. - **Authorization endpoint**: `https://authentik.company/application/o/authorize/` - **Token endpoint**: `https://authentik.company/application/o/token/` - **User endpoint**: `https://authentik.company/application/o/userinfo/` - **Scopes**: `openid profile email` 6. Configure the field mapping: - **Identifier**: `sub` - **Display Name**: `name` - **Email**: `email` 7. Click **Create**. Memos can create a user during their first SSO login only when user registration is allowed. If user registration is disabled, an existing Memos user must link their authentik identity under **Settings** > **My Account** before signing in with SSO. ## Configuration verification To confirm that authentik is properly configured with Memos, log out, open Memos, and click **Continue with authentik**. You should be redirected to authentik and then returned to Memos after a successful login. ## Resources - [Memos documentation - Authentication](https://usememos.com/docs/configuration/authentication) - [Memos documentation - Linked identities](https://usememos.com/docs/usage/linked-identities) - [Memos documentation - Security](https://usememos.com/docs/configuration/security) --- ## Integrate with Mobilizon ## What is Mobilizon? > Gather, organize and mobilize yourselves with a convivial, ethical, and emancipating tool. > > \-- [https://joinmobilizon.org/](https://joinmobilizon.org/) ## Preparation The following placeholders are used in this guide: - `mobilizon.company` is the FQDN of the Mobilizon installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Mobilizon with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://mobilizon.company/auth/keycloak/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Mobilizon configuration Edit the Mobilizon `config.exs` file and add the following settings. Replace the placeholders with values from your authentik instance. ```elixir title="config.exs" config :ueberauth, Ueberauth, providers: [ keycloak: {Ueberauth.Strategy.Keycloak, [default_scope: "openid profile email"]} ] config :mobilizon, :auth, oauth_consumer_strategies: [ {:keycloak, "authentik"} ] config :ueberauth, Ueberauth.Strategy.Keycloak.OAuth, client_id: "", client_secret: "", site: "https://authentik.company", authorize_url: "https://authentik.company/application/o/authorize/", token_url: "https://authentik.company/application/o/token/", userinfo_url: "https://authentik.company/application/o/userinfo/", token_method: :post ``` Restart the Mobilizon service for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with Mobilizon, open Mobilizon, log out, then use the **authentik** button on the login page and verify that Single Sign-On succeeds. ## Resources - [Mobilizon documentation - OAuth authentication](https://docs.mobilizon.org/3.%20System%20administration/configure/auth/#oauth) - [ueberauth\_keycloak\_strategy - OAuth module settings](https://ueberauth-keycloak-strategy.hexdocs.pm/Ueberauth.Strategy.Keycloak.OAuth.html) --- ## Integrate with Nextcloud ## What is Nextcloud? > Nextcloud is an open-source content collaboration platform for file sync and share, groupware, and related productivity apps that can be self-hosted or run as a managed service. > > \-- [https://nextcloud.com/](https://nextcloud.com/) If you require [Nextcloud server-side encryption](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html) with per-user keys, use LDAP. OIDC and SAML do not provide Nextcloud with the user's cleartext password, which can prevent encrypted user data from being decrypted. OIDC and SAML login require Nextcloud to run with HTTPS enabled. If Nextcloud is behind a reverse proxy, configure Nextcloud's overwrite parameters so generated URLs use `https`. If an OIDC or SAML configuration issue prevents users from logging in, visit `https://nextcloud.company/login?direct=1` to use Nextcloud's built-in authentication. ## Preparation The following placeholders are used in this guide: - `nextcloud.company` is the FQDN of the Nextcloud installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Nextcloud can use OIDC, SAML, or LDAP for authentication. OIDC is usually the simplest SSO method for a new Nextcloud deployment. Use LDAP when Nextcloud needs direct password authentication, such as deployments that rely on server-side encryption with per-user keys. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Nextcloud with authentik over OIDC, you need to create an application/provider pair. If you want authentik to send Nextcloud storage quotas, group membership, or existing Nextcloud user IDs, also create a custom scope mapping. ### Create a scope mapping If you do not need storage quota, group information, administrator assignment, or existing-user matching in Nextcloud, skip to the next section. This mapping reads Nextcloud-specific groups from application entitlements. After you create the application below, create entitlements with names that match the group names Nextcloud should receive. To grant Nextcloud administrator access, create an entitlement named `admin` and bind the appropriate users or groups to it. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property mappings** and click **Create**. - **Select type**: select **Scope Mapping**. - **Create Scope Mapping**: - **Name**: `Nextcloud Profile` - **Scope name**: `nextcloud` - **Expression**: ```python groups = [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ] quota = ( request.user.app_entitlements_attributes(provider.application).get("nextcloud_quota") or request.user.group_attributes().get("nextcloud_quota") ) return { "name": request.user.name, "groups": groups, "quota": quota, "user_id": request.user.attributes.get("nextcloud_user_id", str(request.user.uuid)), } ``` 3. Click **Finish**. To set a quota, define the `nextcloud_quota` attribute on a user, group, or Nextcloud application entitlement. For example, setting it to `1 GB` restricts the user to 1 GB of storage. To connect an authentik user to an existing Nextcloud account, set the user's `nextcloud_user_id` attribute to the existing Nextcloud username. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://nextcloud.company/apps/user_oidc/code`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://nextcloud.company`. - Select any available signing key. - Under **Advanced protocol settings**: - **Subject Mode**: select `Based on the User's UUID`. - If you created the `Nextcloud Profile` scope mapping, add it to **Selected Scopes**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. If you created the `Nextcloud Profile` scope mapping and want authentik to send Nextcloud-specific group values, open the new application, click the **Application entitlements** tab, and create the entitlements that Nextcloud should receive in the `groups` claim. Bind the appropriate users or groups to each entitlement. ### Configure the OpenID Connect user backend 1. In Nextcloud, install the **OpenID Connect user backend** app. 2. Log in to Nextcloud as an administrator and navigate to **Settings** > **OpenID Connect**. 3. Click the **+** button and enter the following settings: - **Identifier**: `authentik` - **Client ID**: `` - **Client secret**: `` - **Discovery endpoint**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Scope**: `email profile openid` - If you created the `Nextcloud Profile` scope mapping, add `nextcloud` to the **Scope** value. - Under **Attribute mapping**: - **User ID mapping**: `sub` - **Display name mapping**: `name` - **Email mapping**: `email` - If you created the `Nextcloud Profile` scope mapping: - **User ID mapping**: `user_id` - **Quota mapping**: `quota` - **Groups mapping**: `groups` - Enable **Use group provisioning**. - Disable **Use unique user ID** if you use `user_id` to match existing Nextcloud users or if you send the `admin` group for administrator access. If authentik and Nextcloud are running on the same host and Nextcloud cannot reach authentik, add `'allow_local_remote_servers' => true` to the Nextcloud `config/config.php` file. ### Enable OIDC back-channel logout *(optional)* To automatically log users out of their Nextcloud sessions when they log out of authentik, enable back-channel logout. 1. In Nextcloud, navigate to **Settings** > **OpenID Connect**. 2. Under **Registered Providers**, locate the provider with the identifier used earlier. 3. Copy the back-channel logout URL for that provider. For example, `https://nextcloud.company/apps/user_oidc/backchannel-logout/authentik`. 4. In authentik, navigate to **Applications** > **Providers** and edit the Nextcloud provider. 5. Under **Protocol settings**, set **Logout URI** to the copied back-channel logout URL. 6. Set **Logout Method** to `Back-channel`. 7. Click **Update**. ### Make OIDC the default login method *(optional)* If this is the only configured OpenID Connect provider, run the following command on the Nextcloud host to redirect users to authentik automatically when they access the Nextcloud login page: ```bash sudo -u www-data php /var/www/nextcloud/occ config:app:set --type=string --value=0 user_oidc allow_multiple_user_backends ``` Administrators can still use Nextcloud's built-in authentication with `https://nextcloud.company/login?direct=1`. authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. To support the integration of Nextcloud with authentik over SAML, you need to create an application/provider pair. If you want authentik to send Nextcloud storage quotas or group memberships, also create SAML property mappings. ### Create SAML property mappings If you do not need storage quota or group information in Nextcloud, skip to the next section. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property mappings** and click **Create**. - **Select type**: select **SAML Provider Property Mapping**. - **Create SAML Provider Property Mapping**: - **Name**: `Nextcloud quota` - **SAML Attribute Name**: `nextcloud_quota` - **Expression**: ```python return ( request.user.app_entitlements_attributes(provider.application).get("nextcloud_quota") or request.user.group_attributes().get("nextcloud_quota") ) ``` 3. Click **Finish**. 4. Click **Create** again. - **Select type**: select **SAML Provider Property Mapping**. - **Create SAML Provider Property Mapping**: - **Name**: `Nextcloud groups` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/claims/Group` - **Expression**: ```python for entitlement in request.user.app_entitlements(provider.application): yield entitlement.name ``` 5. Click **Finish**. This mapping reads Nextcloud-specific groups from application entitlements. After you create the application below, create entitlements with names that match the group names Nextcloud should receive. To grant Nextcloud administrator access, create an entitlement named `admin` and bind the appropriate users or groups to it. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://nextcloud.company/apps/user_saml/saml/acs`. - Set the **Audience** to `https://nextcloud.company/apps/user_saml/saml/metadata`. - Set the **SLS URL** to `https://nextcloud.company/apps/user_saml/saml/sls`. - Set the **SLS Binding** to `Redirect`. - Set the **Logout Method** to `Front-channel (Iframe)`. - Under **Advanced protocol settings**, select an available **Signing certificate**. - If you created SAML property mappings for Nextcloud, add them to **Property mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. If you created the `Nextcloud groups` property mapping, open the new application, click the **Application entitlements** tab, and create the entitlements that Nextcloud should receive as SAML group values. Bind the appropriate users or groups to each entitlement. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click the name of the newly created Nextcloud provider. 2. Under **Download signing certificate**, click **Download**. The contents of this certificate will be required when configuring Nextcloud. ### Configure SSO & SAML authentication 1. Log in to Nextcloud as an administrator and navigate to **Apps** by clicking your profile picture in the top-right corner. 2. Install the **SSO & SAML authentication** app. 3. Click your profile picture in the top-right corner and select **Administrative settings**. 4. Under **SSO & SAML authentication**, click **Use built-in SAML authentication**. 5. In the **General** section, set: - **Attribute to map the UID to**: `http://schemas.goauthentik.io/2021/02/saml/uid` - **Optional display name**: `authentik` Using the UID attribute as username is not recommended because of its mutable nature. If you map to the username instead, [disable username changing](/docs/sys-mgmt/settings#allow-users-to-change-username) and set **Attribute to map the UID to** to `http://schemas.goauthentik.io/2021/02/saml/username`. 6. In the **Identity Provider Data** section, set: - **Identifier of the IdP entity**: `https://authentik.company/application/saml//metadata/` - **URL Target of the IdP where the SP will send the Authentication Request Message**: `https://authentik.company/application/saml//` - Under **Show optional Identity Provider settings**: - **URL Location of the IdP where the SP will send the SLO Request**: `https://authentik.company/application/saml//` - **X.509 certificate of the IdP**: paste the contents of the certificate file downloaded from authentik. 7. In the **Attribute mapping** section, set: - **Attribute to map the display name to**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` - **Attribute to map the email address to**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` - If you created the `Nextcloud quota` property mapping, set **Attribute to map the quota to** to `nextcloud_quota`. - If you created the `Nextcloud groups` property mapping, set **Attribute to map the user's groups to** to `http://schemas.xmlsoap.org/claims/Group`. To support the integration of Nextcloud with authentik over LDAP, you need to create an application/provider pair and deploy an LDAP outpost. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **LDAP** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the bind flow to use for this provider, and the following required configuration. - Note the **Base DN** because it will be required later. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create an LDAP outpost 1. Navigate to **Applications** > **Outposts** and click **Create**. - **Name**: provide a suitable name for the outpost. - **Type**: select `LDAP`. - **Applications**: add the newly created Nextcloud application to **Selected Applications**. 2. Click **Create**. ### Configure the LDAP user and group backend 1. In Nextcloud, install the **LDAP user and group backend** app. 2. Log in to Nextcloud as an administrator. 3. Navigate to **Settings** > **LDAP user and group backend**. 4. On the **Server** tab: - Click the **+** icon. - **Host**: enter the hostname or IP address of the authentik LDAP outpost, preceded by `ldap://` or `ldaps://`. - **Port**: enter `389` for LDAP or `636` for LDAPS. - Under **Credentials**, enter the **Bind DN** of the authentik LDAP provider and the associated user password. - Under **Base DN**, enter the **Base DN** of the authentik LDAP provider. 5. On the **Users** tab, set **Only these object classes** to `user`. 6. On the **LDAP/AD integration** tab: - Clear **LDAP/AD Username**. - Set **Other Attributes** to `cn`. - Click **Expert** in the top-right corner and set: - **Internal Username Attribute**: `uid` - **UUID Attribute for Users**: `uid` - **UUID Attribute for Groups**: `gidNumber` - Click **Advanced** in the top-right corner and set: - Under **Connection Settings**: - **Configuration Active**: checked - Under **Directory Settings**: - **User Display Name Field**: `name` - **Base User Tree**: `ou=users,` - **Group Display Name Field**: `cn` - **Base Group Tree**: `ou=groups,` - **Group-Member Association**: `member (AD)` - Under **Special Attributes**: - **Email Field**: `mail` 7. On the **Groups** tab: - Set **Only these object classes** to `group`. - Select the authentik groups that require Nextcloud access. ## Configuration verification To confirm that authentik is properly configured with Nextcloud, log out of Nextcloud and use the login method you configured: - For OIDC, click **Login with authentik**. You should be redirected to authentik and then returned to the Nextcloud dashboard. - For SAML, click **SSO & SAML log in**. You should be redirected to authentik and then returned to the Nextcloud dashboard. - For LDAP, log in with an LDAP user from authentik. ## Resources - [Nextcloud App Store - OpenID Connect user backend](https://apps.nextcloud.com/apps/user_oidc) - [Nextcloud user\_oidc app documentation](https://github.com/nextcloud/user_oidc) - [Nextcloud user\_saml app source](https://github.com/nextcloud/user_saml) - [Nextcloud Administration Manual - User authentication with LDAP](https://docs.nextcloud.com/server/stable/admin_manual/configuration_user/user_auth_ldap.html) - [Nextcloud Administration Manual - Reverse proxy overwrite parameters](https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/reverse_proxy_configuration.html#overwrite-parameters) - [Nextcloud Administration Manual - Server-side encryption](https://docs.nextcloud.com/server/stable/admin_manual/configuration_files/encryption_configuration.html) --- ## Integrate with OnlyOffice ## What is ONLYOFFICE? > ONLYOFFICE is an online office and productivity suite for document editing and collaboration. ONLYOFFICE Workspace adds document management, projects, CRM, mail, calendars, and an administrative control panel. > > \-- [https://www.onlyoffice.com/](https://www.onlyoffice.com/) ## Preparation The following placeholders are used in this guide: - `onlyoffice.company` is the FQDN of the ONLYOFFICE Workspace installation. - `authentik.company` is the FQDN of the authentik installation. This guide is for ONLYOFFICE Workspace server installations that include the ONLYOFFICE Control Panel. ONLYOFFICE can only be connected to one SAML identity provider at a time. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ### Download the ONLYOFFICE service provider metadata 1. Log in to ONLYOFFICE Workspace as an administrator. 2. Click the cog icon in the navigation bar, then click **Control Panel** in the sidebar. 3. In the Control Panel tab, click **SSO** in the sidebar. 4. Enable **Single Sign-on Authentication**. 5. Scroll down to **ONLYOFFICE SP Metadata**. 6. Click **Download SP Metadata XML** to save the ONLYOFFICE SP metadata XML file. You will upload this file to authentik in the next section. ## authentik configuration To support the integration of ONLYOFFICE Workspace with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider from Metadata** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configuration: - **Metadata**: select the SP metadata XML you downloaded from ONLYOFFICE Workspace during the preparation step. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Navigate to **Applications** > **Providers** and click the provider you created. 5. Click **Edit** and set the following values: - Confirm that the **SLS URL** and **SLS Binding** were imported from the ONLYOFFICE SP metadata, then set **Logout Method** to `Front-channel (Iframe)`. - Under **Advanced protocol settings**: - **Signing Certificate**: select any available certificate. - **Sign responses**: enable this option. 6. Click **Update**. 7. Under **Related objects** > **Metadata**, click **Copy download URL**. This metadata download URL will be required in the next section. ## OnlyOffice configuration 1. Return to the ONLYOFFICE Control Panel and open **SSO**. 2. Paste the metadata download URL from authentik into **URL to IdP Metadata XML** and click the upload button next to the field. 3. Confirm that **IdP Single Logout Endpoint URL** is populated from the uploaded authentik metadata, and select the **Binding** that matches the **SLS Binding** shown on the authentik provider. 4. Under **Attribute Mapping**, set the following values: - **First Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` - **Last Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` - **Email**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` 5. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with ONLYOFFICE Workspace, log out of ONLYOFFICE Workspace, open it again, and click **Single Sign-on** on the login page. You should be redirected to authentik to log in, then redirected back to ONLYOFFICE Workspace. ## Resources - [ONLYOFFICE DocSpace - Configuring ONLYOFFICE SP and Authentik IdP](https://helpcenter.onlyoffice.com/docspace/configuration/configure-authentik.aspx) - [ONLYOFFICE Workspace - Single Sign-on overview for server version](https://helpcenter.onlyoffice.com/workspace/administration/control-panel-sso-description.aspx) --- ## Integrate with OpenCloud ## What is OpenCloud? > OpenCloud is an open-source content collaboration platform for storing, syncing, and sharing files, built on the Infinite Scale (oCIS) architecture. > > \-- [https://opencloud.eu](https://opencloud.eu) ## Preparation The following placeholders are used in this guide: - `opencloud.company` is the FQDN of the OpenCloud installation. - `authentik.company` is the FQDN of the authentik installation. This guide covers integrating authentik with the [`opencloud-compose`](https://github.com/opencloud-eu/opencloud-compose) Docker deployment. OpenCloud only supports authentication via OpenID Connect (OIDC). Choose your setup below. The **Web only** tab logs in through the browser. The **Web, desktop & mobile** tab also enables the native sync clients, which each use a distinct client ID and require some extra issuer configuration. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. 1. Log in to authentik as an administrator and open the Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application**. - **Application**: provide a name and note the **slug**. - **Choose a Provider type**: select **OAuth2/OpenID Connect**. - **Configure the Provider**: - **Client type**: `Public` - **Client ID**: `web` - **Redirect URIs**: - `Strict` `Authorization`: `https://opencloud.company/oidc-callback.html` - `Strict` `Authorization`: `https://opencloud.company/oidc-silent-redirect.html` - `Strict` `Authorization`: `https://opencloud.company/` - **Signing Key**: select any available key. - **Scopes**: `openid`, `profile`, `email`. - Under **Advanced protocol settings**, set **Logout URI** to `https://opencloud.company/backchannel_logout` and **Logout Method** to `Back-channel`. 3. Click **Submit**. ## OpenCloud configuration In the `opencloud-compose` project, enable the external IdP overlay in `COMPOSE_FILE`. This replaces OpenCloud's built-in IdP, so login goes through authentik only. ```bash COMPOSE_FILE=docker-compose.yml:idm/external-idp.yml:custom/authentik-roles.yml ``` Set the OIDC values in `.env`: ```bash OC_DOMAIN=opencloud.company IDP_DOMAIN=authentik.company IDP_ISSUER_URL=https://authentik.company/application/o// OC_OIDC_CLIENT_ID=web OC_OIDC_CLIENT_SCOPES=openid profile email WEBFINGER_WEB_OIDC_CLIENT_ID=web WEBFINGER_WEB_OIDC_CLIENT_SCOPES=openid profile email ``` Create `custom/authentik-roles.yml` to assign every user the default role: ```yaml --- services: opencloud: environment: PROXY_ROLE_ASSIGNMENT_DRIVER: "default" GRAPH_ASSIGN_DEFAULT_USER_ROLE: "true" ``` Then reboot your Docker containers. ## Configuration verification Open `https://opencloud.company` in a new browser window. You are redirected to authentik to log in, and after authenticating you are returned to OpenCloud. OpenCloud's web, desktop, Android, and iOS clients each use a distinct client ID, but must validate tokens against one issuer. authentik gives every application its own issuer by default, so this setup uses **GLOBAL issuer mode** (all providers share `https://authentik.company/`) plus a reverse proxy that serves OIDC discovery at that shared issuer. ## Reverse proxy configuration With GLOBAL issuer mode enabled, tokens use an issuer of `iss = https://authentik.company/`, but authentik only exposes OpenID Connect discovery at `https://authentik.company/application/o//.well-known/openid-configuration`. To reconcile this, place a reverse proxy in front of authentik that maps the root discovery URL to a specific provider’s discovery endpoint. Any reverse proxy can handle this; for example, with Caddy: ```caddy # Forward authentik.company to this; it in turn forwards to authentik. :8081 { @discovery path /.well-known/openid-configuration rewrite @discovery /application/o//.well-known/openid-configuration reverse_proxy authentik-upstream:9000 { # keep authentik building https URLs if it is behind TLS termination header_up X-Forwarded-Proto https } } ``` ## authentik configuration Repeat these steps for **each** of the four clients (Web, Desktop, Android, and iOS), using the per-client values from the table below. | Client | Client ID | Redirect URIs | | ------- | ------------------ | ------------------------------------------------------------------------------------------------------------- | | Web | `web` | `Strict` `Authorization`: `https://opencloud.company/oidc-callback.html`, `…/oidc-silent-redirect.html`, `…/` | | Desktop | `OpenCloudDesktop` | `Regex` `Authorization`: `http://127.0.0.1(:[0-9]+)?(/.*)?` and `http://localhost(:[0-9]+)?(/.*)?` | | Android | `OpenCloudAndroid` | `Strict` `Authorization`: `oc://android.opencloud.eu` | | iOS | `OpenCloudIOS` | `Strict` `Authorization`: `oc://ios.opencloud.eu` | 1. Log in to authentik as an administrator and open the Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application**. - **Application**: provide a name and note the **slug**. - **Choose a Provider type**: select **OAuth2/OpenID Connect**. - **Configure the Provider**: - **Client type**: `Public` - **Client ID**: the client's value from the table above. - **Redirect URIs**: the client's value from the table above. - **Signing Key**: select the **same** key for all four providers (the shared issuer exposes a single `jwks_uri`, so all clients' tokens must be signed by one key). - Under **Advanced protocol settings**, add `offline_access` to **Selected scopes**. - **Under advanced protocol settings**: - **Issuer mode**: `Same identifier is used for all providers`. 3. Click **Submit**. ## OpenCloud configuration In the `opencloud-compose` project, enable the external IdP overlay in `COMPOSE_FILE`. This replaces OpenCloud's built-in IdP, so login goes through authentik only. ```bash COMPOSE_FILE=docker-compose.yml:idm/external-idp.yml:custom/authentik-roles.yml ``` Set the OIDC values in `.env`. `OC_OIDC_ISSUER` points at the shared (root) issuer, and each client uses its own WebFinger client ID: ```bash OC_DOMAIN=opencloud.company IDP_DOMAIN=authentik.company IDP_ISSUER_URL=https://authentik.company/ OC_OIDC_CLIENT_ID=web OC_OIDC_CLIENT_SCOPES=openid profile email WEBFINGER_WEB_OIDC_CLIENT_ID=web WEBFINGER_WEB_OIDC_CLIENT_SCOPES=openid profile email WEBFINGER_DESKTOP_OIDC_CLIENT_ID=OpenCloudDesktop WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES=openid profile email offline_access WEBFINGER_IOS_OIDC_CLIENT_ID=OpenCloudIOS WEBFINGER_IOS_OIDC_CLIENT_SCOPES=openid profile email offline_access WEBFINGER_ANDROID_OIDC_CLIENT_ID=OpenCloudAndroid WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES=openid profile email offline_access ``` Create `custom/authentik-roles.yml` to assign every user the default role: ```yaml --- services: opencloud: environment: PROXY_ROLE_ASSIGNMENT_DRIVER: "default" GRAPH_ASSIGN_DEFAULT_USER_ROLE: "true" ``` Then reboot your Docker containers. ## Configuration verification Open `https://opencloud.company` in a browser, and add the account in the Desktop, iOS, and Android apps using the same server URL. Each client is redirected to authentik to log in and returned to the client afterwards. ## Resources - [OpenCloud docs — Integrating external OpenID Connect Identity Providers](https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/external-idp) - [opencloud-compose](https://github.com/opencloud-eu/opencloud-compose) --- ## Integrate with OpenProject ## What is OpenProject? > OpenProject is a web-based project management software. Use OpenProject to manage your projects, tasks and goals. Collaborate via work packages and link them to your pull requests on GitHub. > > \-- [https://www.openproject.org/](https://www.openproject.org/) ## Preparation The following placeholders are used in this guide: - `openproject.company` is the FQDN of the OpenProject installation. - `authentik.company` is the FQDN of the authentik installation. OpenID Connect providers is an OpenProject Enterprise add-on. If **OpenID providers** is not available in your OpenProject instance, activate the Enterprise edition before continuing. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of OpenProject with authentik, you need to create a property mapping and an application/provider pair in authentik. ### Create a scope mapping OpenProject requires a first and last name for each user. By default, authentik only stores a user's full name as a single string. Therefore you need to create a property mapping to provide separate first and last names to OpenProject. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. - **Select type**: select **Scope Mapping** as the property mapping type. - **Configure the Scope Mapping**: provide a descriptive name (e.g. `OpenProject Profile Scope`), and an optional description. - **Scope name**: `profile` - **Expression**: ```python showLineNumbers name = request.user.name or request.user.username first_name, _, last_name = name.rpartition(" ") return { "name": name, "given_name": first_name or name, "family_name": last_name or name, "preferred_username": request.user.username, "nickname": request.user.username, "groups": [group.name for group in request.user.groups.all()], "first_name": first_name or name, "last_name": last_name or name, } ``` 3. Click **Finish** to save the property mapping. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **Protocol settings**: - Note the **Client ID** and **Client Secret** values because they will be required later. - **Redirect URI**: - `Strict` `Authorization`: `https://openproject.company/auth/oidc-authentik/callback` - **Signing Key**: select any available signing key. - **Advanced protocol settings**: - **Scopes**: - Remove `authentik default OAuth Mapping: OpenID 'profile'` from **Selected Scopes**. - Add the scope that you created in the previous section (e.g. `OpenProject Profile Scope`) to **Selected Scopes**. - **Logout URI**: `https://openproject.company/auth/oidc-authentik/backchannel-logout` - **Logout Method**: `Back-channel` - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## OpenProject configuration To support the integration of authentik with OpenProject, you need to configure authentication in the OpenProject administration interface. 1. Log in to OpenProject as an administrator, click your profile icon in the top-right corner, and then click **Administration**. 2. Navigate to **Authentication** > **OpenID providers**. 3. Click **+ OpenID provider** and select **Custom**. 4. Set **Display Name** to `authentik` to match the `/auth/oidc-authentik/callback` redirect URI configured in authentik. 5. In the discovery endpoint section, select **I have a discovery endpoint URL**, and enter: `https://authentik.company/application/o//.well-known/openid-configuration` 6. Continue to **Advanced configuration** > **Metadata**. The values should be automatically populated based on your discovery endpoint URL. If not, copy these values from the **Overview** page of the OpenProject provider in authentik. 7. Under **Advanced configuration** > **Client details**, enter the **Client ID** and **Client Secret** values from authentik. 8. Under **Optional configuration** > **Attribute mapping**, enter the following required configurations: - **Mapping for: Username**: `preferred_username` - **Mapping for: Email**: `email` - **Mapping for: First Name**: `first_name` - **Mapping for: Last Name**: `last_name` 9. Click **Finish setup**. OpenProject can optionally synchronize groups from the `groups` claim included in the scope mapping above. Enable **Synchronize groups** only if authentik should become responsible for OpenProject group assignments for users who log in with this provider. When enabled, OpenProject removes group memberships that are not included in the claim on each login. ## Configuration verification To confirm that authentik is properly configured with OpenProject, log out of OpenProject, and then click on **authentik** and enter your authentik credentials to log back in. ## Resources - [OpenProject Documentation - OpenID providers](https://www.openproject.org/docs/system-admin-guide/authentication/openid-providers/) --- ## Integrate with ownCloud ## What is ownCloud? > ownCloud is a free and open-source software project for content collaboration and sharing and syncing of files. > > \-- [https://owncloud.com](https://owncloud.com) ## Preparation The following placeholders are used in this guide: - `owncloud.company` is the FQDN of the ownCloud installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This guide focuses on ownCloud Server deployments using Docker and the official ownCloud OpenID Connect (OIDC) app. If you deployed ownCloud Server using a different mechanism, the configuration file location and service management commands might differ. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of ownCloud with authentik, you need to create an application/provider pair for each ownCloud client type that should use OIDC: Web UI, Desktop, Android, and iOS. ownCloud Server stores one OIDC provider URL in its configuration, but the ownCloud desktop and mobile clients use their own predefined client IDs, secrets, and redirect URIs. Use the values from this table when creating the authentik providers. | ownCloud client | Client ID | Client Secret | Redirect URI | | --------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------- | | Web UI | Use the value generated by authentik. | Use the value generated by authentik. | `Strict` `Authorization`: `https://owncloud.company/index.php/apps/openidconnect/redirect` | | Desktop | `xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69` | `UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh` | `Regex` `Authorization`: `http://localhost(:[0-9]+)?(/.*)?` and `Regex` `Authorization`: `http://127.0.0.1(:[0-9]+)?(/.*)?` | | Android | `e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD` | `dInFYGV33xKzhbRmpqQltYNdfLdJIfJ9L5ISoKhNoT9qZftpdWSP71VrpGR9pmoD` | `Strict` `Authorization`: `oc://android.owncloud.com` | | iOS | `mxd5OQDk6es5LzOzRvidJNfXLUZS2oN3oUFeXPP8LpPrhx3UroJFduGEYIBOxkY1` | `KFeFWWEZO9TkisIQzR3fo7hfiMXlOpaqP8CFuTbSHzV1TUuGECglPxpiVKJfOXIx` | `Strict` `Authorization`: `oc://ios.owncloud.com` | ### Create applications and providers 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. Repeat the wizard once for each ownCloud client type that you want to support. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. For the Web UI application, note the **Slug** value because it is used as the `` value in the ownCloud configuration. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **Client ID**: enter the client ID from the table above. - **Client Secret**: enter the client secret from the table above. - **Redirect URIs**: add the redirect URI values from the table above. - **Signing Key**: select the same signing key for all ownCloud providers. - **Advanced protocol settings** > **Scopes**: select `openid`, `profile`, `email`, and `offline_access`. - For the **Web UI** provider, under **Advanced protocol settings**, set **Logout URI** to `https://owncloud.company/index.php/apps/openidconnect/logout` and **Logout Method** to `Front-channel`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## ownCloud configuration ### Install the OpenID Connect app 1. Log in to ownCloud as an administrator. 2. Open the Market by navigating to `https://owncloud.company/apps/market/#/`, or by clicking the hamburger menu in the top-left corner of any page in ownCloud and selecting **Market**. 3. Search for and enable the **OpenID Connect** app. ### Configure the OpenID Connect app The OpenID Connect app cannot be configured from the ownCloud UI. Configure it by adding settings to the ownCloud configuration file or by storing the same settings in the ownCloud database with `occ`. For clustered setups, ownCloud recommends database-backed app configuration. The Docker Compose deployment from the ownCloud documentation mounts the `files` volume at `/mnt/data` inside the ownCloud container. In that deployment, place `oidc.config.php` in the `/mnt/data/config` directory. If your deployment stores ownCloud configuration elsewhere, place the file in the same directory as `config.php`. You can configure ownCloud to use either the `sub` or `preferred_username` claim as the UID field under `search-attribute`. When using `preferred_username`, disable the authentik [**Allow users to change username** setting](/docs/sys-mgmt/settings#allow-users-to-change-username) to prevent authentication issues if a username changes. ```php title="/mnt/data/config/oidc.config.php" 'None', 'openid-connect' => [ 'provider-url' => 'https://authentik.company/application/o//', 'client-id' => '', 'client-secret' => '', 'loginButtonName' => 'Log in with authentik', 'mode' => 'userid', 'search-attribute' => 'preferred_username', ], ]; ``` To allow ownCloud to create users automatically when they first sign in with authentik, add the `auto-provision` block: ```php title="/mnt/data/config/oidc.config.php" 'None', 'openid-connect' => [ 'provider-url' => 'https://authentik.company/application/o//', 'client-id' => '', 'client-secret' => '', 'loginButtonName' => 'Log in with authentik', 'mode' => 'userid', 'search-attribute' => 'preferred_username', 'auto-provision' => [ 'enabled' => true, 'email-claim' => 'email', 'display-name-claim' => 'name', 'update' => [ 'enabled' => true, ], ], ], ]; ``` The configuration above creates ownCloud users with the same username as their authentik username. To use the user's email address as the ownCloud username instead, remove the `mode` and `search-attribute` settings. Using email addresses as ownCloud usernames can make mobile clients display usernames in a format such as `user@email.com@owncloud.company`. To make ownCloud redirect immediately to authentik from its login page, add `autoRedirectOnLoginPage` to the `openid-connect` configuration. Keep this disabled until you have tested OIDC login. ```php title="/mnt/data/config/oidc.config.php" [ 'autoRedirectOnLoginPage' => true, ], ]; ``` If `autoRedirectOnLoginPage` is enabled while OIDC is misconfigured, you can lock yourself out of the normal ownCloud login page. Disable the setting and restart ownCloud to restore the standard login page. To force existing desktop, Android, and iOS client sessions to authenticate again with OIDC, set `token_auth_enforced` to `true`. ```php title="/mnt/data/config/oidc.config.php" true, ]; ``` ### Configure service discovery To allow the ownCloud desktop, Android, and iOS clients to use OIDC, configure your reverse proxy to rewrite `https://owncloud.company/.well-known/openid-configuration` to `https://owncloud.company/index.php/apps/openidconnect/config`. Do not configure this as an HTTP redirect. ownCloud clients expect the discovery document to be served directly from `/.well-known/openid-configuration`. ## Configuration verification To confirm that authentik is properly configured with ownCloud, open ownCloud and select the **Log in with authentik** option. A successful authentication redirects you to authentik and then returns you to ownCloud as a signed-in user. If you configured service discovery, add a new connection in the ownCloud desktop or mobile app. The client should discover OIDC and send you through the authentik sign-in flow. ## Resources - [ownCloud Server documentation - OpenID Connect](https://doc.owncloud.com/server/latest/admin_manual/configuration/user/oidc/oidc.html) - [ownCloud Server documentation - Installing with Docker](https://doc.owncloud.com/server/latest/admin_manual/installation/docker/index.html) - [ownCloud OpenID Connect app README](https://github.com/owncloud/openidconnect/blob/master/README.md) --- ## Integrate with Placetel ## What is Placetel? > Placetel is a German cloud communications provider, specializing in VoIP-based telephony, unified communications (UCaaS), and collaboration tools for businesses. > > \-- [https://www.placetel.de/](https://www.placetel.de/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `company.tld` is the domain of your users' email addresses. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Placetel with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://accounts.webex.placetel.de/users/saml/auth`. - Set the **SLS URL** to `https://accounts.webex.placetel.de/users/saml/idp_sign_out`. - Under **Advanced protocol settings**, set an available **Signing Certificate** and ensure that **Sign assertions** and **Sign responses** are enabled. - Remove all **Property Mappings** except for `authentik default SAML Mapping: Email`. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section. 3. Under **Related objects** > **Metadata**, click **Download**. This downloaded file is your **SAML Metadata** file and is required in the next section. ## Placetel configuration To integrate Placetel with authentik, configure SSO in the Placetel portal. 1. Log in to the [Placetel portal](https://accounts.webex.placetel.de) as an Administrator. 2. Click the organization name in the bottom-left corner and select **Settings**. 3. Scroll to the bottom of the page. Next to the **Single Sign On (SSO/SAML)** section heading, select **Edit**. 4. In the **Import** section, click **Choose File** and upload the **SAML Metadata** file that you downloaded from authentik. 5. In the **Settings** section, confirm or enter the following values: - **SP Entity ID**: `https://web.placetel.de` with no trailing slash. - **IDP Entity ID**: `https://authentik.company/application/saml//metadata/` - **Domains**: `company.tld`. Add any other email domains that should use SSO. 6. Leave **Activate Single Sign On** unchecked until you are ready to switch Placetel sign-ins to SSO. 7. Click **Save settings**. ### Activate SSO After saving the configuration, return to the Placetel SSO configuration page, check **Activate Single Sign On**, and click **Save settings**. ## Configuration verification To confirm that authentik is properly configured with Placetel, open the Placetel portal and sign in with an existing Placetel user's email address. Placetel does not create new users through authentik. After clicking **Login**, you should be redirected to authentik and then signed in to Placetel. The default login link on the Placetel homepage will not work. ## Resources - [Placetel Help - SSO (SAML)](https://www.placetel.de/hilfe/webex-fuer-placetel/sso-saml-webex-fuer-placetel) - [Placetel SAML Metadata](https://accounts.webex.placetel.de/users/saml/metadata) --- ## Integrate with Plane ## What is Plane? > Plane is a project and knowledge management platform that brings projects, documentation, and workflows into a single workspace. > > \-- [https://plane.so/](https://plane.so/) ## Preparation The following placeholders are used in this guide: - `plane.company` is the FQDN of the self-hosted Plane installation. This placeholder is not used for Plane Cloud. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. OIDC SSO requires a Plane Cloud Business plan or a self-hosted Plane Pro or Business plan. Plane Cloud also requires a verified email domain before you configure SSO. Domain verification is outside the scope of this guide. Choose your Plane deployment below. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Plane Cloud with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), select the authorization flow to use for this provider, and configure the following settings: - Note the **Client ID** and **Client Secret** values because they are required later. - Add a `Strict` `Authorization` redirect URI with the temporary value `https://temp.temp`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the application and provider. ## Plane configuration ### Get the Plane connection details 1. Log in to Plane Cloud as a workspace administrator. 2. Navigate to **Workspace Settings** > **Identity**. 3. Click **Configure** next to **Enable OIDC**, and then click **Get setup details**. 4. Copy the **Redirect URL** and **Logout URL**. You need these values to update the authentik provider. ### Update the authentik provider 1. In a separate browser tab, log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the provider that you created for Plane. 3. Replace the temporary **Redirect URI** with the **Redirect URL** that you copied from Plane. Keep the URI type set to `Strict` `Authorization`. 4. Add the **Logout URL** from Plane as a `Strict` `Post Logout` redirect URI. 5. Click **Update** to save the provider. ### Configure OIDC 1. Return to the Plane Cloud OIDC configuration page. 2. Configure the following settings: - **Client ID**: enter the Client ID from authentik. - **Client secret**: enter the Client Secret from authentik. - **Authorize URL**: `https://authentik.company/application/o/authorize/` - **Token URL**: `https://authentik.company/application/o/token/` - **Users' info URL**: `https://authentik.company/application/o/userinfo/` - **Logout URL**: `https://authentik.company/application/o//end-session/` 3. Click **Save changes** to enable OIDC authentication. ## Configuration verification To confirm that authentik is properly configured with Plane Cloud, log out, open Plane, and click **Sign in with Single Sign-On**. You should be redirected to authentik and then returned to Plane after authentication. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of self-hosted Plane with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), select the authorization flow to use for this provider, and configure the following settings: - Note the **Client ID** and **Client Secret** values because they are required later. - Add the following redirect URIs: - `Strict` `Authorization`: `https://plane.company/auth/oidc/callback/` - `Strict` `Post Logout`: `https://plane.company/auth/oidc/logout/` - `Strict` `Authorization`: `https://plane.company/auth/mobile/oidc/callback/` - `Strict` `Post Logout`: `https://plane.company/auth/mobile/oidc/logout/` - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the application and provider. ## Plane configuration 1. Log in to Plane as an instance administrator and open **God Mode**. 2. Navigate to **Authentication** > **OIDC**. 3. Configure the following settings: - **Client ID**: enter the Client ID from authentik. - **Client secret**: enter the Client Secret from authentik. - **Authorize URL**: `https://authentik.company/application/o/authorize/` - **Token URL**: `https://authentik.company/application/o/token/` - **Users' info URL**: `https://authentik.company/application/o/userinfo/` - **Logout URL**: `https://authentik.company/application/o//end-session/` - **IdP's name**: `authentik` 4. Click **Save changes**, and then enable OIDC using the toggle at the top of the page. ## Configuration verification To confirm that authentik is properly configured with self-hosted Plane, log out, open Plane, and click **Continue with authentik**. You should be redirected to authentik and then returned to Plane after authentication. ## Resources - [Plane documentation - Single sign-on](https://docs.plane.so/authentication/sso) - [Plane developer documentation - OIDC SSO](https://developers.plane.so/self-hosting/govern/oidc-sso) - [Plane developer documentation - Instance admin and God mode](https://developers.plane.so/self-hosting/govern/instance-admin) --- ## Integrate with Planka ## What is Planka? > Planka is an open-source, Trello-like application with a Kanban board system, used for project management. > > \-- [https://planka.app/](https://planka.app/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `planka.company` is the FQDN of the Planka installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Planka with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, optional UI settings, and note the application **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://planka.company/oidc-callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create role groups *(optional)* Planka can set user roles from the OIDC `groups` claim. To provision users with Planka administrative or project owner permissions, create corresponding groups in authentik. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups** and click **Create**. 3. Set a name for the group (for example, `planka-admin` or `planka-project-owner`) and click **Create**. 4. Click the name of the newly created group, and then switch to the **Users** tab. 5. Click **Add existing user**, select the user who requires the corresponding Planka role, and click **Add**. ## Planka configuration Add the following required environment variables to your Planka deployment: ```env title=".env" BASE_URL=https://planka.company OIDC_ISSUER=https://authentik.company/application/o// OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= ``` To assign Planka roles from authentik group membership, add the relevant role mappings: ```env title=".env" OIDC_ADMIN_ROLES=planka-admin OIDC_PROJECT_OWNER_ROLES=planka-project-owner ``` To enforce SSO and disable local authentication, add the following environment variable: ```env title=".env" OIDC_ENFORCED=true ``` Restart Planka after applying the environment variable changes. ## Configuration verification To verify the integration with Planka, log out and attempt to log back in using the **Log in with SSO** button. You should be redirected to authentik, and then redirected back to the Planka dashboard. ## Resources - [Planka Docs - OIDC (OpenID Connect)](https://docs.planka.cloud/docs/configuration/oidc) --- ## Integrate with Rocket.Chat ## What is Rocket.Chat? > Centralize real-time messaging, voice, video, AI, and apps for secure, reliable and unified communication among internal and external stakeholders. > > \-- [https://www.rocket.chat/](https://www.rocket.chat/) ## Preparation The following placeholders are used in this guide: - `rocket.company` is the FQDN of the Rocket.Chat installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Rocket.Chat with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://rocket.company/_oauth/authentik`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Rocket.Chat configuration This guide uses `authentik` as the Rocket.Chat custom OAuth name. If you choose a different name, update the redirect URI in authentik to match the callback URL shown by Rocket.Chat. 1. Log in to Rocket.Chat as a system administrator. 2. Navigate to **Manage** > **Workspace** > **Settings** > **OAuth**. 3. Click **Add custom OAuth**, enter `authentik` as the unique name, and click **Add**. 4. Open the new custom OAuth configuration and configure the following settings: - **Enable**: turn the switch on. - **URL**: `https://authentik.company/application/o` - **Token Path**: `/token/` - **Identity Path**: `/userinfo/` - **Authorize Path**: `/authorize/` - **Scope**: `openid email profile` - **Id**: the Client ID from authentik - **Secret**: the Client Secret from authentik - **Login Style**: `Redirect` - **Button Text**: `Login with authentik` - **Username field**: `preferred_username` - **Email field**: `email` - **Name field**: `name` 5. Click **Save changes**. 6. Click **Refresh OAuth Services**. To link existing Rocket.Chat users to authentik identities with matching usernames, enable **Merge users** before users sign in with authentik. ### Optional account settings Navigate to **Manage** > **Workspace** > **Settings** > **Accounts** and disable the following settings: - **Allow Name Change** - **Allow Username Change** - **Allow Email Change** - **Allow Password Change for OAuth Users** If authentik handles multi-factor authentication, review **Accounts** > **Two Factor Authentication** and avoid enabling Rocket.Chat two-factor authentication for OAuth users unless you want them to complete an additional challenge after returning from authentik. To prevent password self-registration, navigate to **Accounts** > **Registration** and set **Registration Form** to **Disabled**. ## Configuration verification To confirm that authentik is properly configured with Rocket.Chat, log out of Rocket.Chat and log back in using **Login with authentik**. ## Resources - [Rocket.Chat Custom OAuth Setup](https://docs.rocket.chat/docs/custom-oauth-setup) - [Rocket.Chat Accounts Settings](https://docs.rocket.chat/docs/accounts) - [Rocket.Chat Two Factor Authentication Configuration](https://docs.rocket.chat/docs/two-factor-authentication-configuration) --- ## Integrate with Roundcube ## What is Roundcube? > Roundcube is a browser-based multilingual IMAP client with an application-like user interface. It provides the full functionality you expect from an email client, including MIME support, address book, folder manipulation, message searching and spell checking. > > \-- [https://roundcube.net](https://roundcube.net) ## Preparation The following placeholders are used in this guide: - `roundcube.company` is the FQDN of the Roundcube installation. - `authentik.company` is the FQDN of the authentik installation. Roundcube is often used alongside Postfix and Dovecot. Postfix sends/receives email (SMTP), Dovecot stores/retrieves mail (IMAP/POP3), and Roundcube acts as a webmail client. Whichever mail server is used in conjunction with Roundcube must support XOAUTH2 for both SMTPD and IMAP/POP. A Postfix SMTP server can use Dovecot for authentication, which allows XOAUTH2 support in Postfix without requiring separate configuration. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Roundcube with authentik, you need to create a scope mapping and an application/provider pair in authentik. ### Create a property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**. 3. Select **Scope Mapping** and configure the following settings: - **Name**: Set an appropriate name. - **Scope name**: `dovecotprofile` - **Description**: Set an appropriate description, if desired. - **Expression**: ```python return { "name": request.user.name, "given_name": request.user.name, "family_name": "", "preferred_username": request.user.username, "nickname": request.user.username, "active": True, } ``` 4. Click **Create**. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://roundcube.company/index.php/login/oauth`. - Select any available signing key. - Under **Advanced protocol settings**, set **Logout URI** to `https://roundcube.company/index.php/login/backchannel` and **Logout Method** to `Back-channel`. - Under **Advanced protocol settings** > **Scopes**, add the following scopes to **Selected Scopes**: - The `dovecotprofile` scope mapping that you previously created. - `authentik default OAuth Mapping: OpenID 'offline_access'` - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Roundcube configuration ### Configure Roundcube OAuth2 Set the following variables in your Roundcube configuration file: ```php title="config/config.inc.php" $config['oauth_provider'] = 'generic'; $config['oauth_provider_name'] = 'authentik'; $config['oauth_client_id'] = ''; $config['oauth_client_secret'] = ''; $config['oauth_auth_uri'] = 'https://authentik.company/application/o/authorize/'; $config['oauth_token_uri'] = 'https://authentik.company/application/o/token/'; $config['oauth_identity_uri'] = 'https://authentik.company/application/o/userinfo/'; $config['oauth_scope'] = 'email openid dovecotprofile offline_access'; $config['oauth_identity_fields'] = ['email']; $config['oauth_cache'] = 'db'; ``` Add the following variable to your Roundcube configuration file to enable OAuth2 debugging: ```php title="config/config.inc.php" $config['oauth_debug'] = true; ``` ### Configure Dovecot XOAUTH2 Add the XOAUTH2 and OAUTHBEARER authentication mechanisms and configure the OAuth2 database in your Dovecot configuration: ```text title="/etc/dovecot/dovecot.conf" auth_mechanisms { oauthbearer = yes xoauth2 = yes } oauth2 { tokeninfo_url = https://authentik.company/application/o/userinfo/?access_token= introspection_url = https://:@authentik.company/application/o/introspect/ introspection_mode = post force_introspection = yes active_attribute = active active_value = true username_attribute = email ssl_client_ca_file = /etc/ssl/certs/ca-certificates.crt } ``` Add the following variables to your Dovecot configuration to enable debugging: ```text title="/etc/dovecot/dovecot.conf" auth_debug = yes auth_verbose = yes ``` With this setup, Dovecot can also be used with other email clients that support XOAUTH2 authentication. However, most commonly available clients, such as FairEmail for Android and Thunderbird, only provide built-in support for providers like Gmail and Outlook, with no option to configure custom mail servers. ## Configuration verification To confirm that authentik is properly configured with Roundcube, log out of Roundcube and open Roundcube. Select **Login via authentik**. A mailbox should open and you should be able to send and receive mail. ## Resources - [Roundcube documentation - Configuration: OAuth2](https://github.com/roundcube/roundcubemail/wiki/Configuration:-OAuth2) - [Roundcube OAuth2 defaults](https://github.com/roundcube/roundcubemail/blob/master/config/defaults.inc.php) - [Dovecot CE documentation - OAuth2](https://doc.dovecot.org/main/core/config/auth/databases/oauth2.html) --- ## Integrate with SeaTable ## What is SeaTable? > SeaTable is a no-code database and app builder platform that provides a web-based, spreadsheet-like interface for organizing data, building apps, and automating workflows. It is designed to function as a collaborative database with features like tables, views, forms, and permissions. > > \-- [https://seatable.com](https://seatable.com) ## Preparation The following placeholders are used in this guide: - `seatable.company` is the FQDN of the self-hosted SeaTable installation. - `authentik.company` is the FQDN of the authentik installation. SeaTable supports SAML SSO for SeaTable Cloud Enterprise teams and self-hosted SeaTable Server Enterprise Edition installations. SeaTable Cloud requires domain verification in SeaTable Team Management, which is outside the scope of this guide. For SeaTable Cloud, log in to SeaTable Cloud and navigate to **Team Management** > **Teams** > **Settings** > **Single Sign-On**. Keep the SeaTable-provided **Entity ID**, **Assertion Consumer Service (ACS) URL**, **Login (SSO URL)**, and **Logout** values available while creating the authentik provider. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of SeaTable Cloud with authentik, you need to create SAML property mappings and an application/provider pair in authentik. ### Create property mappings SeaTable Cloud requires SAML attributes named `contact_email`, `name`, and `uid`. Create three SAML provider property mappings for these attributes. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `SeaTable contact_email` - **SAML Attribute Name**: `contact_email` - **Expression**: ```python return request.user.email ``` 5. Click **Finish** to save the property mapping. 6. Repeat steps 2-5 to create the following additional property mappings: - **Name**: `SeaTable name` - **SAML Attribute Name**: `name` - **Expression**: ```python return request.user.name ``` - **Name**: `SeaTable uid` - **SAML Attribute Name**: `uid` - **Expression**: ```python return request.user.uid ``` ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because you will use it later as ``. - Set the **Launch URL** to the **Login (SSO URL)** value from SeaTable. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to the **Assertion Consumer Service (ACS) URL** value from SeaTable. - Set the **Audience** to the **Entity ID** value from SeaTable. - Set the **SLS URL** to the **Logout** value from SeaTable. - Set the **Service Provider Binding** to `Post`. - Under **Advanced protocol settings**: - Set an available **Signing certificate**. - Add the `SeaTable contact_email`, `SeaTable name`, and `SeaTable uid` property mappings that you created earlier to **Property mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate and retrieve the metadata URL 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the newly created SeaTable provider. 3. Under **Related objects** > **Download signing certificate**, click **Download**. This certificate file will be required in the next section. 4. Under **Related objects** > **Metadata**, click **Copy download URL**. This metadata download URL will be required in the next section. ## SeaTable configuration To support the integration of authentik with SeaTable Cloud, configure SeaTable with the authentik certificate and metadata URL. ### Determine effective URL for metadata download authentik's **metadata download URL** returns a 302 redirect, but SeaTable Cloud requires the effective URL. Run the following command to determine the effective URL: ```sh curl -Ls -o /dev/null -w '%{url_effective}\n' "" 2>/dev/null ``` The output of this command will be required as the SeaTable metadata URL. ### Configure SeaTable Cloud 1. Log in to SeaTable Cloud and navigate to **Team Management** > **Teams** > **Settings** > **Single Sign-On**. 2. Configure the following settings: - **Metadata URL**: enter the effective metadata URL from authentik. - **Certificate**: upload or paste the signing certificate that you downloaded from authentik. - **Domain**: select the email domain that should use this SSO configuration. 3. Complete the DNS domain verification shown by SeaTable. ## authentik configuration To support the integration of self-hosted SeaTable with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because you will use it later as ``. - Set the **Launch URL** to `https://seatable.company/sso/`. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://seatable.company/saml/acs/`. - Set the **Audience** to `https://seatable.company/saml/metadata/`. - Set the **Service Provider Binding** to `Post`. - Under **Advanced protocol settings**, set an available **Signing certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate and retrieve the metadata URL 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the newly created SeaTable provider. 3. Under **Related objects** > **Download signing certificate**, click **Download**. This certificate file will be required in the next section. 4. Under **Related objects** > **Metadata**, click **Copy download URL**. This metadata download URL will be required in the next section. ## SeaTable configuration To support the integration of authentik with self-hosted SeaTable, configure SeaTable with the authentik certificate and metadata URL. ### Determine effective URL for metadata download authentik's **metadata download URL** returns a 302 redirect, but SeaTable requires the effective URL. Run the following command to determine the effective URL: ```sh curl -Ls -o /dev/null -w '%{url_effective}\n' "" 2>/dev/null ``` The output of this command will be required as the `SAML_REMOTE_METADATA_URL` in the next section. ### Configure self-hosted SeaTable #### Set up required certificates SeaTable requires the signing certificate from authentik and its own signing certificate. Follow these steps to configure the required certificates on your SeaTable deployment. 1. Connect to your SeaTable server or exec into the shell of your SeaTable container. 2. Create the `/opt/seatable-server/certs` directory and navigate to it. 3. Copy the signing certificate that you downloaded from authentik to this directory and name it `idp.crt`. 4. Generate a certificate and key with the following command: ```sh openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout sp.key -out sp.crt ``` After completing these steps, the `/opt/seatable-server/certs` directory should contain: `idp.crt`, `sp.crt`, and `sp.key`. #### Configure SAML authentication Add the following block to your SeaTable configuration file: ```python title="/opt/seatable-server/seatable/conf/dtable_web_settings.py" ENABLE_SAML = True SAML_PROVIDER_IDENTIFIER = 'authentik' SAML_REMOTE_METADATA_URL = '' SAML_ATTRIBUTE_MAP = { 'http://schemas.goauthentik.io/2021/02/saml/uid': 'uid', 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress': 'contact_email', 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name': 'name', } SAML_CERTS_DIR = '/shared/certs' ``` Restart the SeaTable service or Docker container to apply the changes. ## Configuration verification To confirm that authentik is integrated correctly with SeaTable, log out of SeaTable and access SeaTable from the authentik application dashboard. You should be redirected to SeaTable. For self-hosted SeaTable, check `/opt/seatable-server/seatable/logs/dtable_web.log` for troubleshooting info if authentication fails. ## Resources - [SeaTable Admin Manual - SAML](https://admin.seatable.com/configuration/authentication/saml/) - [SeaTable Help - Requirements and prerequisites for using single sign-on](https://seatable.com/help/requirements-single-sign-on/) - [SeaTable Help - IdP setup, attribute mapping, and domain authentication](https://seatable.com/help/configuration-ipd-single-sign-on-seatable-cloud/) --- ## Integrate with SharePoint Server SE ## What is Microsoft SharePoint Server SE? > SharePoint Server Subscription Edition is the on-premises SharePoint Server release that provides collaboration, document management, intranet, and business process features with continuous updates. > > \-- [https://www.microsoft.com/en-us/download/details.aspx?id=103599](https://www.microsoft.com/en-us/download/details.aspx?id=103599) ## Preparation The following placeholders are used in this guide: - `sharepoint.company` is the FQDN of the SharePoint Server SE web application. - `authentik.company` is the FQDN of the authentik installation. - `ldap.company` is the FQDN of the optional authentik LDAP outpost that SharePoint can reach. This guide assumes that you have: - a SharePoint Server Subscription Edition farm with OIDC support enabled by the current SharePoint update channel for your environment. - administrative access to the SharePoint Management Shell and SharePoint Central Administration. - synchronized clocks between authentik and the SharePoint Server farm. - an LDAPCP installation if you want SharePoint People Picker lookup and role claim augmentation from authentik LDAP data. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of SharePoint Server SE with authentik, you need to create custom property mappings and an application/provider pair in authentik. ### Create property mappings SharePoint requires specific claims in the `id_token`. Create the following scope mappings before creating the provider. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **Scope Mapping**, click **Next**, and use the following values: - **Name**: `sharepoint-openid` - **Scope name**: `openid` - **Expression**: ```python return { "nbf": 0, "oid": request.user.uid, "upn": request.user.username, } ``` 4. Click **Finish**. 5. Click **Create** again. 6. Select **Scope Mapping**, click **Next**, and use the following values: - **Name**: `sharepoint-profile` - **Scope name**: `profile` - **Expression**: ```python return { "name": request.user.name, "given_name": request.user.name, "unique_name": request.user.name, "preferred_username": request.user.username, "nickname": request.user.username, "roles": [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ], } ``` 7. Click **Finish**. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. Alternatively you can first create a provider separately, then create the application and connect it with the provider. - **Application**: provide a descriptive name, an optional group for the type of application, and the policy engine mode. Take note of the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name or accept the auto-provided name, the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** because it will be required later. - Add a **Redirect URI** of type `Regex` `Authorization` as `https://sharepoint.company/.*`. - Select any available signing key. - Under **Advanced protocol settings**, set **Access Code Validity** to `minutes=5`. - Under **Advanced protocol settings**, set **Access Token Validity** to `minutes=15`. - Under **Advanced protocol settings** > **Scopes**, select `authentik default OAuth Mapping: OpenID 'email'`, `sharepoint-openid`, and `sharepoint-profile`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to define the role values that authentik sends to SharePoint in the `roles` claim. 1. Navigate to **Applications** > **Applications**. 2. Open the SharePoint Server SE application. 3. Click the **Application entitlements** tab. 4. Create one entitlement for each role value that SharePoint should receive. 5. Open each entitlement and bind the users or groups that should receive it. The entitlement names must match the role values that your SharePoint configuration expects in the incoming `roles` claim. ## SharePoint Server SE configuration To support OIDC authentication with authentik, configure SharePoint farm properties, create a trusted identity token issuer, and enable the trusted provider on the target SharePoint web application. ### Configure SharePoint farm properties Run the script that matches your SharePoint Server SE version and release preference from a SharePoint Management Shell as a farm administrator. For SharePoint Server SE Version 24H1 or later with Early Release feature preference, use SharePoint Certificate Management to manage the nonce cookie certificate: ```powershell Add-PSSnapin Microsoft.SharePoint.PowerShell $cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" -Subject "CN=SharePoint Cookie Cert" $certPath = "C:\certs\nonce.pfx" $certPassword = ConvertTo-SecureString -String "" -Force -AsPlainText Export-PfxCertificate -Cert $cert -FilePath $certPath -Password $certPassword $nonceCert = Import-SPCertificate -Path $certPath -Password $certPassword -Store "EndEntity" -Exportable:$true $farm = Get-SPFarm $farm.UpdateNonceCertificate($nonceCert, $true) ``` For SharePoint Server SE versions before 24H1, or for farms that do not use Early Release feature preference, configure the farm properties directly: ```powershell Add-PSSnapin Microsoft.SharePoint.PowerShell $cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" -Subject "CN=SharePoint Cookie Cert" $rsaCert = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert) $fileName = $rsaCert.key.UniqueName # In multi-server farms, export the certificate with Export-PfxCertificate, # import it on each SharePoint server with Import-PfxCertificate, and grant # the same private key permissions on each server. $path = "$env:ALLUSERSPROFILE\Microsoft\Crypto\RSA\MachineKeys\$fileName" $permissions = Get-Acl -Path $path $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("", "Read", "None", "None", "Allow") $permissions.AddAccessRule($accessRule) Set-Acl -Path $path -AclObject $permissions $farm = Get-SPFarm $farm.Properties["SP-NonceCookieCertificateThumbprint"] = $cert.Thumbprint $farm.Properties["SP-NonceCookieHMACSecretKey"] = "seed" $farm.Update() ``` If SharePoint terminates TLS before traffic reaches the web application, configure SharePoint to accept OAuth authentication over HTTP: ```powershell Add-PSSnapin Microsoft.SharePoint.PowerShell $config = Get-SPSecurityTokenServiceConfig $config.AllowOAuthOverHttp = $true $config.Update() ``` ### Create a SharePoint trusted identity token issuer Update the values in the following script, then run it from a SharePoint Management Shell as a farm administrator: ```powershell Add-PSSnapin Microsoft.SharePoint.PowerShell $metadataEndpointUrl = "https://authentik.company/application/o//.well-known/openid-configuration" $clientIdentifier = "" $trustedTokenIssuerName = "authentik" $trustedTokenIssuerDescription = "authentik OIDC" $idClaim = New-SPClaimTypeMapping "http://schemas.microsoft.com/identity/claims/objectidentifier" -IncomingClaimTypeDisplayName "oid" -SameAsIncoming $claims = @( $idClaim, (New-SPClaimTypeMapping ([System.Security.Claims.ClaimTypes]::Role) -IncomingClaimTypeDisplayName "Role" -SameAsIncoming), (New-SPClaimTypeMapping ([System.Security.Claims.ClaimTypes]::Email) -IncomingClaimTypeDisplayName "Email" -SameAsIncoming), (New-SPClaimTypeMapping ([System.Security.Claims.ClaimTypes]::GivenName) -IncomingClaimTypeDisplayName "GivenName" -SameAsIncoming) ) $trustedTokenIssuer = New-SPTrustedIdentityTokenIssuer ` -Name $trustedTokenIssuerName ` -Description $trustedTokenIssuerDescription ` -ClaimsMappings $claims ` -IdentifierClaim $idClaim.InputClaimType ` -DefaultClientIdentifier $clientIdentifier ` -MetadataEndPoint $metadataEndpointUrl ` -Scope "openid email profile" New-SPAuthenticationProvider -TrustedIdentityTokenIssuer $trustedTokenIssuer ``` If you plan to use LDAPCP claim augmentation for role claims, remove the `profile` value from the `-Scope` parameter so SharePoint receives role membership from LDAPCP instead of the OIDC `roles` claim. ### Configure SharePoint web applications 1. Open SharePoint Central Administration as a farm administrator. 2. Navigate to **Application Management** > **Manage web applications**. 3. Select the target web application. 4. Click **Authentication Providers** in the ribbon. 5. Click the target zone for your environment, such as **Default**. 6. Configure the authentication provider: - Select **Trusted Identity Provider**. - Select the provider that you created for authentik. - Set **Custom Sign In Page** to `/_trust/default.aspx`. 7. Click **Save**. Repeat these steps for each target web application that matches the redirect URI configured in authentik. ### Configure LDAPCP claims augmentation LDAPCP is optional. Use it when you want SharePoint People Picker lookup and role claim augmentation through an authentik LDAP provider. 1. Create an authentik LDAP provider and LDAP outpost that includes the users and groups that SharePoint should search. 2. Navigate to **Applications** > **Applications** in authentik. 3. Open the SharePoint Server SE application. 4. Add the LDAP provider as a **Backchannel Provider** and save the application. 5. From a SharePoint Management Shell as a farm administrator, assign LDAPCP as the claim provider for the trusted identity token issuer: ```powershell Add-PSSnapin Microsoft.SharePoint.PowerShell $trustedTokenIssuerName = "authentik" $spTrust = Get-SPTrustedIdentityTokenIssuer $trustedTokenIssuerName $spTrust.ClaimProviderName = "LDAPCP" $spTrust.Update() ``` 6. In SharePoint Central Administration, navigate to **Security** > **LDAPCP Configuration** > **Claim types configuration**. 7. Update the claim type mappings: | Claim type | Entity type | LDAP class | LDAP attribute to query | LDAP attribute to display | PickerEntity metadata | | ------------------------------------------------------------------------------------------------------------------------------ | ----------- | ---------- | ----------------------- | ------------------------- | --------------------- | | [http://schemas.microsoft.com/identity/claims/objectidentifier](http://schemas.microsoft.com/identity/claims/objectidentifier) | User | user | uid | sn | UserId | | LDAP attribute linked to the main mapping for object User | User | user | mail | | Email | | LDAP attribute linked to the main mapping for object User | User | user | sn | | DisplayName | | [http://schemas.microsoft.com/ws/2008/06/identity/claims/role](http://schemas.microsoft.com/ws/2008/06/identity/claims/role) | Group | group | cn | | DisplayName | | LDAP attribute linked to the main mapping for object Group | Group | group | uid | | SPGroupID | 8. Navigate to **Security** > **LDAPCP Configuration** > **Global configuration**. 9. Add an LDAP connection: - **LDAP Path**: `LDAP://ldap.company/dc=ldap,dc=goauthentik,dc=io` - **Username**: the LDAP service account DN from authentik. - **Password**: the LDAP service account password from authentik. - **Authentication types**: select **ServerBind**. 10. Under **Augmentation**, select **Enable augmentation**. 11. Under **Augmentation**, select the role claim `http://schemas.microsoft.com/ws/2008/06/identity/claims/role`. 12. Under **Augmentation**, select **Query this server** only for `ldap.company`. 13. Under **User identifier properties**, set **LDAP class** to `user` and **LDAP attribute** to `uid`. 14. Under **Display of user identifier results**, select **Show the value of another LDAP attribute** and set it to `sn`. 15. Click **OK**. ## Configuration verification To confirm that authentik is properly configured with SharePoint Server SE, open the integration and sign in with the trusted identity provider. After authentication in authentik, SharePoint should redirect you back to the web application. If you configured LDAPCP, open People Picker in SharePoint and verify that it can resolve users and groups from authentik LDAP data. ## Resources - [Microsoft Learn - OpenID Connect 1.0 authentication](https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/oidc-1-0-authentication) - [Microsoft Learn - Set up OIDC authentication in SharePoint Server with Microsoft Entra ID](https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/set-up-oidc-auth-in-sharepoint-server-with-msaad) - [Microsoft Learn - Set up OIDC authentication in SharePoint Server using RSA public keys](https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/set-up-oidc-auth-in-sharepoint-server-using-rsa) - [Microsoft Learn - ID token claims reference](https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference) - [Microsoft Learn - New-SPTrustedIdentityTokenIssuer](https://learn.microsoft.com/en-us/powershell/module/microsoft.sharepoint.powershell/new-sptrustedidentitytokenissuer) - [LDAPCP - Configure](https://www.ldapcp.com/docs-classic/usage/configuration/) --- ## Integrate with Slack ## What is Slack? > Slack is a collaboration platform for messaging, calls, file sharing, and workflow automation. > > \-- [https://slack.com](https://slack.com) ## Preparation The following placeholders are used in this guide: - `company.slack.com` is the FQDN of your Slack workspace. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. SAML SSO requires a Slack plan where custom SAML is available and a Slack Workspace Owner or Org Owner account. Optional SCIM provisioning requires a Slack Business+ or Enterprise plan and an owner or admin account that can create a Slack app with the `admin` OAuth scope. ## authentik configuration To support the integration of Slack with authentik, you need to create SAML property mappings and an application/provider pair. If you also want to provision Slack users and user groups from authentik, generate a Slack SCIM token in the Slack configuration section, then create a SCIM provider and assign it as a backchannel provider for the same application. ### Create property mappings Slack requires the SAML assertion to include a `User.Email` attribute. You can also optionally send username and name attributes. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create the following **SAML Provider Property Mapping**: - **Email mapping:** - **Name**: Choose a descriptive name. - **SAML Attribute Name**: `User.Email` - **Expression**: ```python return request.user.email ``` 3. Optionally, create the following additional **SAML Provider Property Mappings**: - **Username mapping:** - **Name**: Choose a descriptive name. - **SAML Attribute Name**: `User.Username` - **Expression**: ```python return request.user.username ``` - **First name mapping:** - **Name**: Choose a descriptive name. - **SAML Attribute Name**: `first_name` - **Expression**: ```python name = request.user.name.strip() return name.split(" ", 1)[0] if name else "" ``` - **Last name mapping:** - **Name**: Choose a descriptive name. - **SAML Attribute Name**: `last_name` - **Expression**: ```python name = request.user.name.strip() return name.rsplit(" ", 1)[1] if " " in name else "" ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations: - Set the **ACS URL** to `https://company.slack.com/sso/saml`. - Set the **Audience** to `https://slack.com`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Enable **Sign responses**. - Add the property mappings that you created earlier to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click on the name of the SAML provider you created in the previous section. 2. Under **Related objects** > **Download signing certificate**, click **Download**. This certificate file will be required in the next section. ## Slack configuration Configure SAML SSO in Slack first. If you want authentik to provision users and user groups, then create a Slack app for SCIM and use its token in the optional SCIM provider. ### Configure SAML SSO 1. Log in to Slack as a Workspace Owner or Org Owner. 2. Open the SAML configuration page: - For a workspace, click **Admin** in the sidebar, select **Workspace settings**, click **Security**, select **SSO & authentication**, then click **Configure SAML** next to **An identity provider or custom SAML**. - For an Enterprise Grid organization, click your organization name, select **Tools & settings** > **Organization settings**, then navigate to **Security** > **SSO Settings**. 3. Configure the following settings: - **SAML 2.0 Endpoint URL**: `https://authentik.company/application/saml//` - **Identity Provider Issuer URL**: `https://authentik.company/application/saml//metadata/` - **x.509 Certificate** or **Public Certificate**: paste the entire contents of the signing certificate that you downloaded from authentik. 4. In **Advanced Options**, select both **Responses Signed** and **Assertions Signed**. 5. Click **Test Configuration** and confirm that Slack reports a successful test. 6. Review the SSO options, choose whether SSO is required or optional for members, then click **Turn on SSO** or **Add SSO**. ### Create a Slack API token for SCIM *(optional)* 1. Open the [Slack app creation page](https://api.slack.com/apps?new_app=1) and create an app for your workspace or organization. 2. In the app settings, click **OAuth & Permissions**. 3. Under **User Token Scopes**, add the `admin` scope. 4. Install the app to the workspace or organization that you want authentik to provision. 5. Copy the generated **User OAuth Token**. You need this token for the optional SCIM provider in authentik. For Enterprise Grid, install the SCIM app on the organization, not on an individual workspace. ### Create a SCIM provider in authentik *(optional)* Configure this optional provider only if you want authentik to provision Slack users and user groups through SCIM. 1. Return to the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **Create**. 3. Select **SCIM Provider** as the provider type and click **Next**. 4. Configure the following settings: - **Provider Name**: enter a descriptive name. - **URL**: `https://api.slack.com/scim/v2/` - **Token**: paste the Slack user OAuth token. - **Compatibility Mode**: select **Slack**. 5. Click **Finish** to save the provider. 6. Navigate to **Applications** > **Applications** and open the Slack application that you created earlier. 7. Click **Edit** and add the SCIM provider to **Backchannel Providers**. 8. Click **Update**. Users that should be provisioned to Slack will then need to be bound to the Slack application. For more information on SCIM user and group filtering, refer to the [SCIM provider documentation](/docs/add-secure-apps/providers/scim/#filter-the-sync-scope). ## Configuration verification To confirm that authentik is properly configured with Slack, open the integration from the authentik Application Dashboard. You should be redirected to Slack and signed in. You can also open your Slack workspace directly and select the SSO option. You should be redirected to authentik to authenticate, then returned to Slack. If you configured SCIM provisioning, assign a test user to the Slack application in authentik and verify that the user is created or updated in Slack. ## Resources - [Slack Help - Custom SAML single sign-on](https://slack.com/help/articles/205168057-Custom-SAML-single-sign-on) - [Slack Help - Set up SAML single sign-on for Slack](https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack) - [Slack Help - Troubleshoot SAML authorization errors](https://slack.com/help/articles/360037402653-Troubleshoot-SAML-authorization-errors) - [Slack Developer Docs - Using the Slack SCIM API](https://docs.slack.dev/admins/scim-api/) - [Slack Help - Manage members with SCIM provisioning](https://slack.com/help/articles/212572638-Manage-members-with-SCIM-provisioning) --- ## Integrate with The Lounge ## What is The Lounge? > The Lounge is a modern, web-based IRC client that keeps users connected to IRC servers even when they are offline. > > \-- [https://thelounge.chat/](https://thelounge.chat/) ## Preparation The following placeholders are used in this guide: - `ldap.company` is the FQDN of the authentik LDAP outpost. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of The Lounge with authentik, you need to create an LDAP application/provider pair, a service account, and an LDAP outpost in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **LDAP Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the bind flow to use for this provider, and note the **Base DN** because it will be required later. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create a service account and LDAP outpost After creating the application/provider pair, follow the LDAP provider setup to create a [service account](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#create-a-service-account), assign the [LDAP search permission](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#assign-the-ldap-search-permission-to-the-service-account) to the service account, and [create an LDAP outpost](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#create-an-ldap-outpost) for this LDAP provider. Use a descriptive service account name such as `the-lounge-ldap`, and note the service account's full Bind DN and password. The Lounge uses this account to search for a matching user DN before binding as that user. If you configure application bindings, ensure that the LDAP bind service account and the users who should authenticate to The Lounge have access to the application. ## The Lounge configuration The Lounge uses LDAP authentication only when it runs in private mode. In `config.js`, set the following values in the `ldap` object: ```js title="config.js" ldap: { enable: true, url: "ldap://ldap.company:389", primaryKey: "cn", searchDN: { rootDN: "cn=the-lounge-ldap,ou=users,DC=ldap,DC=goauthentik,DC=io", rootPassword: "", filter: "(objectClass=user)", base: "", }, }, ``` To restrict access to members of a specific authentik group, set `filter` to the following value: ```js title="config.js" filter: "(&(objectClass=user)(memberOf=cn=,ou=groups,))", ``` Save `config.js` and restart The Lounge. ## Configuration verification To confirm that authentik is properly configured with The Lounge, open The Lounge and log in with an authentik user's username and password. ## Resources - [The Lounge documentation - Configuration](https://thelounge.chat/docs/configuration#ldap-support) - [The Lounge source - LDAP authentication](https://github.com/thelounge/thelounge/blob/master/server/plugins/auth/ldap.ts) --- ## Integrate with Vikunja ## What is Vikunja? > Vikunja is an Open-Source, self-hosted To-Do list application for all platforms. > > \-- [https://vikunja.io/](https://vikunja.io/) This guide is based on authentik 2026.2.0 and Vikunja v1.1.0 using the [Docker Compose install](https://vikunja.io/docs/full-docker-example/). Instructions may differ between versions. Vikunja versions before 1.0 use different OpenID configuration syntax. ## Preparation The following placeholders are used in this guide: - `vikunja.company` is the FQDN of the Vikunja installation. - `authentik.company` is the FQDN of the authentik installation. - `authentik` is the provider key set in `config.yml` under `auth.openid.providers`. This key is used as the path segment in the redirect URI. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Vikunja with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - For web login, add a **Redirect URI** of type `Strict` `Authorization` as `https://vikunja.company/auth/openid/authentik`. - If using the Vikunja desktop client, add a **Redirect URI** of type `Regex` `Authorization` such as `^http://127\\.0\\.0\\.1:[0-9]+/auth/openid/authentik$` to allow loopback redirects to `127.0.0.1`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Vikunja configuration Configure Vikunja using either a config file or environment variables. Set the following values in `config.yml`: ```yaml title="config.yml" auth: local: enabled: true openid: enabled: true providers: authentik: name: "authentik Login" authurl: https://authentik.company/application/o// clientid: clientsecret: scope: openid email profile ``` Set the following values in your `.env` file: ```bash title=".env" VIKUNJA_AUTH_OPENID_ENABLED=true VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_NAME="authentik Login" VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_AUTHURL=https://authentik.company/application/o// VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTID= VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET= VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_SCOPE=openid email profile # Optional: disable local auth if all users must sign in through authentik VIKUNJA_AUTH_LOCAL_ENABLED=false ``` When using environment variables for providers, define the provider key in `config.yml`: ```yaml title="config.yml" auth: openid: providers: authentik: {} ``` The key under `auth.openid.providers` (for example, `authentik`) must match the path segment in the redirect URI configured in authentik. If the key contains uppercase letters, Vikunja converts it to lowercase and removes spaces. The Vikunja frontend expects redirects at `/auth/openid/`. If all users must sign in through authentik, disable local auth (`auth.local.enabled: false` or `VIKUNJA_AUTH_LOCAL_ENABLED=false`). Restart the Vikunja API after applying the OpenID configuration. ## Configuration verification To verify that authentik is correctly integrated with Vikunja, log out of Vikunja and sign in again using the configured OpenID provider. You should be redirected to authentik for authentication and then redirected back to Vikunja. ## Resources - [Vikunja configuration options - auth](https://vikunja.io/docs/config-options/#0--auth) --- ## Integrate with Wekan ## What is Wekan? > Wekan is an open-source Kanban board application for organizing tasks with boards, lists, and cards. > > \-- [https://wekan.fi/](https://wekan.fi/) ## Preparation The following placeholders are used in this guide: - `wekan.company` is the FQDN of the Wekan installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Wekan with authentik, you need to create an application/provider pair in authentik. If you want Wekan administrator access to be managed from authentik, also create a custom scope mapping. ### Create a scope mapping *(optional)* Wekan can promote users to Wekan administrators from OIDC group names. This mapping sends application entitlements from authentik as Wekan-specific OIDC group values. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property mappings** and click **Create**. - **Select type**: select **Scope Mapping**. - **Create Scope Mapping**: - **Name**: `Wekan groups` - **Scope name**: `wekan` - **Expression**: ```python wekan_groups = [ {"displayName": entitlement.name} for entitlement in request.user.app_entitlements(provider.application) ] return { "wekanGroups": wekan_groups, } ``` 3. Click **Finish**. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://wekan.company/_oauth/oidc`. - Select any available signing key. - If you created the `Wekan groups` scope mapping, add it to **Selected Scopes** under **Advanced protocol settings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. If you created the `Wekan groups` scope mapping, open the new application, click the **Application entitlements** tab, and create the entitlements that Wekan should receive as OIDC group names. Bind the appropriate users or groups to each entitlement. ## Wekan configuration Add the following required environment variables to your Wekan deployment: ```env title=".env" OAUTH2_ENABLED=true OAUTH2_CLIENT_ID= OAUTH2_SECRET= OAUTH2_SERVER_URL=https://authentik.company OAUTH2_AUTH_ENDPOINT=/application/o/authorize/ OAUTH2_USERINFO_ENDPOINT=/application/o/userinfo/ OAUTH2_TOKEN_ENDPOINT=/application/o/token/ OAUTH2_ID_MAP=sub OAUTH2_USERNAME_MAP=preferred_username OAUTH2_FULLNAME_MAP=name OAUTH2_EMAIL_MAP=email ``` For Snap deployments, use Wekan's lower-case, dash-separated equivalents for these settings. If you created the `Wekan groups` scope mapping, add the custom scope to Wekan's requested permissions and list the entitlement names that should grant Wekan administrator access: ```env title=".env" OAUTH2_REQUEST_PERMISSIONS=openid profile email wekan OAUTH2_ADMIN_GROUPS=wekan-admin ``` Restart Wekan after applying the environment variable changes. ## Configuration verification To verify the integration with Wekan, open Wekan, log out if necessary, and log in using the OIDC login button. You should be redirected to authentik and then returned to Wekan. ## Resources - [Wekan OAuth2 providers documentation](https://github.com/wekan/wekan/blob/main/docs/Login/OAuth2.md) - [Wekan Docker Compose OAuth2 configuration example](https://github.com/wekan/wekan/blob/main/docker-compose.yml) --- ## Integrate with WriteFreely ## What is WriteFreely? > An open source platform for building a writing space on the web. > > \-- [https://writefreely.org/](https://writefreely.org/) ## Preparation The following placeholders are used in this guide: - `writefreely.company` is the FQDN of the WriteFreely installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of WriteFreely with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://writefreely.company/oauth/callback/generic`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## WriteFreely configuration Configure WriteFreely by editing `config.ini`. WriteFreely looks for this file in the current directory unless it is started with the `-c` flag. ```ini title="config.ini" [oauth.generic] client_id = client_secret = host = https://authentik.company display_name = authentik token_endpoint = /application/o/token/ inspect_endpoint = /application/o/userinfo/ auth_endpoint = /application/o/authorize/ scope = openid profile email map_user_id = sub map_username = preferred_username map_display_name = name map_email = email ``` Restart WriteFreely for the changes to take effect. ### Configure registration *(optional)* To disable local username and password authentication after you have tested OAuth sign-in, set `disable_password_auth` to `true` in the `[app]` section. ```ini title="config.ini" [app] disable_password_auth = true ``` WriteFreely uses the `open_registration` setting for both local registration and first-time OAuth sign-ins. If `open_registration` is set to `false`, users must already have a linked WriteFreely account or sign in through a valid invite. To link an existing local account with authentik, log in to WriteFreely with local credentials before disabling password authentication. Then navigate to **Customize** > **Account Settings**. In the **Link External Accounts** section, click **Link authentik**. ## Configuration verification To confirm that authentik is properly configured with WriteFreely, open WriteFreely and select the **Log in with authentik** option. A successful authentication redirects you to authentik and then returns you to WriteFreely as a signed-in user. ## Resources - [WriteFreely documentation - Configuring WriteFreely](https://writefreely.org/docs/main/admin/config) --- ## Integrate with Zoom ## What is Zoom? > Zoom is a video conferencing and collaboration platform. It allows users to hold online meetings, webinars, chats, and calls over the internet. > > \-- [https://zoom.com/](https://zoom.com/) ## Preparation The following placeholders are used in this guide: - `company.zoom.us` is the FQDN of your Zoom vanity URL. For US Government tenants, use `agency.zoomgov.com`. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. To configure SSO in Zoom, you need a Zoom Business, Education, or Enterprise account with an approved vanity URL. ## authentik configuration To support the integration of Zoom with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because you use it later as ``. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations: - Set the **ACS URL** to `https://company.zoom.us/saml/SSO`. - Set the **SLS URL** to `https://company.zoom.us/saml/SingleLogout`. - Set the **SLS Binding** to `Redirect`. - Set the **Logout Method** to `Front-channel (Native)`. - Set the **Audience** to `company.zoom.us`. - Under **Advanced protocol settings**, select an available **Signing Certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the provider that you created in the previous section. 3. Under **Related objects** > **Download signing certificate**, click **Download** to save the certificate to your machine. 4. Open the downloaded certificate file in plain text, remove the first and last lines (`-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`), then take note of the remaining text. ## Zoom configuration You must configure and receive approval for a Zoom vanity URL before you can use SAML SSO. Domain verification and vanity URL approval are outside the scope of this guide. This documentation covers a single Zoom vanity URL. Multiple vanity URLs or multiple IdPs require a different SP entity ID format and should be coordinated with Zoom Support. 1. Log in to the [Zoom web portal](https://success.zoom.us/profile) as an administrator. 2. In the navigation menu, under **Admin**, click **Advanced**, then **Single Sign-On**. 3. Select the vanity URL that you want to configure with SAML SSO. If you only have one vanity URL, additional options are not shown. 4. Configure the following required settings: - **Sign-in page URL**: `https://authentik.company/application/saml//` - **Sign-out page URL**: `https://authentik.company/application/saml//` - **Identity Provider Certificate**: paste the certificate contents that you noted in the previous section. - **Service Provider (SP) Entity ID**: `company.zoom.us` - **Issuer (IDP Entity ID)**: `https://authentik.company/application/saml//metadata/` - **Binding**: `HTTP-POST` - **Signature Hash Algorithm**: `SHA-256` - **Security options**: select **Sign SAML request**. - **Provision User**: select **At Sign-In**. 5. Click **Save Changes**. ## Configuration verification To confirm that authentik is properly configured with Zoom, open Zoom and select **Sign in**. You should be redirected to authentik for authentication and then redirected back to Zoom. ## Resources - [Zoom Support - Quick start guide for single sign-on](https://support.zoom.com/hc/en/article?id=zm_kb\&sysparm_article=KB0060673) - [Zoom Support - Guidelines for Vanity URL requests](https://support.zoom.com/hc/en/article?id=zm_kb\&sysparm_article=KB0061540) --- ## Integrate with Zulip ## What is Zulip? > Zulip is an open-source team chat application that organizes conversations into topic-based streams, enabling more structured and efficient communication compared to traditional linear chat platforms. > > \-- [https://zulip.com](https://zulip.com) ## Preparation The following placeholders are used in this guide: - `zulip.company` is the FQDN of the Zulip instance. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Zulip with authentik, you need to create SAML property mappings and an application/provider pair in authentik. ### Create property mappings Zulip expects SAML attributes for the user's email address and name. Create SAML provider property mappings that send those values with the attribute names used in the Zulip configuration. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings**, click **Create**, select **SAML Provider Property Mapping**, and then click **Next**. 3. Configure the first mapping for the user's email address: - **Name**: `Zulip email` - **SAML Attribute Name**: `email` - **Expression**: ```python return request.user.email ``` 4. Click **Finish** to save the mapping. 5. Repeat the process to create the user's full name mapping: - **Name**: `Zulip full name` - **SAML Attribute Name**: `full_name` - **Expression**: ```python return request.user.name or request.user.username ``` 6. Click **Finish** to save the mapping. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://zulip.company/complete/saml/`. - Set the **Audience** to `https://zulip.company`. - Set the **SLS URL** to `https://zulip.company/complete/saml/`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `Zulip email`. - Add the `Zulip email` and `Zulip full name` property mappings to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Zulip configuration Zulip is a Django application and is configured with `/etc/zulip/settings.py`. Make sure that your `settings.py` file includes the current Zulip SAML authentication section before changing the settings below. 1. Uncomment `zproject.backends.SAMLAuthBackend` in `AUTHENTICATION_BACKENDS`. 2. In the `SAML Authentication` section, configure authentik as a SAML IdP: ```python title="/etc/zulip/settings.py" SOCIAL_AUTH_SAML_ORG_INFO = { "en-US": { "displayname": "authentik Zulip", "name": "zulip", "url": "{}{}".format("https://", EXTERNAL_HOST), }, } SOCIAL_AUTH_SAML_ENABLED_IDPS: dict[str, Any] = { "authentik": { "entity_id": "https://authentik.company/application/saml//metadata/", "url": "https://authentik.company/application/saml//", "attr_user_permanent_id": "email", "attr_username": "email", "attr_email": "email", "attr_full_name": "full_name", "display_name": "authentik SAML", }, } ``` 3. Download the signing certificate from the authentik SAML provider and place it at `/etc/zulip/saml/idps/authentik.crt`. 4. Set the certificate permissions expected by Zulip: ```bash chown -R zulip.zulip /etc/zulip/saml/ find /etc/zulip/saml/ -type f -exec chmod 644 -- {} + ``` 5. Restart Zulip. ## Configuration verification To confirm that authentik is properly configured with Zulip, open Zulip and click **Log in with authentik SAML**. After you authenticate with authentik, you should be redirected back to Zulip. ## Resources - [Zulip documentation - SAML authentication for self-hosted servers](https://zulip.readthedocs.io/en/stable/production/authentication-methods.html#saml) - [Zulip Help Center - SAML authentication](https://zulip.com/help/saml-authentication) - [Zulip source - production settings template](https://github.com/zulip/zulip/blob/main/zproject/prod_settings_template.py) --- ## Integrate with Amazon Web Services (IAM Identity Center) ## What is AWS? > AWS, or Amazon Web Services, is a comprehensive cloud computing platform. It provides a wide array of on-demand IT services like computing power, storage, and databases, allowing businesses to build and run applications, and manage infrastructure through the internet. > > \-- [https://aws.amazon.com](https://aws.amazon.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. You need an AWS account with IAM Identity Center enabled and permissions to change the IAM Identity Center identity source. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. IAM Identity Center requires users to exist before they can log in with an external identity provider. You can create users manually in IAM Identity Center or configure SCIM provisioning from authentik. SCIM provisioning is only supported with IAM Identity Center. It is not supported with [Amazon Web Services (Classic IAM)](../aws-classic/index.mdx). ### Download the service provider metadata 1. Log in to the AWS Management Console as an administrator. 2. Navigate to **IAM Identity Center** > **Settings** > **Identity source**. 3. Click **Actions** > **Change identity source**. 4. Select **External identity provider** and click **Next**. 5. Under **Service provider metadata**, click **Download metadata file**. 6. Note the **AWS access portal sign-in URL**. 7. Keep this browser tab open. You need to return to it after you configure authentik. ## authentik configuration To support the integration of AWS IAM Identity Center with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - Under **UI Settings**, set **Launch URL** to the **AWS access portal sign-in URL** that you copied from AWS. - **Choose a Provider type**: select **SAML Provider from metadata** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), upload the service provider metadata file that you downloaded from AWS, and configure the following required settings. - Under **Advanced protocol settings**, select an available **Signing Certificate**. - Under **Advanced protocol settings**, set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. AWS matches the SAML NameID value to the user's IAM Identity Center username, not to the user's email attribute. If you provision users with SCIM, configure the SCIM user mapping so that the IAM Identity Center username uses the same value as the SAML NameID. ### Download the identity provider metadata 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the AWS provider that you created. 3. Under **Related objects** > **Metadata**, click **Download**. This metadata file is required in the next section. ## AWS configuration ### Complete the SAML setup 1. Return to the AWS IAM Identity Center browser tab from the previous section. 2. Under **Identity provider metadata** > **IdP SAML metadata**, click **Choose file** and upload the metadata file that you downloaded from authentik. 3. Click **Next**. 4. Type `ACCEPT` in the confirmation field. 5. Click **Add/Change Identity Provider**. ### Enable automatic provisioning *(optional)* IAM Identity Center supports SCIM provisioning for users and groups from authentik. Complete the SAML setup before you configure SCIM provisioning. 1. Log in to the AWS Management Console as an administrator. 2. Navigate to **IAM Identity Center** > **Settings**. 3. In the **Automatic provisioning** info box, click **Enable**. - If automatic provisioning is already enabled, click **Actions** > **Manage provisioning** under **Identity source**. 4. Note the **SCIM endpoint** and **Access token**. These values are required when you configure the SCIM provider in authentik. ### Configure SCIM property mappings *(optional)* 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SCIM Provider Mapping** and click **Next**. 4. Configure the AWS user mapping: - **Name**: provide a name that sorts after `authentik default SCIM Mapping: User`, such as `zz AWS SCIM User`. - **Expression**: ```python return { "photos": None, "userName": request.user.email, } ``` 5. Click **Finish**. This mapping removes the `photos` attribute and maps the IAM Identity Center username to the user's email address so that it matches the SAML NameID configured earlier. ### Configure a SCIM provider *(optional)* 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Providers** > **Providers** and click **Create**. 3. Select **SCIM Provider** as the provider type. 4. Configure the provider with the following settings: - Provide a descriptive name. - Under **Protocol settings**, set **URL** to the **SCIM endpoint** from AWS. - Under **Protocol settings**, set **Token** to the **Access token** from AWS. - Under **Protocol settings**, set **Compatibility Mode** to `AWS`. - If you want to test provisioning without writing changes to AWS, enable **Dry run mode**. - Configure user filtering and group filtering for the users and groups that authentik should provision. - Under **User Property Mappings**, add `authentik default SCIM Mapping: User` and the AWS user mapping that you created. - Under **Group Property Mappings**, add `authentik default SCIM Mapping: Group`. 5. Click **Finish**. 6. Navigate to **Applications** > **Applications** and open the AWS application. 7. Click **Edit**. 8. Set **Backchannel providers** to the AWS SCIM provider that you created. 9. Click **Update**. The SCIM provider syncs when users, groups, or memberships change. You can also start a manual sync from the SCIM provider page. ## Configuration verification To confirm that authentik is properly configured with AWS IAM Identity Center, open the AWS application from the authentik User interface. The AWS access portal should open without prompting for another sign-in. If you configured SCIM, confirm that the expected users and groups appear in IAM Identity Center. ## Resources - [AWS Docs - What is IAM Identity Center?](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html) - [AWS Docs - How to connect to an external identity provider](https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-connect-idp.html) - [AWS Docs - Enable automatic provisioning](https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-with-scim.html) - [AWS Docs - Provision users and groups from an external identity provider using SCIM](https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html) - [AWS Docs - SCIM profile and SAML 2.0 implementation](https://docs.aws.amazon.com/singlesignon/latest/userguide/scim-profile-saml.html) --- ## Integrate with Amazon Web Services (Classic IAM) ## What is AWS? > AWS, or Amazon Web Services, is a comprehensive cloud computing platform. It provides a wide array of on-demand IT services like computing power, storage, and databases, allowing businesses to build and run applications, and manage infrastructure through the internet. > > \-- [https://aws.amazon.com](https://aws.amazon.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. You need an AWS account with permissions to create IAM identity providers, IAM roles, and IAM policies. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Classic IAM SAML federation is best suited for legacy or single-account AWS console access. For centralized workforce access, multi-account access, or SCIM provisioning, use [Amazon Web Services (IAM Identity Center)](../aws/index.mdx). AWS Classic IAM also supports OIDC identity providers for web identity federation and temporary AWS credentials. OIDC does not provide direct sign-in to the AWS Management Console, so this guide uses SAML for console SSO. ## authentik configuration authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. To support the integration of AWS Classic IAM with authentik, you need to create SAML property mappings, an application/provider pair, and application entitlements for the AWS IAM roles that users can assume. ### Create property mappings Before creating the AWS role mapping, note your AWS account ID and choose the name that you will use for the SAML provider in AWS, such as `authentik`. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** and click **Next**. 4. Configure the role mapping for application entitlement-based role assignment: - **Name**: provide a descriptive name, such as `AWS Role`. - **SAML Attribute Name**: `https://aws.amazon.com/SAML/Attributes/Role` - **Friendly Name**: leave blank. - **Expression**: ```python ACCOUNT_ID = "" PROVIDER_NAME = "" return [ ( f"arn:aws:iam::{ACCOUNT_ID}:role/{entitlement.name}," f"arn:aws:iam::{ACCOUNT_ID}:saml-provider/{PROVIDER_NAME}" ) for entitlement in request.user.app_entitlements(provider.application) ] ``` 5. Click **Finish**. 6. Create another **SAML Provider Property Mapping** for the AWS role session name: - **Name**: provide a descriptive name, such as `AWS Role Session Name`. - **SAML Attribute Name**: `https://aws.amazon.com/SAML/Attributes/RoleSessionName` - **Friendly Name**: leave blank. - **Expression**: ```python session_name = regex_replace(user.username, r"[^a-zA-Z0-9+=,.@-]", "-")[:64] return session_name if len(session_name) >= 2 else "ak-user" ``` 7. Click **Finish**. This role mapping returns one role/provider ARN pair for each AWS role entitlement assigned to the user. If a user receives one role, AWS opens that role directly. If a user receives multiple roles, AWS prompts them to select which role to assume. If you do not want to use application entitlements for role assignment, return one or more static role and provider ARN pairs from the role mapping instead. For a single static role, use this expression: ```python return ( "arn:aws:iam:::role/authentik-admin," "arn:aws:iam:::saml-provider/" ) ``` For multiple static roles, use this expression: ```python return [ ( "arn:aws:iam:::role/authentik-admin," "arn:aws:iam:::saml-provider/" ), ( "arn:aws:iam:::role/authentik-read-only," "arn:aws:iam:::saml-provider/" ), ] ``` The role session name mapping determines how the user is identified in AWS audit logs and in the AWS console. AWS displays the assumed role session in the format `/`. ### Configure session duration *(optional)* AWS supports the `SessionDuration` SAML attribute for AWS Management Console sessions. To set the requested session duration from authentik, create another **SAML Provider Property Mapping**: - **Name**: provide a descriptive name, such as `AWS Session Duration`. - **SAML Attribute Name**: `https://aws.amazon.com/SAML/Attributes/SessionDuration` - **Friendly Name**: leave blank. - **Expression**: return the requested duration in seconds, such as `return "3600"`. The value must be between 900 and 43200 seconds and cannot exceed the maximum session duration configured on the IAM role. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **ACS URL**: `https://signin.aws.amazon.com/saml` - **Audience**: `urn:amazon:webservices` - Under **Advanced protocol settings**, select an available **Signing Certificate**. - Under **Advanced protocol settings**, enable **Sign responses** and keep **Sign assertions** enabled. - Under **Advanced protocol settings** > **Property mappings**, add the AWS role mapping, AWS role session name mapping, and optional AWS session duration mapping that you created. - Under **Advanced protocol settings**, set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. AWS Classic IAM accepts an email-formatted NameID. The default authentik SAML email mapping provides that value. ### Create application entitlements for AWS roles Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the AWS IAM roles that this application should expose. 1. Open the AWS application that you created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each AWS IAM role that users should be able to assume, such as `authentik-admin` or `authentik-read-only`. 4. Bind the appropriate users or groups to each entitlement. For this integration, each entitlement name must exactly match the corresponding AWS IAM role name. This keeps AWS-specific authorization scoped to the AWS application instead of relying on global group names. ### Download the metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the AWS provider that you created. 3. Under **Related objects** > **Metadata**, click **Download**. This metadata file is required in the next section. ## AWS configuration ### Create a SAML identity provider 1. Log in to the AWS Management Console as an administrator. 2. Navigate to **IAM** > **Identity providers**. 3. Click **Add provider** and configure the following settings: - **Provider type**: select **SAML**. - **Provider name**: enter the provider name that you used in the authentik role mapping. - **Metadata document**: upload the metadata file that you downloaded from authentik. 4. Click **Add provider**. ### Create IAM roles for SAML federation Create one IAM role for each application entitlement that you created in authentik. 1. In the IAM console, navigate to **Access management** > **Roles**. 2. Click **Create role**. 3. Under **Trusted entity type**, select **SAML 2.0 federation**. 4. Under **SAML 2.0-based provider**, select the SAML provider that you created. 5. Under **Access to be allowed**, select the access mode that matches how users should use the role: - **Allow programmatic and AWS Management Console access**: users can access the AWS Management Console and use temporary credentials. - **Allow programmatic access only**: users can use temporary credentials, but not console SSO. 6. Under **Sign-in endpoint type**, select the endpoint type for your environment: - **Regional endpoint**: AWS uses a region-specific sign-in URL. - **Non-Regional endpoint**: AWS uses the global sign-in URL. 7. Click **Next**. 8. Select the permissions policies that define access for this role. 9. Click **Next**. 10. Set **Role name** to the matching entitlement name in authentik, such as `authentik-admin`. 11. Optionally add a description and tags. 12. Click **Create role**. Repeat these steps for each AWS role that users should be able to assume. ### Verify the role trust policy For each IAM role, confirm that the trust policy allows SAML federation from the authentik SAML provider. 1. Navigate to **IAM** > **Roles** and click the role that you created. 2. Go to the **Trust relationships** tab and click **Edit trust policy**. 3. AWS can create a trust policy with a session-specific ACS URL similar to this: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam:::saml-provider/" }, "Action": "sts:AssumeRoleWithSAML", "Condition": { "StringEquals": { "SAML:aud": "https://signin.aws.amazon.com/saml/acs/AAAAAA" } } } ] } ``` 4. Update `SAML:aud` to the generic AWS SAML sign-in URL: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam:::saml-provider/" }, "Action": "sts:AssumeRoleWithSAML", "Condition": { "StringEquals": { "SAML:aud": "https://signin.aws.amazon.com/saml" } } } ] } ``` 5. Click **Update policy**. ### Configure OIDC federation *(optional)* Use this path only for AWS IAM web identity federation, such as CI/CD pipelines, automation, or workloads that exchange OIDC tokens for temporary AWS credentials. It does not configure AWS Management Console SSO. 1. In authentik, create an application/provider pair with **OAuth2/OpenID Connect** as the provider type. - **Application**: provide a descriptive name, note the application **Slug**, and configure an optional group for the type of application, the policy engine mode, and optional UI settings. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**. - Select an available signing key. - Under **Advanced protocol settings** > **Selected Scopes**, add `authentik default OAuth Mapping: OpenID 'entitlements'` if your role trust policies use entitlement claims. 2. In the AWS Management Console, navigate to **IAM** > **Identity providers**. 3. Click **Add provider** and configure the following settings: - **Provider type**: select **OpenID Connect**. - **Provider URL**: `https://authentik.company/application/o//` - **Audience**: enter the **Client ID** from authentik. 4. Click **Add provider**. 5. Open the identity provider that you created and click **Assign role** to create or select the IAM role that trusts this provider. ## Configuration verification To confirm that authentik is properly configured with AWS Classic IAM, open the AWS application from the authentik User interface. If your user has access to more than one AWS role, AWS prompts you to choose a role. After you select a role, the AWS Management Console opens and shows your assumed role session in the account menu in the format `/`. ## Resources - [AWS Docs - Create a SAML identity provider in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html) - [AWS Docs - Create a role for SAML 2.0 federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_saml.html) - [AWS Docs - Create an OpenID Connect (OIDC) identity provider in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html) - [AWS Docs - Create a role for OpenID Connect federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) - [AWS Docs - Configure SAML assertions for the authentication response](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_assertions.html) - [AWS Docs - Enabling SAML 2.0 federated principals to access the AWS Management Console](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html) - [AWS Docs - Troubleshoot SAML federation with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_saml.html) --- ## Integrate with DigitalOcean ## What is DigitalOcean? > DigitalOcean is a cloud infrastructure provider that offers developers simple, scalable virtual servers (droplets), managed databases, and other cloud services to deploy and manage applications efficiently. > > \-- [https://www.digitalocean.com/](https://www.digitalocean.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. You need access to a DigitalOcean team where you can configure SSO, and you need to know which DigitalOcean team role each user should receive. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of DigitalOcean with authentik, you need to create a scope mapping, an application/provider pair, and application entitlements for the DigitalOcean roles that users should receive. ### Create a scope mapping DigitalOcean expects the `team_role` claim to be sent as an array. This scope mapping reads the user's application entitlements and returns one DigitalOcean role in the format DigitalOcean expects. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Click **Scope Mapping**, **Next**, and fill the following required information: - **Name**: `DigitalOcean team role` - **Scope name**: `profile` - **Expression**: ```py # Get the role names from the application's entitlements do_roles = [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ] # DigitalOcean team roles must match a valid predefined or custom role name. # Predefined roles are Owner, Biller, Billing Viewer, Modifier, Member, # and Resource Viewer. priority = [ "Owner", "Biller", "Billing Viewer", "Modifier", "Member", "Resource Viewer", ] # Pick the first matching predefined role based on priority order. # If no predefined role matches, fall back to the first custom role name. chosen = next((r for p in priority for r in do_roles if r == p), None) if not chosen and do_roles: chosen = sorted(do_roles)[0] # Return a dict with the team role if one was chosen, otherwise return an empty dict. return {"team_role": [chosen]} if chosen else {} ``` 4. Click **Finish**. ### Create an application and provider In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://cloud.digitalocean.com/sessions/sso/callback`. - Select any available signing key. - Under **Advanced protocol settings**: - Add the `profile` scope created in the previous section. Do not remove authentik’s `authentik default OAuth Mapping: OpenID 'profile'`, as claims such as `name` are required by DigitalOcean. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements for DigitalOcean roles Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the DigitalOcean roles that this application should assign. 1. Open the DigitalOcean application that you just created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each DigitalOcean role that users should be able to receive. 4. Bind the appropriate users or groups to each entitlement. For this integration, each entitlement name must exactly match a valid DigitalOcean team role name. This can be one of the predefined team roles, such as `Owner`, `Biller`, `Billing Viewer`, `Modifier`, `Member`, or `Resource Viewer`, or the exact name of a custom role that you created for the same DigitalOcean team. This keeps the role assignment scoped to the DigitalOcean application instead of relying on global group names such as `do:Owner`. The sample scope mapping returns a single `team_role` value. In most deployments, each user should receive only one DigitalOcean role entitlement at a time. If multiple matching entitlements are assigned, the example prefers predefined roles in the priority order shown above and otherwise falls back to the first custom role name alphabetically. ## DigitalOcean configuration 1. Log in to the [DigitalOcean control panel](https://cloud.digitalocean.com/) as an administrator. 2. Click the profile icon in the top right, click **Switch Teams**, and then select the team where you want to configure SSO. 3. Navigate to **Settings** > **Single sign-on (OIDC)**, then click **Enable**. 4. Configure the following required settings: - **OpenID provider URL**: `https://authentik.company/application/o//` - **OpenID client ID**: Set this to the **Client ID** from authentik. - **OpenID client secret**: Set this to the **Client Secret** from authentik. 5. Click **Test SSO config to continue**. 6. Leave **Require sign-in via SSO only** disabled while testing, then click **Continue**. 7. Take note of the **SSO sign-in URL**, then click **Enable SSO**. After saving the DigitalOcean SSO configuration, update the authentik application launch URL: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications**, then select your DigitalOcean application. 3. Click **Edit**, expand **UI Settings**, and set **Launch URL** to the **SSO sign-in URL** copied from the DigitalOcean control panel. 4. Click **Update**. ## Configuration verification To verify the integration of authentik with DigitalOcean, open the DigitalOcean application from the authentik User interface. Upon successful login, you should be redirected to the DigitalOcean dashboard and have the appropriate permissions set by your application entitlements. After successfully testing SSO, you can return to DigitalOcean's **Single sign-on (OIDC)** settings and enable **Require sign-in via SSO only**. ## Resources - [DigitalOcean Documentation - How to Configure Single Sign-On for Teams](https://docs.digitalocean.com/platform/teams/how-to/configure-sso/) - [DigitalOcean Documentation - Teams Predefined Roles](https://docs.digitalocean.com/platform/teams/roles/predefined/) - [DigitalOcean Documentation - Teams Custom Roles](https://docs.digitalocean.com/platform/teams/roles/custom/) --- ## Integrate with Google Workspace ## What is Google Workspace? > Google Workspace is a collection of business productivity and collaboration apps, including Gmail, Calendar, Drive, Docs, Sheets, Meet, and more. > > \-- [https://workspace.google.com](https://workspace.google.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `example.com` is the primary domain of the Google Workspace account. Google Workspace users must already exist before they can sign in with SSO. The primary email address in Google Workspace must match the user's email address in authentik. Google handles super administrator sign-ins differently from standard user sign-ins. Use a non-super-admin account to verify the SSO flow. Provisioning users and groups from authentik to Google Workspace requires authentik Enterprise. The SAML configuration below can be used with or without this optional provisioning provider. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Google Workspace with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: Provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug**, because it is used by the SAML provider warning above. - Set **Launch URL** to `https://mail.google.com/a/example.com`. - **Choose a Provider type**: Select **SAML Provider** as the provider type. - **Configure the Provider**: Provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations: - Set **ACS URL** to `https://accounts.google.com/a/example.com/acs`. - Set **Audience** to `google.com/a/example.com`. - Under **Advanced protocol settings**, select an available **Signing Certificate**. - Under **Advanced protocol settings**, set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Under **Advanced protocol settings**, set **Service Provider Binding** to **Post**. - **Configure Bindings** *(optional)*: You can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Copy provider values 1. In authentik, navigate to **Applications** > **Providers** and click the name of the provider that you created. 2. Under **SAML Configuration**, copy the **SAML Endpoint** value. 3. Under **Related objects** > **Download signing certificate**, click **Download**. ### Configure user and group provisioning *(optional)* The authentik Enterprise Google Workspace provider syncs authentik users and groups to Google Workspace through the Google Admin SDK Directory API. Before creating the provider, complete the Google-side preparation in [Prepare user and group provisioning](#prepare-user-and-group-provisioning-optional). To use it with this SAML application, create the provider and attach it to the application as a backchannel provider. 1. In authentik, navigate to **Applications** > **Providers** and click **New Provider**. 2. Select **Google Workspace Provider** as the provider type and click **Next**. 3. Configure the following settings: - **Provider Name**: Enter a descriptive name. - Under **Protocol settings**, set **Credentials** to the JSON service account key that you created in Google Cloud. - Under **Protocol settings**, set **Delegated Subject** to the Google Workspace user email address that authentik should act as. - Under **Protocol settings**, set **Default group email domain** to the Google Workspace domain that authentik should use when generating group email addresses. - Under **Protocol settings**, choose the **User deletion action** and **Group deletion action** that match your lifecycle policy. - Under **User filtering**, optionally configure which authentik users are synchronized. - Under **Attribute mapping**, optionally customize the user and group property mappings. 4. Click **Finish**. 5. Navigate to **Applications** > **Applications** and edit the Google Workspace application that you created earlier. 6. In **Backchannel Providers**, select the Google Workspace provider that you created. 7. Save the application. ## Google Workspace configuration ### Configure SAML SSO 1. Log in to the Google Admin console at [https://admin.google.com](https://admin.google.com) with a super-admin account. 2. Navigate to **Security** > **Authentication** > **SSO with third party IdP**. 3. In the **Third-party SSO profiles** section, click **Add SAML profile**. 4. At the bottom of the **IdP details** page, click **Go to legacy SSO profile settings**. 5. On the **Legacy SSO profile** page, select **Enable SSO with third-party identity provider**. 6. Configure the following settings: - **Sign-in page URL**: Enter the **SAML Endpoint** value from authentik. - **Sign-out page URL**: Enter the **SAML Endpoint** value from authentik. - **Verification certificate**: Upload the signing certificate that you downloaded from authentik. - **Use a domain-specific issuer**: Enable this option. 7. Click **Save**. If your Google Workspace account uses SSO profile assignments, make sure that the users who should sign in with authentik are assigned to the legacy SSO profile. ### Prepare user and group provisioning *(optional)* If you are configuring the authentik Enterprise Google Workspace provider, prepare Google Workspace and Google Cloud before creating the provider in authentik. 1. In Google Cloud, create or select a project. 2. Enable the **Admin SDK API** for the project. 3. Create a service account. 4. Create a **JSON** key for the service account and save the downloaded key. This key is used as the **Credentials** value in authentik. 5. On the service account details page, copy the **Client ID** from the **Domain-wide delegation** section. 6. In the Google Admin console, navigate to **Security** > **Access and data control** > **API controls**. 7. Click **Manage Domain Wide Delegation**. 8. Click **Add new** and enter the service account **Client ID**. 9. Authorize the following OAuth scopes: - `https://www.googleapis.com/auth/admin.directory.user` - `https://www.googleapis.com/auth/admin.directory.group` - `https://www.googleapis.com/auth/admin.directory.group.member` - `https://www.googleapis.com/auth/admin.directory.domain.readonly` 10. Select or create the Google Workspace user whose email address you will use as the authentik provider's **Delegated Subject**. This user must have permissions to manage users and groups. ## Configuration verification To confirm that authentik is properly configured with Google Workspace, open Google Workspace in a private browser window and sign in with a non-super-admin user whose primary email address exists in both Google Workspace and authentik. You should be redirected to authentik to complete authentication. If you configured the Google Workspace provider, open the provider in authentik and check that the sync status succeeds. Existing users are linked by email address, and existing groups are linked by name. ## Resources - [Google Workspace Help - Setting up SSO](https://knowledge.workspace.google.com/admin/apps/setting-up-sso) - [Google Workspace Help - SSO assertion requirements](https://knowledge.workspace.google.com/admin/apps/sso-assertion-requirements) - [Google Workspace Help - Super administrator SSO](https://knowledge.workspace.google.com/admin/apps/super-administrator-sso) - [Google Workspace Help - Control API access with domain-wide delegation](https://knowledge.workspace.google.com/admin/apps/control-api-access-with-domain-wide-delegation) - [Google for Developers - Choose Directory API scopes](https://developers.google.com/workspace/admin/directory/v1/guides/authorizing) --- ## Integrate with HashiCorp Cloud Platform ## What is HashiCorp Cloud Platform? > The HashiCorp Cloud Platform (HCP) is a unified suite of SaaS products that automate the lifecycle management of the infrastructure and security supporting your most critical applications. > > \-- [https://www.hashicorp.com/en](https://www.hashicorp.com/en) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Before you configure authentik, log in to the [HCP Portal](https://portal.cloud.hashicorp.com), open the organization that you want to configure, and navigate to **Organization settings** > **SSO**. Configure SSO for the organization, verify the email domains that should use SSO, and select **SAML** as the SSO protocol. Domain verification is required by HCP before SAML SSO can be completed, but managing DNS records is outside the scope of this guide. After the domain is verified, copy the following values from the **Initiate SAML integration** section: - **SSO Sign-On URL** - **Entity ID** - **Email Attribute Assertion Name** ## authentik configuration To support the integration of HashiCorp Cloud Platform with authentik, you need to create a property mapping and an application/provider pair in authentik. ### Create an email property mapping HCP requires a SAML attribute that contains the user's email address. The attribute name is generated by HCP, so create a SAML provider property mapping that uses the **Email Attribute Assertion Name** value copied from HCP. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings**, click **Create**, select **SAML Provider Property Mappings**, and then click **Next**. 3. Configure the property mapping: - **Name**: `HCP email` - **SAML Attribute Name**: enter the **Email Attribute Assertion Name** copied from HCP. - **Expression**: ```python return request.user.email ``` 4. Click **Finish**. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - Set the **Launch URL** to `https://portal.cloud.hashicorp.com/`. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to the **SSO Sign-On URL** copied from HCP. - Set the **Audience** to the **Entity ID** copied from HCP. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Under **Selected User Property Mappings**, add the `HCP email` property mapping that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 2. Click **Submit** to save the new application and provider. ### Copy the SAML endpoint and signing certificate 1. Navigate to **Applications** > **Providers** and click the name of the provider that you created. 2. Under **Related objects** > **SAML Endpoint**, copy the endpoint URL. 3. Under **Related objects** > **Download signing certificate**, click **Download**. Open the downloaded certificate in a text editor and copy its contents. ## HashiCorp Cloud Platform configuration 1. Return to the HCP SAML SSO setup page. 2. Enter the values from authentik: - **SAML IDP Single Sign-On URL**: enter the **SAML Endpoint** URL copied from authentik. - **SAML IDP Certificate**: paste the signing certificate contents copied from authentik. 3. Assign the default organization role that HCP should grant to SSO users. 4. Optional: enable **Assign users an organization role**. 5. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with HashiCorp Cloud Platform, open the integration from the authentik User interface. If HCP prompts for an email address, enter an address that uses a verified SSO domain. HCP redirects you to authentik, and after a successful login, signs you in to the organization. ## Resources - [HashiCorp Cloud Platform documentation - Set up SAML SSO](https://developer.hashicorp.com/hcp/docs/hcp/iam/sso/setup/saml) - [HashiCorp Cloud Platform documentation - Single sign-on overview](https://developer.hashicorp.com/hcp/docs/hcp/iam/sso) - [HashiCorp Cloud Platform documentation - Assign a default role for single sign-on](https://developer.hashicorp.com/hcp/docs/hcp/iam/sso/default-role) - [HashiCorp Cloud Platform documentation - Troubleshoot single sign-on](https://developer.hashicorp.com/hcp/docs/hcp/iam/sso/troubleshoot) --- ## Integrate with Oracle Cloud ## What is Oracle Cloud? > Oracle Cloud is a cloud platform that provides infrastructure and platform services for running applications, storing data, and managing cloud resources. > > \-- [https://www.oracle.com/cloud/](https://www.oracle.com/cloud/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `tenant.identity.oraclecloud.com` is the FQDN of your Oracle Cloud identity domain base URL. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Oracle Cloud with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - Note the application **Slug**, because it is required later. - Optionally set the **Launch URL** to `https://cloud.oracle.com?tenant=`, where `` is the tenant name used when logging in through the [Oracle Cloud sign-in page](https://cloud.oracle.com). - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://tenant.identity.oraclecloud.com/oauth2/v1/social/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Oracle Cloud configuration To integrate authentik with Oracle Cloud, configure authentik as a social identity provider in your Oracle Cloud identity domain. ### Configure the identity provider 1. Log in to the Oracle Cloud dashboard as an administrator. Click the hamburger menu in the top-left corner, then select **Identity & Security** > **Domains**. 2. Select your identity domain, click the **Federation** tab, and under **Actions**, select **Add Social IdP**. 3. Set the following required information: - **Type**: `OpenID Connect` - **Name**: `authentik` - **Client ID**: set the client ID from authentik. - **Client Secret**: set the client secret from authentik. - **Discovery service URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Enable Just-In-Time (JIT) provisioning**: toggle this on. 4. Click **Add**. 5. Click the three dots in the row of the identity provider that was just created, select **Activate IdP**, read the confirmation message, and click **Activate IdP** again. ### Add the provider to an IdP policy 1. Log in to the Oracle Cloud dashboard as an administrator. Click the hamburger menu in the top-left corner, then select **Identity & Security** > **Domains**. 2. Select your identity domain. On the **Federation** tab, scroll to **Identity provider policies**. If your domain shows the current navigation instead, open **Security** > **IdP policies**. 3. Select your identity provider policy, or select the default policy named **Default Identity Provider Policy**. 4. Edit the rule that should offer authentik sign-in, and under **Assign identity providers**, add `authentik`. 5. Save the rule. ## Configuration verification To confirm that authentik is properly configured with Oracle Cloud, open the Oracle Cloud integration from the authentik User interface. On the Oracle Cloud login page, click **authentik**. After you successfully log in with authentik, Oracle Cloud signs you in. ## Resources - [Oracle Cloud documentation - Adding a Social Identity Provider](https://docs.oracle.com/en-us/iaas/Content/Identity/identityproviders/add-social-identity-provider.htm) - [Oracle Cloud documentation - Listing Identity Provider Policies](https://docs.oracle.com/en-us/iaas/Content/Identity/idppolicies/list-idp-policies.htm) --- ## Integrate with OVHcloud ## What is OVHcloud? > OVHcloud is a cloud provider that offers public and private cloud services, web hosting, dedicated servers, and domain services. > > \-- [https://www.ovhcloud.com](https://www.ovhcloud.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of OVHcloud with authentik, you need to create a SAML property mapping, an application/provider pair, and application entitlements for the OVHcloud user groups that users should receive. ### Create a group property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the type and click **Next**. 4. Configure the property mapping: - **Name**: provide a descriptive name, such as `OVHcloud groups`. - **SAML Attribute Name**: set the value for your OVHcloud region: - EU and CA: `Group` - US: `groups` - **Expression**: ```python return [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ] ``` 5. Click **Finish**. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations: - Set **ACS URL** to the value for your OVHcloud region: - EU: `https://www.ovhcloud.com/eu/auth/saml/acs` - CA: `https://www.ovhcloud.com/ca/auth/saml/acs` - US: `https://us.ovhcloud.com/auth/` - Set **Audience** to the value for your OVHcloud region: - EU: `https://www.ovhcloud.com/eu/auth/` - CA: `https://www.ovhcloud.com/ca/auth/` - US: `https://us.ovhcloud.com/auth/` - Under **Advanced protocol settings**: - Set an available **Signing Keypair**. - Under **Property mappings**, add the OVHcloud groups mapping and remove `authentik default SAML Mapping: Groups`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section. 3. Under **Related objects** > **Metadata**, click **Download**. This downloaded file is your SAML metadata file and is required in the next section. ### Create application entitlements Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the OVHcloud user groups that this application should send. 1. In the Admin interface, navigate to **Applications** > **Applications** and open the OVHcloud application. 2. Click the **Application entitlements** tab. 3. Click **Create**, enter the name of an OVHcloud user group that authentik should send, and click **Create** again. 4. Bind the appropriate users or groups to the entitlement. 5. Repeat these steps for each OVHcloud user group that authentik should send. ## OVHcloud configuration To integrate authentik with OVHcloud, configure authentik as the trusted identity provider for your OVHcloud account. You also need to declare OVHcloud user groups that match the group names that authentik sends in the SAML assertion. ### Configure the SSO connection 1. Log in to the OVHcloud Control Panel. 2. Click your name in the top-right corner, and in the sidebar that appears, click your name again. 3. Select **Identity and Access Management (IAM)** from the left-hand menu. 4. Click the **Identities** tab to access local users management and switch to the **SSO** tab. 5. Click **SSO Connection** and configure the following settings: - **XML-Metadata**: open the file that you downloaded in [Download metadata file](#download-metadata-file), copy the content, and paste it into this field. - **User Attribute Name**: for EU and CA accounts, set this to `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn`. - **Group Attribute Name**: set this to the **SAML Attribute Name** value from the OVHcloud groups property mapping. - **Keep active OVHcloud users** *(optional)*: enable this option if you want to keep local OVHcloud users active. 6. Click **Confirm**. ### Declare user groups OVHcloud authorizes federated users through OVHcloud user groups. The group name in OVHcloud must match an OVHcloud application entitlement name in authentik. 1. In the **Identities** section, open the **User groups** tab. 2. Click **Declare a group**. 3. Configure the following settings: - **Group name**: enter an OVHcloud application entitlement name from authentik. - **Role**: select the OVHcloud role for this group. 4. Click **Confirm**. 5. Repeat these steps for each OVHcloud application entitlement that should grant access to OVHcloud. If you select the `NONE` role, assign permissions to the group with OVHcloud IAM policies. ## Configuration verification To confirm that authentik is properly configured with OVHcloud, log out of your OVHcloud account. On the OVHcloud login page, enter your [OVH Customer ID/NIC handle](https://help.ovhcloud.com/csm/en-account-create-ovhcloud-account?id=kb_article_view\&sysparm_article=KB0043022#what-is-my-nic-handle) followed by `/idp`, leave the password field blank, and click **Login**. After you are redirected to authentik and successfully authenticate, OVHcloud signs you in. ## Resources - [OVHcloud documentation - Enabling Okta SSO connections with your OVHcloud account](https://docs.ovhcloud.com/en/guides/account-and-service-management/account-information/ovhcloud-account-connect-saml-okta) - [OVHcloud US support - Enabling Okta SSO connections with your OVHcloud account](https://support.us.ovhcloud.com/hc/en-us/articles/16487697807635-Enabling-Okta-SSO-connections-with-your-OVHcloud-account) --- ## Integrate with Dashy ## What is Dashy? > Dashy is a self-hostable personal dashboard built for you. Includes status-checking, widgets, themes, icon packs, a UI editor and tons more. > > \-- [https://dashy.to/](https://dashy.to/) ## Preparation The following placeholders are used in this guide: - `dashy.company` is the FQDN of the Dashy installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Dashy with authentik, you need to create an application/provider pair in authentik. If you want to manage Dashy administrator access through authentik, create or choose a group for Dashy administrators and add the appropriate users to it. Dashy checks the `groups` claim from the ID token for the group name that you configure later. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** value because it will be required later. - Set the **Client type** to `Public`. Dashy runs entirely in the browser and does not store a client secret. - Add two **Redirect URIs** of type `Strict` `Authorization`: - `https://dashy.company` - `https://dashy.company/` - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Dashy configuration Dashy can be configured through the web UI under **Config** > **Edit Config** or by editing `conf.yml` directly. The following steps describe the web UI flow. 1. Log in to Dashy as an administrator and click **Config** > **Edit Config**. 2. Open the **App Config** > **Auth** section. 3. Check **Enable OIDC?**. 4. Under **Oidc**: - Set **OIDC Endpoint** to `https://authentik.company/application/o//`. - Set **OIDC Client Id** to the Client ID from the authentik provider. - Set **OIDC Scope** to `openid profile email`. - If you use an authentik group for Dashy administrators, set **Admin Group** to the exact group name from authentik. The `profile` scope includes the `groups` claim that Dashy uses for this check. 5. If you use an authentik group for Dashy administrators, enable **Disable all UI Config for non admin users.**. 6. Click **Save Changes** and restart Dashy to apply the new authentication settings. The same settings can also be set directly in `conf.yml`. ```yaml title="/user-data/conf.yml" appConfig: auth: enableOidc: true oidc: endpoint: https://authentik.company/application/o// clientId: "" scope: openid profile email adminGroup: Dashy Admins disableConfigurationForNonAdmin: true ``` Replace `Dashy Admins` with the exact name of your authentik group for Dashy administrators. If you do not use a Dashy administrator group, remove `adminGroup` and `disableConfigurationForNonAdmin`. Restart Dashy after changing any values under `appConfig.auth.oidc`. ## Configuration verification To confirm that authentik is properly configured with Dashy, log out of Dashy, then open Dashy. You should be redirected to authentik to log in, then redirected back to Dashy. ## Resources - [Dashy authentik authentication documentation](https://dashy.to/docs/authentication/authentik/) - [Dashy configuration reference](https://dashy.to/docs/configuring/) - [Dashy OIDC authentication source](https://github.com/Lissy93/dashy/blob/master/services/auth-oidc.js) --- ## Integrate with ExcaliDash ## What is ExcaliDash? > ExcaliDash is a self-hosted dashboard and organizer for Excalidraw with live collaboration features. > > \-- [https://github.com/ZimengXiong/ExcaliDash](https://github.com/ZimengXiong/ExcaliDash) ## Preparation The following placeholders are used in this guide: - `excalidash.company` is the FQDN of the ExcaliDash installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of ExcaliDash with authentik, you need to create an email verification scope mapping and an application/provider pair in authentik. ### Create an email verification scope mapping in authentik ExcaliDash requires verified email addresses unless email verification is disabled in ExcaliDash. As of [authentik 2025.10](/docs/releases/2025/v2025.10.md#default-oauth-scope-mappings), the default behavior is to return `email_verified: False`, so a custom scope mapping is required for ExcaliDash to allow authentication while keeping email verification enabled. Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification) for instructions on how to create the required custom scope mapping. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://excalidash.company/api/auth/oidc/callback`. - Select any available signing key. - **Advanced protocol settings** > **Scopes**: - Add `OAuth Mapping: OpenID 'email' with "email_verified"` to the **Selected Scopes**. - Remove the `authentik default OAuth Mapping: OpenID 'email'` scope. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## ExcaliDash configuration Configure the ExcaliDash backend with the following environment variables. Replace the placeholders with values from your authentik instance. ```env title=".env" AUTH_MODE=oidc_enforced FRONTEND_URL=https://excalidash.company TRUST_PROXY=1 OIDC_PROVIDER_NAME=authentik OIDC_ISSUER_URL=https://authentik.company/application/o// OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_REDIRECT_URI=https://excalidash.company/api/auth/oidc/callback ``` If you want to keep password login enabled alongside authentik login, set `AUTH_MODE=hybrid` instead. If you want to map existing authentik groups to the ExcaliDash administrator role, set `OIDC_ADMIN_GROUPS` to a comma-separated list of authentik group names. ```env title=".env" OIDC_ADMIN_GROUPS= ``` Restart the ExcaliDash backend for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with ExcaliDash, open ExcaliDash and click **Continue with authentik**. You should be redirected to authentik and returned to ExcaliDash after a successful login. ## Resources - [ExcaliDash README - Auth, Onboarding, and First Admin Setup](https://github.com/ZimengXiong/ExcaliDash/tree/v0.5.1#auth-onboarding-and-first-admin-setup) - [ExcaliDash authentik OIDC example](https://github.com/ZimengXiong/ExcaliDash/blob/v0.5.1/backend/.env.oidc.authentik.example) - [ExcaliDash OIDC configuration source](https://github.com/ZimengXiong/ExcaliDash/blob/v0.5.1/backend/src/config.ts) --- ## Integrate with Homarr ## What is Homarr? > A sleek, modern dashboard that puts all of your apps and services at your fingertips. Control everything in one convenient location. Seamlessly integrates with the apps you've added, providing you with valuable information. > > \-- [https://homarr.dev/](https://homarr.dev/) ## Preparation The following placeholders are used in this guide: - `homarr.company` is the FQDN of the Homarr installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Homarr with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://homarr.company/api/auth/callback/oidc`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure Homarr groups *(optional)* Homarr can synchronize group memberships from the `groups` claim that authentik sends in the OpenID `profile` scope. To use authentik groups for Homarr permissions, create groups in Homarr with names that match the authentik groups that should grant those permissions, then assign the required permissions to the Homarr groups. ## Homarr configuration Add the following environment variables to your Homarr configuration: ```env title=".env" AUTH_PROVIDERS=oidc AUTH_OIDC_CLIENT_ID= AUTH_OIDC_CLIENT_SECRET= AUTH_OIDC_ISSUER=https://authentik.company/application/o// AUTH_OIDC_CLIENT_NAME=authentik ``` To keep local Homarr account login available, set `AUTH_PROVIDERS=oidc,credentials`. If you want Homarr to skip the login page and send users directly to authentik, also add `AUTH_OIDC_AUTO_LOGIN=true`. If you are intentionally linking existing Homarr accounts by email during an OIDC provider migration, and the email addresses from your IdP are verified, also add `AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING=true`. Restart the Homarr service for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with Homarr, open Homarr and log in with authentik. You should be redirected to authentik for authentication and then redirected back to Homarr. ## Resources - [Homarr Single Sign On documentation](https://homarr.dev/docs/advanced/single-sign-on/) --- ## Integrate with Linkwarden ## What is Linkwarden? > Linkwarden is an open-source collaborative bookmark manager used to collect, organize, and preserve webpages. > > \-- [https://linkwarden.app/](https://linkwarden.app/) ## Preparation The following placeholders are used in this guide: - `linkwarden.company` is the FQDN of the Linkwarden installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Linkwarden with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://linkwarden.company/api/v1/auth/callback/authentik`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Linkwarden configuration To configure Linkwarden to use authentik, add the following values to your `.env` file. Replace `` with the authentik application slug created earlier. ```env title=".env" NEXTAUTH_URL=https://linkwarden.company/api/v1/auth NEXT_PUBLIC_AUTHENTIK_ENABLED=true AUTHENTIK_ISSUER=https://authentik.company/application/o/ AUTHENTIK_CLIENT_ID= AUTHENTIK_CLIENT_SECRET= ``` To change the login button label, set `AUTHENTIK_CUSTOM_NAME` in the same file. After making these changes, recreate your Linkwarden containers to apply the new environment variables. ## Configuration verification To confirm that authentik is properly configured with Linkwarden, open Linkwarden and sign in with authentik. ## Resources - [Linkwarden SSO/OAuth integrations](https://docs.linkwarden.app/self-hosting/sso-oauth) - [Linkwarden environment variables](https://docs.linkwarden.app/self-hosting/environment-variables) --- ## Integrate with Organizr ## What is Organizr? > Organizr allows you to setup "Tabs" that will be loaded all in one webpage. > > \-- [https://organizr.app/](https://organizr.app/) Organizr does not provide native OAuth, OIDC, or SAML SSO. This guide uses the authentik Proxy Provider to authenticate requests before they reach Organizr, and configures Organizr to trust the identity headers sent by the authentik proxy outpost. ## Preparation The following placeholders are used in this guide: - `organizr.company` is the FQDN of the Organizr installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Before configuring Organizr, create an authentik LDAP provider and LDAP outpost by following [Create an LDAP provider](/docs/add-secure-apps/providers/ldap/create-ldap-provider/). Organizr also needs a service account that can bind to LDAP and search for users. This guide uses `ldapservice` as the service account username. Note the following values from your LDAP provider and outpost: - LDAP provider **Base DN**. - Service account DN, for example `cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io`. - Service account password. - LDAP outpost hostname or IP address and port. If you want to scope access to Organizr, create or choose an authentik group for Organizr users. You can bind this group to the Organizr application later. When Organizr is configured for auth proxy login, Organizr trusts the proxy headers that it receives. Make sure users can access Organizr only through the authentik proxy outpost, and do not expose the Organizr backend directly to the internet. ## authentik configuration To support the integration of Organizr with authentik, you need to create an application/provider pair in authentik and assign it to a proxy outpost. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **Proxy Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **Mode** to **Proxy**. - Set **External host** to `https://organizr.company`. - Set **Internal host** to the URL that the authentik proxy outpost uses to reach Organizr. - Under **Advanced protocol settings**, set **Unauthenticated Paths** to the following value to allow Organizr API requests: ```text ^/api/.* ``` - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure proxy outpost The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. Add the Organizr application to a proxy outpost that will serve it: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Outposts**. 3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. 4. Under **Available Applications**, select the Organizr application and move it to **Selected Applications**. 5. Click **Update** to save your changes. ## Organizr configuration Configure Organizr to trust the authenticated username and email headers sent by the authentik proxy outpost. Ensure that local Organizr usernames and email addresses do not conflict with usernames and email addresses in authentik. 1. Log in to Organizr as an administrator. 2. Navigate to **Settings** > **System Settings** > **Main** > **Auth Proxy**. 3. Set **Auth Proxy** to enabled. 4. Set **Auth Proxy Whitelist** to the IPv4 address of the authentik proxy outpost as seen by Organizr. You can also use an IPv4 subnet in CIDR notation if the proxy outpost can reach Organizr from multiple addresses. 5. Set **Auth Proxy Header Name** to `X-authentik-username`. 6. Set **Auth Proxy Header Name for Email** to `X-authentik-email`. 7. Set **Override Logout** to enabled. 8. Set **Logout URL** to `/outpost.goauthentik.io/sign_out`. 9. Navigate to **Settings** > **System Settings** > **Main** > **Authentication**. 10. Set **Authentication Type** to **Organizr DB + Backend**. 11. Set **Authentication Backend** to **Ldap**. 12. Set **Host Address** to the LDAP outpost URL, including the scheme and port. 13. Set **Host Base DN** to the Base DN from the authentik LDAP provider. 14. Set **Account Prefix** to `cn=`. 15. Set **Account Suffix** to `,ou=users,`, replacing `` with the Base DN from the authentik LDAP provider. 16. Set **Bind Username** to the service account DN from authentik. 17. Set **Bind Password** to the service account password from authentik. 18. Set **LDAP Backend Type** to **OpenLDAP**. 19. Save your changes. Access for authentik users is managed locally within Organizr under **User Management**. New users are assigned to the default Organizr group. Configure DNS or your reverse proxy so that requests for `https://organizr.company` are routed to the authentik proxy outpost. The authentik proxy outpost then forwards authenticated requests to Organizr through the **Internal host** configured on the proxy provider. ## Configuration verification To verify the login flow, open Organizr. You should be redirected to authentik before the Organizr web interface is shown. ## Resources - [Organizr Proxy Auth SSO documentation](https://docs.organizr.app/features/sso/proxy-auth-sso) - [Organizr Auth Proxy and LDAP settings source](https://github.com/causefx/Organizr/blob/v2-master/api/classes/organizr.class.php#L2413) --- ## Integrate with Coder ## What is Coder? > Coder is an open-source platform that provides browser-based cloud development environments, enabling developers and teams to securely write, edit, and manage code remotely without the need for local setup. > > \-- [https://coder.com](https://coder.com) ## Preparation The following placeholders are used in this guide: - `coder.company` is the FQDN of your Coder installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Coder with authentik, you need to create an application/provider pair in authentik. In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://coder.company/api/v2/users/oidc/callback`. - Select any available signing key. - Under **Advanced protocol settings**, add the `authentik default OAuth Mapping: OpenID 'offline_access'` scope. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Coder configuration To support the integration of Coder with authentik, add the following environment variables to your Coder deployment. Set `CODER_OIDC_EMAIL_DOMAIN` to one or more comma-separated email domains that are allowed to use Coder. ```env title=".env" CODER_OIDC_ISSUER_URL="https://authentik.company/application/o//" CODER_OIDC_EMAIL_DOMAIN="acme.company,acme-corp.company" CODER_OIDC_CLIENT_ID="" CODER_OIDC_CLIENT_SECRET="" CODER_OIDC_SCOPES="openid,profile,email,offline_access" CODER_OIDC_SIGN_IN_TEXT="Log in with authentik" CODER_OIDC_ICON_URL="https://authentik.company/static/dist/assets/icons/icon.svg" ``` Restart Coder after changing these settings. ## Configuration verification To confirm that authentik is properly configured with Coder, log out of Coder and log back in by clicking **Log in with authentik**. ## Resources - [Coder OIDC authentication documentation](https://coder.com/docs/admin/users/oidc-auth/) - [Coder OIDC refresh token documentation](https://coder.com/docs/admin/users/oidc-auth/refresh-tokens) --- ## Integrate with Convex ## What is Convex? > Convex provides backend building blocks for applications, including TypeScript server functions, realtime data updates, authentication, and a database. > > \-- [https://www.convex.dev/](https://www.convex.dev/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `example.company` is the email domain that you verify in Convex. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Single Sign-On is only available on Convex Business and Enterprise. Convex also requires domain verification before SSO can be configured. Domain verification is outside the scope of this integration guide. ## authentik configuration To support the integration of Convex with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** and **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created. 2. Under **Related objects** > **Download signing certificate**, click **Download**. This certificate file is required in the Convex SSO setup flow. ## Convex configuration 1. Log in to the [Convex dashboard](https://dashboard.convex.dev/) as a team administrator. 2. On the project list page, click **Team Settings**. 3. Select the **Single Sign-On** tab. 4. Click **Enable SSO**. 5. Click **Manage Domains** and complete the domain verification flow for `example.company`. 6. Return to the Convex **Single Sign-On** settings page and click **Manage SSO Configuration**. 7. Follow the Convex SSO configuration wizard until Convex shows the service provider values. Copy these values because they are required in the next section: - **ACS URL** - **SP Entity ID** or **Audience** 8. When Convex asks for identity provider details, set the following values: - **Identity Provider SSO URL**: `https://authentik.company/application/saml//` - **Identity Provider Entity ID**: `https://authentik.company/application/saml//metadata/` - **Public certificate**: upload or paste the signing certificate that you downloaded from authentik. 9. Keep the Convex setup flow open. ## Configure the remaining information in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the provider that you created earlier. 3. Under **Protocol settings**, set the following values: - **ACS URL**: the **ACS URL** value from Convex. - **Audience**: the **SP Entity ID** or **Audience** value from Convex. 4. Click **Update** to save the provider. ## Enable SSO in Convex 1. Return to the Convex SSO configuration wizard and finish the SSO setup. 2. To require SSO for all members of the Convex team, return to the **Single Sign-On** settings page and enable **Require SSO**. ## Configuration verification To confirm that authentik is properly configured with Convex, log out of Convex and sign in with an email address from the verified SSO domain. You should be redirected to authentik and, after authenticating, returned to Convex. ## Resources - [Convex Docs - Single Sign-On (SSO)](https://docs.convex.dev/team-management/sso) --- ## Integrate with Cursor ## What is Cursor? > Cursor is an AI coding agent and code editor built to help developers write, edit, and understand code. > > \-- [https://cursor.com](https://cursor.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `example.company` is the email domain that you verify in Cursor. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Cursor SSO requires a Cursor Team or Enterprise plan and admin access to the Cursor organization. Cursor also requires domain verification for the email domains that use SSO; domain verification is outside the scope of this integration guide. ## authentik configuration To support the integration of Cursor with authentik, you need to create SAML property mappings and an application/provider pair. ### Create property mappings Create SAML property mappings for the attributes that Cursor expects from the identity provider. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create the following **SAML Provider Property Mapping** entries: - **ID mapping:** - **Name**: choose a descriptive name. - **SAML Attribute Name**: `id` - **Friendly Name**: leave blank. - **Expression**: ```python return str(request.user.uuid) ``` - **Email mapping:** - **Name**: choose a descriptive name. - **SAML Attribute Name**: `email` - **Friendly Name**: leave blank. - **Expression**: ```python return request.user.email ``` - **First name mapping:** - **Name**: choose a descriptive name. - **SAML Attribute Name**: `firstName` - **Friendly Name**: leave blank. - **Expression**: ```python return request.user.name.split(" ", 1)[0] if request.user.name else request.user.username ``` - **Last name mapping:** - **Name**: choose a descriptive name. - **SAML Attribute Name**: `lastName` - **Friendly Name**: leave blank. - **Expression**: ```python return request.user.name.rsplit(" ", 1)[-1] if " " in request.user.name else " " ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** and **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Add the property mappings that you created earlier. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Copy the metadata URL 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created. 2. Under **Related objects** > **Metadata**, click **Copy download URL**. This metadata URL is required in the Cursor setup flow. ## Cursor configuration 1. Log in to the [Cursor dashboard settings](https://www.cursor.com/dashboard/settings) as an organization administrator. 2. Find and expand the **Single Sign-On (SSO)** section. 3. Click **SSO Provider Connection settings** and follow the setup wizard. 4. Create a new SAML connection and copy the following Cursor service provider values. These values are required in the next section: - **ACS URL** - **SP Entity ID** 5. When Cursor asks for identity provider information, use the authentik metadata URL that you copied earlier. 6. Configure the SAML attributes as follows: - `id` to the user ID field. - `email` to the email field. - `firstName` to the first name field. - `lastName` to the last name field. 7. Keep the Cursor setup flow open. ### Update the authentik provider 1. Return to the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the SAML provider that you created earlier. 3. Under **Protocol settings**, set the following values: - **ACS URL**: set to the **ACS URL** value from Cursor. - **Audience**: set to the **SP Entity ID** value from Cursor. 4. Click **Update** to save the provider. ### Test and enable SSO 1. Return to the Cursor setup flow. 2. Run the SSO test. Cursor should redirect you to authentik for authentication and then back to Cursor. 3. After the test succeeds, complete the setup flow. 4. Verify `example.company` from the Cursor **Domain verification settings** page if you have not already done so. 5. Configure SSO enforcement from the Cursor admin dashboard. ## Configuration verification To confirm that authentik is properly configured with Cursor, log out of Cursor and sign in with an email address from the verified SSO domain. You should be redirected to authentik and, after authenticating, returned to Cursor. ## Resources - [Cursor Docs - SSO](https://cursor.com/docs/account/teams/sso) - [WorkOS Docs - SAML](https://workos.com/docs/integrations/saml) - [WorkOS Docs - Just-In-Time User Provisioning](https://workos.com/docs/sso/jit-provisioning) --- ## Integrate with engomo ## What is engomo? > engomo is a low-code app development platform to create enterprise apps for smartphones and tablets based on Android, iOS, or iPadOS. > > \-- [https://engomo.com/](https://engomo.com/) This guide explains how to set up engomo to use authentik as the OpenID Connect (OIDC) provider for application login on smartphones and tablets, and for login to the Composer admin web GUI. ## Preparation The following placeholders are used in this guide: - `engomo.company` is the FQDN of the engomo installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of engomo with authentik, you need to create an application/provider pair in authentik. ### Create property mappings 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **Scope Mapping** with the following settings: - **Name**: Set an appropriate name. - **Scope Name**: `profile` - **Description**: Set an appropriate description, if desired. - **Expression**: `return {"preferred_username": request.user.email}` ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://engomo.company/auth` and `com.engomo.engomo://callback/`. - Select any available signing key. - Under **Advanced protocol settings** > **Selected Scopes**, add the scope that you created earlier. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## engomo configuration ### Add the authentication method 1. Open `https://engomo.company/composer` and log in with your administrator credentials. 2. Select **Server**. 3. Select **Authentication**. 4. Click the plus icon to add a new authentication method. 5. Set **Name** to `authentik`. 6. Set **Type** to **OpenID Connect**. 7. Click **Create**. 8. Configure the following values using information from the authentik provider: - **Issuer**: `https://authentik.company/application/o//` - **Client ID**: Client ID from authentik - **Client Secret**: Client Secret from authentik 9. Click **Save**. ### Create users engomo does not automatically create users during OIDC sign-in. Create each user in engomo before they sign in with authentik. 1. Open `https://engomo.company/composer` and log in with your administrator credentials. 2. Select **Users & Devices**. 3. In the **Users** section, click the plus icon. 4. From the **Authenticator** dropdown, select `authentik`. 5. Create the user with their email address as the username. This email address must match the user's email address in authentik. The created user can access only the app or Composer page permissions that they have been granted in engomo. ## Configuration verification To confirm that authentik is properly configured with engomo, open engomo, enter the email address for the user that you created, and click the arrow icon to log in. You should be redirected to authentik and returned to engomo after authentication. ## Resources - [Authelia Integration - engomo OpenID Connect 1.0](https://www.authelia.com/integration/openid-connect/clients/engomo/) --- ## Integrate with Forgejo ## What is Forgejo? > Forgejo is a lightweight, self-hosted alternative to GitHub/GitLab, with a strong emphasis on community governance and open development. > > \-- [https://forgejo.org/](https://forgejo.org/) ## Preparation The following placeholders are used in this guide: - `forgejo.company` is the FQDN of the Forgejo installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Forgejo with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://forgejo.company/user/oauth2/authentik/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Forgejo configuration 1. Log in to Forgejo as an administrator, then click your profile icon in the top-right corner and select **Site Administration**. 2. Select the **Authentication Sources** tab and then click on **Add Authentication Source**. 3. Set the following required configurations: - **Authentication Name**: `authentik`. This value must match the name used in the **Redirect URI** in the previous section. - **OAuth2 Provider**: select **OpenID Connect**. - **Client ID (Key)**: enter the **Client ID** from authentik. - **Client Secret**: enter the **Client Secret** from authentik. - **Icon URL**: `https://authentik.company/static/dist/assets/icons/icon.png` - **OpenID Connect Auto Discovery URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Additional Scopes**: `email profile` 4. Click **Add Authentication Source**. ### Enable automatic user registration *(optional)* If Forgejo should create user accounts after a successful authentik login, enable OAuth2 auto-registration in the Forgejo configuration: ```ini title="app.ini" [oauth2_client] ENABLE_AUTO_REGISTRATION = true ``` Restart Forgejo after changing its configuration file. ### Configure permissions *(optional)* Optionally, application entitlements and property mappings can be created to manage user permissions in Forgejo. #### Create application entitlements The following application entitlements will be created: - `gituser`: normal Forgejo users. - `gitadmin`: Forgejo users with administrative permissions. - `gitrestricted`: restricted Forgejo users. Users who are not assigned any of these entitlements will be denied login access. Users assigned the `gitadmin` entitlement will have full administrative privileges, while users assigned the `gitrestricted` entitlement will have limited access. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and open the Forgejo application. 3. Click the **Application entitlements** tab. 4. Click **New Entitlement**, set the name to `gituser`, and then click **Create**. 5. Repeat step 4 to create two additional entitlements named `gitadmin` and `gitrestricted`. 6. Open an entitlement and bind the users or groups that need Forgejo access to it. 7. Repeat step 6 for the two additional entitlements. #### Create custom property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **Scope Mapping** with the following configurations: - **Name**: Choose a descriptive name (e.g. `authentik forgejo OAuth Mapping: OpenID 'forgejo'`) - **Scope name**: `forgejo` - **Expression**: ```python showLineNumbers entitlement_names = { entitlement.name for entitlement in request.user.app_entitlements(provider.application) } forgejo_claims = {} if "gituser" in entitlement_names: forgejo_claims["forgejo"] = "user" if "gitadmin" in entitlement_names: forgejo_claims["forgejo"] = "admin" if "gitrestricted" in entitlement_names: forgejo_claims["forgejo"] = "restricted" return forgejo_claims ``` 3. Click **Finish**. #### Add the custom property mapping to the provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the **Edit** icon of the Forgejo provider. 3. Under **Advanced protocol settings** > **Scopes**, add the following scope to **Selected Scopes**: - `authentik forgejo OAuth Mapping: OpenID 'forgejo'` 4. Click **Update**. #### Configure Forgejo to use the new claims 1. Log in to Forgejo as an administrator. Click your profile icon in the top-right corner, and then click **Site Administration**. 2. Select the **Authentication Sources** tab and edit the **authentik** Authentication Source. 3. Set the following configurations: - **Additional Scopes**: `email profile forgejo` - **Required Claim Name**: `forgejo` - **Claim name providing group names for this source. (Optional)**: `forgejo` - **Group Claim value for administrator users. (Optional - requires claim name above)**: `admin` - **Group Claim value for restricted users. (Optional - requires claim name above)**: `restricted` 4. Click **Update Authentication Source**. ## Configuration verification To confirm that authentik is properly configured with Forgejo, open Forgejo and sign in using the **Sign in with authentik** button. ## Resources - [Forgejo documentation - Configuration Cheat Sheet: OAuth2 Client](https://forgejo.org/docs/latest/admin/config-cheat-sheet/#oauth2-client-oauth2_client) - [Forgejo source - OpenID Connect provider](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/services/auth/source/oauth2/providers_openid.go) - [Forgejo source - OAuth2 callback handling](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/routers/web/auth/oauth.go) --- ## Integrate with Frappe/ERPNext ## What is Frappe? > Frappe is a full stack, batteries-included, web framework written in Python and JavaScript. > > \-- [https://frappe.io/](https://frappe.io/) ## Preparation The following placeholders are used in this guide: - `frappe.company` is the FQDN of the Frappe installation. - `authentik.company` is the FQDN of the authentik installation. These instructions apply to Frappe Framework apps that use Social Login Key, including ERPNext. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Frappe with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://frappe.company/api/method/frappe.integrations.oauth2_logins.custom/authentik`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Frappe configuration 1. Log in to Frappe as an administrator. 2. From the Frappe main menu, navigate to **Integrations** and select **Social Login Key**. 3. Click **+ New**. 4. Configure the following settings: - **Client Credentials** - **Enable Social Login**: enable this option. - **Provider Name**: `authentik`. - **Client ID**: Client ID from authentik. - **Client Secret**: Client Secret from authentik. - **Configuration** - **Sign ups**: `Allow`. - **Identity Details** - **Base URL**: `https://authentik.company` - **Client URLs** - **Authorize URL**: `/application/o/authorize/` - **Access Token URL**: `/application/o/token/` - **Redirect URL**: `/api/method/frappe.integrations.oauth2_logins.custom/authentik` - **API Endpoint**: `/application/o/userinfo/` - **Client Information** - **Auth URL Data**: ```json { "response_type": "code", "scope": "openid email profile" } ``` 5. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with Frappe, log out of Frappe and click the login button for your configured provider. A successful login should redirect you to authentik and return you to Frappe after authentication. ## Resources - [Frappe Docs - Adding Social Login Provider](https://docs.frappe.io/framework/user/en/guides/app-development/adding-social-login-provider) - [Frappe Docs - How To Enable Social Logins](https://docs.frappe.io/framework/user/en/guides/deployment/how-to-enable-social-logins) - [Frappe Docs - OpenID Connect and Frappe social login](https://docs.frappe.io/framework/user/en/guides/integration/openid_connect_and_frappe_social_login) --- ## Integrate with GitHub Enterprise Cloud ## What is GitHub Enterprise Cloud? > GitHub Enterprise Cloud is the cloud-based solution of GitHub Enterprise, hosted on GitHub's servers. > > \-- [https://github.com/enterprise](https://github.com/enterprise) This guide configures SAML SSO for an organization on GitHub Enterprise Cloud. For GitHub Enterprise Cloud with Enterprise Managed Users, see the [GitHub Enterprise EMU](../ghec-emu/) integration guide. ## Preparation The following placeholders are used in this guide: - `github.com/orgs/foo` is your GitHub organization, where `foo` is the name of your organization. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of GitHub Enterprise Cloud with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://github.com/orgs/foo/saml/consume`. - Set the **Audience** to `https://github.com/orgs/foo`. - Under **Advanced protocol settings**: - Select an available **Signing certificate**. Download this certificate because it is required later. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Username`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## GitHub Enterprise Cloud configuration 1. Log in to GitHub as an organization owner. 2. Navigate to your organization at `https://github.com/foo`. 3. Click **Settings**. 4. In the left sidebar, under **Security**, click **Authentication security**. 5. Under **SAML single sign-on**, select **Enable SAML authentication**. 6. Configure the following settings: - **Sign on URL**: enter the **SAML Endpoint** from the SAML provider that you created in authentik. - **Issuer**: `https://authentik.company/application/saml//metadata/`. - **Public certificate**: paste the full signing certificate that you downloaded from authentik. - **Signature method** and **Digest method**: select the methods that match the authentik SAML provider settings. 7. Click **Test SAML configuration**. 8. After the test succeeds, click **Save**. 9. Download and store the SAML recovery codes. This enables SAML as an authentication option. To require SAML for all organization members, authenticate with SAML at least once, prepare the organization for enforcement, then return to **Authentication security** and select **Require SAML SSO authentication for all members of the foo organization**. When you enforce SAML SSO, GitHub removes organization members and administrators who have not authenticated through the IdP. ## Configuration verification To confirm that authentik is properly configured with GitHub Enterprise Cloud, log out of GitHub and then access a resource in the organization. GitHub should prompt you to authenticate with SAML through authentik. ## Resources - [GitHub Enterprise Cloud: enabling and testing SAML single sign-on for your organization](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-saml-single-sign-on-for-your-organization/enabling-and-testing-saml-single-sign-on-for-your-organization) - [GitHub Enterprise Cloud: SAML configuration reference](https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/iam-configuration-reference/saml-configuration-reference) - [GitHub Enterprise Cloud: enforcing SAML single sign-on for your organization](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-saml-single-sign-on-for-your-organization/enforcing-saml-single-sign-on-for-your-organization) --- ## Integrate with GitHub Enterprise Managed Users ## What is GitHub Enterprise Managed Users? > GitHub Enterprise Managed Users lets organizations manage access to GitHub Enterprise Cloud with user accounts that are provisioned and authenticated from an external identity provider. > > \-- [https://github.com/enterprise](https://github.com/enterprise) This guide configures authentik as the SAML identity provider and SCIM provider for GitHub Enterprise Cloud with Enterprise Managed Users (EMU). It applies to EMU enterprises hosted on GitHub.com and EMU enterprises with data residency on GHE.com. ## Preparation The following placeholders are used in this guide: - `github.com/enterprises/foo` is your GitHub.com EMU enterprise, where `foo` is the name of your enterprise. - `foo.ghe.com` is your GHE.com EMU enterprise, where `foo` is your enterprise subdomain. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This guide uses two application entitlements: `GitHub Users` for standard GitHub users and `GitHub Admins` for GitHub enterprise administrators. SCIM must be configured for this integration. GitHub matches the SAML identity to the SCIM identity by comparing the SAML `NameID` value with the SCIM `userName` value, and users must be provisioned by SCIM before they can sign in with SAML. The mappings below use the `github_emu_username` user attribute when it exists and fall back to the authentik username. Use the values for your EMU deployment when configuring authentik: | Setting | Value | | ------------ | ------------------------------------------------- | | **ACS URL** | `https://github.com/enterprises/foo/saml/consume` | | **Audience** | `https://github.com/enterprises/foo` | | **SCIM URL** | `https://api.github.com/scim/v2/enterprises/foo` | | Setting | Value | | ------------ | -------------------------------------------------- | | **ACS URL** | `https://foo.ghe.com/enterprises/foo/saml/consume` | | **Audience** | `https://foo.ghe.com/enterprises/foo` | | **SCIM URL** | `https://api.foo.ghe.com/scim/v2/enterprises/foo` | ## authentik configuration To support the integration of GitHub Enterprise EMU with authentik, you need to create property mappings, an application/provider pair, application entitlements, and a SCIM provider. ### Create property mappings 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings**. 3. Create the following **SAML Provider Property Mapping**s. For each mapping, click **Create**, select **SAML Provider Property Mapping**, click **Next**, and configure the following settings: - **Name**: `GitHub EMU username` - **SAML Attribute Name**: `http://schemas.goauthentik.io/2021/02/saml/username` - **Expression**: ```python return request.user.attributes.get("github_emu_username", request.user.username) ``` - **Name**: `GitHub EMU full name` - **SAML Attribute Name**: `full_name` - **Expression**: ```python return request.user.name ``` - **Name**: `GitHub EMU emails` - **SAML Attribute Name**: `emails` - **Expression**: ```python if request.user.email: yield request.user.email ``` 4. Click **Create**, select **SCIM Provider Mapping**, click **Next**, and configure the following settings: - **Name**: `GitHub EMU user` - **Expression**: The supported `roles` values are documented in [GitHub Enterprise Cloud's SCIM API documentation](https://docs.github.com/en/enterprise-cloud@latest/rest/enterprise-admin/scim#provision-a-scim-enterprise-user). ```python username = request.user.attributes.get("github_emu_username", request.user.username) formatted = request.user.name or username given_name = formatted family_name = " " if " " in formatted: given_name, _, family_name = formatted.partition(" ") emails = [] if request.user.email: emails.append( { "value": request.user.email, "type": "work", "primary": True, } ) entitlement_names = { entitlement.name for entitlement in request.user.app_entitlements(provider.application) } roles = [] if "GitHub Admins" in entitlement_names: roles.append({"value": "enterprise_owner", "primary": True}) elif "GitHub Users" in entitlement_names: roles.append({"value": "user", "primary": True}) return { "userName": username, "externalId": str(request.user.uid), "name": { "formatted": formatted, "givenName": given_name, "familyName": family_name, }, "displayName": formatted, "active": request.user.is_active, "emails": emails, "roles": roles, } ``` ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug**, because it is required later for the GitHub issuer URL. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to the ACS URL for your EMU deployment. - Set **Audience** to the audience value for your EMU deployment. - Under **Advanced protocol settings**: - Add the `GitHub EMU full name` and `GitHub EMU emails` property mappings. - Set **NameID Property Mapping** to `GitHub EMU username`. - Set **Default NameID Policy** to `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`. - Select an available **Signing certificate**. Download this certificate because it is required later. - Enable **Sign assertions** and **Sign responses**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. If you add the SCIM provider as a backchannel provider later, only users who can view this application are synchronized. 3. Click **Submit** to save the new application and provider. ### Create application entitlements 1. In the authentik Admin interface, open the GitHub EMU application that you created. 2. Click the **Application entitlements** tab. 3. Create two entitlements named `GitHub Users` and `GitHub Admins`. 4. Open each entitlement and bind the users or groups that should receive it. ## GitHub configuration When GitHub provisions your managed enterprise, GitHub sends an email inviting you to set the password for the setup user. The setup user has the username `_admin`, cannot be linked with SSO, and is the emergency account that can bypass SSO requirements. ### Create the SCIM token 1. Log in as the setup user. 2. Navigate to the personal access tokens page: - GitHub.com: `https://github.com/settings/tokens` - GHE.com: `https://foo.ghe.com/settings/tokens` 3. Generate a new classic personal access token with the `scim:enterprise` scope and no expiration. 4. Copy the token. This value is used in the authentik SCIM provider. ### Configure SAML in GitHub 1. Log in as the setup user. 2. Navigate to your enterprise. 3. Click **Identity provider**. 4. Under **Identity Provider**, click **Single sign-on configuration**. 5. Under **Open SCIM Configuration**, select **Enable open SCIM configuration**. 6. Under **SAML single sign-on**, select **Add SAML configuration**. 7. Configure the following settings: - **Sign on URL**: enter the **SAML Endpoint** from the SAML provider that you created in authentik. - **Issuer**: `https://authentik.company/application/saml//metadata/`. - **Public certificate**: paste the full signing certificate that you downloaded from authentik. - **Signature method** and **Digest method**: select the methods that match the authentik SAML provider settings. 8. Click **Test SAML configuration**. 9. After the test succeeds, click **Save SAML settings**. 10. Save the SAML recovery codes that GitHub provides. ![Screenshot showing populated GitHub Enterprise Cloud EMU SAML settings](ghec_emu_settings.png) ### Create a SCIM provider in authentik 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click **Create**. 2. Select **SCIM Provider** as the provider type and click **Next**. 3. Configure the following settings: - **Name**: provide a descriptive name. - **URL**: enter the SCIM URL for your EMU deployment. - **Token**: paste the GitHub personal access token that you created earlier. - **User Property Mappings**: remove `authentik default SCIM Mapping: User`, then add the `GitHub EMU user` mapping that you created earlier. - **Group Property Mappings**: if you do not want authentik to synchronize groups to GitHub, remove `authentik default SCIM Mapping: Group`. To synchronize selected authentik groups to GitHub, keep `authentik default SCIM Mapping: Group` selected and add those groups to **Group Filter**. 4. Click **Finish**. 5. Navigate to **Applications** > **Applications** and open the GitHub EMU application. 6. Add the SCIM provider to **Backchannel Providers**. 7. Click **Update**. ## Configuration verification To confirm that authentik is properly configured with GitHub Enterprise EMU, assign a test user to the `GitHub Users` entitlement and ensure that the user can view the application in authentik. Open the SCIM provider and click **Run sync again**. After the sync completes, confirm that the user is provisioned in GitHub. Then, log in to GitHub as the test user and confirm that GitHub redirects the user to authentik for SAML authentication. ## Resources - [GitHub Enterprise Cloud: configuring SAML single sign-on for Enterprise Managed Users](https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/configuring-authentication-for-enterprise-managed-users/configuring-saml-single-sign-on-for-enterprise-managed-users) - [GitHub Enterprise Cloud: configuring SCIM provisioning for Enterprise Managed Users](https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users) - [GitHub Enterprise Cloud: SAML configuration reference](https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/iam-configuration-reference/saml-configuration-reference) - [GitHub Enterprise Cloud: REST API endpoints for SCIM](https://docs.github.com/en/enterprise-cloud@latest/rest/enterprise-admin/scim) --- ## Integrate with GitHub Enterprise Server ## What is GitHub Enterprise Server? > GitHub Enterprise Server is the self-hosted version of GitHub Enterprise. It is installed on-premises or on a private cloud and provides organizations with a secure and customizable source code management and collaboration platform. > > \-- [https://github.com/enterprise](https://github.com/enterprise) ## Preparation The following placeholders are used in this guide: - `github.company` is the FQDN of your GitHub Enterprise Server installation. - `authentik.company` is the FQDN of the authentik installation. - `GitHub Users` is an application entitlement used for standard GitHub Enterprise Server users. - `GitHub Admins` is an application entitlement used for GitHub Enterprise Server administrators. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of GitHub Enterprise Server with authentik, you need to create an application/provider pair in authentik. If you want to use SCIM provisioning, you also need to create application entitlements and a SCIM property mapping. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug**, because it is required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to `https://github.company/saml/consume`. - Set **Audience** to `https://github.company`. - Under **Advanced protocol settings**: - Select an available **Signing certificate**. Download this certificate because it is required later. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Username`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. If you add the SCIM provider as a backchannel provider later, only users who can view this application are synchronized. 3. Click **Submit** to save the new application and provider. ### Create application entitlements *(optional)* Create application entitlements if you want authentik to provision GitHub Enterprise Server user roles with SCIM. 1. In the authentik Admin interface, open the GitHub Enterprise Server application that you created. 2. Click the **Application entitlements** tab. 3. Create two entitlements named `GitHub Users` and `GitHub Admins`. 4. Open each entitlement and bind the users or groups that should receive it. ### Create a SCIM property mapping *(optional)* 1. In the authentik Admin interface, navigate to **Customization** > **Property Mappings** and click **Create**. 2. Select **SCIM Provider Mapping** and click **Next**. 3. Create a mapping for GitHub roles: - **Name**: `GitHub roles` - **Expression**: The supported `roles` values are documented in [GitHub Enterprise Server's SCIM API documentation](https://docs.github.com/en/enterprise-server@latest/rest/enterprise-admin/scim#provision-a-scim-enterprise-user). ```python entitlement_names = { entitlement.name for entitlement in request.user.app_entitlements(provider.application) } roles = [] if "GitHub Admins" in entitlement_names: roles.append({"value": "enterprise_owner", "primary": True}) elif "GitHub Users" in entitlement_names: roles.append({"value": "user", "primary": True}) return { "roles": roles, } ``` 4. Click **Finish**. ## GitHub Enterprise Server configuration ### Create the SCIM token *(optional)* Complete this section if you want to use SCIM provisioning. 1. Create or use a built-in enterprise owner account that is not managed through SCIM. GitHub recommends the username `scim-admin`. 2. Log in to GitHub Enterprise Server with the built-in setup user. 3. Navigate to `https://github.company/settings/tokens`. 4. Generate a new classic personal access token with the `scim:enterprise` scope and no expiration. 5. Copy the token. This value is used in the authentik SCIM provider. ### Configure SAML 1. Navigate to the GitHub Enterprise Server Management Console at `https://github.company:8443`. 2. Sign in as an administrator. 3. Go to **Authentication**. 4. Configure the following settings: - Select **SAML**. - **Single sign-on URL**: enter the **SAML Endpoint** from the SAML provider that you created in authentik. - **Issuer**: `https://authentik.company/application/saml//metadata/`. - **Signature method** and **Digest method**: select the methods that match the authentik SAML provider settings. - **Verification certificate**: upload the signing certificate that you downloaded from authentik. - If you plan to use SCIM, select **Allow creation of accounts with built-in authentication** and **Disable administrator demotion/promotion**. - In the **User attributes** section, do not configure a different username attribute unless it returns the same value as the SCIM `userName` attribute. 5. Click **Save settings** and wait for the changes to apply. ![Screenshot showing populated GitHub Enterprise Server SAML settings](ghes_saml_settings.png) ### Enable SCIM *(optional)* Complete this section if you want to use SCIM provisioning. 1. Log in to GitHub Enterprise Server with the built-in setup user. 2. In the upper-right corner, click your profile picture, then click **Enterprise settings**. 3. Click **Settings** > **Authentication security**. 4. Select **Enable SCIM configuration**. 5. Click **Save**. ### Create a SCIM provider *(optional)* 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click **Create**. 2. Select **SCIM Provider** as the provider type and click **Next**. 3. Configure the following settings: - **Name**: provide a descriptive name. - **URL**: `https://github.company/api/v3/scim/v2` - **Token**: paste the GitHub personal access token that you created earlier. - **User Property Mappings**: keep `authentik default SCIM Mapping: User` selected, then add the `GitHub roles` mapping that you created earlier. - **Group Property Mappings**: keep `authentik default SCIM Mapping: Group` selected. 4. Click **Finish**. 5. Navigate to **Applications** > **Applications** and open the GitHub Enterprise Server application. 6. Add the SCIM provider to **Backchannel Providers**. 7. Click **Update**. ### Update GitHub Enterprise Server settings *(optional)* Complete this section after SCIM sync is working if you use SCIM provisioning. 1. Navigate to the GitHub Enterprise Server Management Console at `https://github.company:8443`. 2. Sign in as an administrator. 3. Go to **Authentication**. 4. Clear **Disable administrator demotion/promotion**. 5. If you want all users to be provisioned from authentik, clear **Allow creation of accounts with built-in authentication**. 6. Click **Save settings** and wait for the changes to apply. ## Configuration verification To confirm that authentik is properly configured with GitHub Enterprise Server, log out of GitHub Enterprise Server and open GitHub Enterprise Server. It should redirect you to authentik for SAML authentication. If you configured SCIM provisioning, assign a test user to the `GitHub Users` entitlement and ensure that the user can view the application in authentik. Open the SCIM provider and click **Run sync again**. After the sync completes, confirm that the user is provisioned in GitHub Enterprise Server. ## Resources - [GitHub Enterprise Server: configuring SAML single sign-on for your enterprise](https://docs.github.com/en/enterprise-server@latest/admin/managing-iam/using-saml-for-enterprise-iam/configuring-saml-single-sign-on-for-your-enterprise) - [GitHub Enterprise Server: configuring SCIM provisioning to manage users](https://docs.github.com/en/enterprise-server@latest/admin/managing-iam/provisioning-user-accounts-with-scim/configuring-scim-provisioning-for-users) - [GitHub Enterprise Server: REST API endpoints for SCIM](https://docs.github.com/en/enterprise-server@latest/rest/enterprise-admin/scim) --- ## Integrate with Gitea ## What is Gitea? > Gitea is a community managed lightweight code hosting solution written in Go. It is published under the MIT license. > > \-- [https://gitea.io/](https://gitea.io/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `gitea.company` is the FQDN of the Gitea installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Gitea with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://gitea.company/user/oauth2/authentik/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure authorization claims *(optional)* You can use application entitlements and a custom property mapping to let Gitea assign administrator permissions, restricted-user status, and organization team membership from authentik. Create the authorization claim only if Gitea should manage those permissions from authentik. Users who do not receive any of the entitlements in this section will be denied access after you configure Gitea to require the claim. #### Create entitlements Create the following application entitlements: - `gituser`: normal Gitea users. - `gitadmin`: Gitea users with administrative permissions. - `gitrestricted`: restricted Gitea users. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and open the Gitea application. 3. Click the **Application entitlements** tab. 4. Click **Create entitlement**, set the name to `gituser`, and then click **Create**. 5. Repeat step 4 to create two additional entitlements named `gitadmin` and `gitrestricted`. 6. Open an entitlement and bind the users or groups that need Gitea access to it. 7. Repeat step 6 for the two additional entitlements. #### Create custom property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **Scope Mapping** with the following configurations: - **Name**: `authentik gitea OAuth Mapping: OpenID 'gitea'` - **Scope name**: `gitea` - **Expression**: ```python showLineNumbers entitlement_names = { entitlement.name for entitlement in request.user.app_entitlements(provider.application) } gitea_claims = {} groups = [] if "gituser" in entitlement_names: groups.append("user") if "gitadmin" in entitlement_names: groups.append("admin") if "gitrestricted" in entitlement_names: groups.append("restricted") if groups: gitea_claims["gitea"] = groups return gitea_claims ``` 3. Click **Finish**. #### Add the mapping to the provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon of the Gitea provider. 3. Under **Advanced protocol settings** > **Scopes**, add the `authentik gitea OAuth Mapping: OpenID 'gitea'` scope mapping that you created in the previous section to **Selected Scopes**. 4. Click **Update**. ## Gitea configuration 1. Log in to Gitea as an administrator, then click your profile icon in the top-right corner and select **Site Administration**. 2. Select the **Authentication Sources** tab and then click **Add Authentication Source**. 3. Set the following required configurations: - **Authentication Name**: `authentik`. This value is part of the callback URL, so it must match the value used in the authentik **Redirect URI**. - **OAuth2 Provider**: `OpenID Connect` - **Client ID (Key)**: enter the **Client ID** from authentik. - **Client Secret**: enter the **Client Secret** from authentik. - **Icon URL**: `https://authentik.company/static/dist/assets/icons/icon.png` - **OpenID Connect Auto Discovery URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Additional Scopes**: `email profile` 4. Click **Add Authentication Source**. ### Evaluate authorization claims *(optional)* If you created the authorization claim in authentik, configure Gitea to request and evaluate it. 1. In Gitea, return to **Site Administration** > **Authentication Sources** and edit the **authentik** authentication source. 2. Set **Additional Scopes** to `email profile gitea`. 3. Set **Required Claim Name** to `gitea`. 4. To use the same claim for Gitea permissions and team membership, set the following values: - **Claim name providing group names for this source.**: `gitea` - **Group Claim value for administrator users.**: `admin` - **Group Claim value for restricted users.**: `restricted` - **Map claimed groups to Organization teams.**: `{"admin":{"Acme":["Owners"]}}` 5. Click **Update Authentication Source**. The organization team mapping example adds users with the `gitadmin` entitlement to the `Owners` team in the `Acme` organization. Replace `Acme` and `Owners` with the Gitea organization and team names that should receive synchronized users. The organization and team must already exist in Gitea. ### Configure the Helm chart *(optional)* authentik authentication can be configured automatically in Kubernetes deployments using the Gitea Helm chart. Add the following to your Gitea Helm chart `values.yaml` file: ```yaml showLineNumbers title="values.yaml" gitea: oauth: - name: "authentik" provider: "openidConnect" key: "" secret: "" autoDiscoverUrl: "https://authentik.company/application/o//.well-known/openid-configuration" iconUrl: "https://authentik.company/static/dist/assets/icons/icon.png" scopes: "email profile" ``` ### Use a Kubernetes secret *(optional)* You can use a Kubernetes secret to store and manage the sensitive `key` and `secret` values. 1. Create a Kubernetes secret with the following variables: ```yaml showLineNumbers apiVersion: v1 kind: Secret metadata: name: gitea-authentik-secret type: Opaque stringData: key: "" secret: "" ``` 2. Add the following configurations to your Gitea Helm chart `values.yaml` file: ```yaml showLineNumbers title="values.yaml" gitea: oauth: - name: "authentik" provider: "openidConnect" existingSecret: gitea-authentik-secret autoDiscoverUrl: "https://authentik.company/application/o//.well-known/openid-configuration" iconUrl: "https://authentik.company/static/dist/assets/icons/icon.png" scopes: "email profile" ``` ## Configuration verification To confirm that authentik is properly configured with Gitea, log out of Gitea and open the Gitea integration from authentik. On the Gitea login page, click **Sign in with authentik**. ## Resources - [Gitea Docs - Configuration cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet) - [Gitea Docs - Command line admin authentication sources](https://docs.gitea.com/administration/command-line#admin) - [Gitea Helm chart - OAuth2 settings](https://gitea.com/gitea/helm-gitea/src/branch/main/README.md#oauth2-settings) --- ## Integrate with GitLab ## What is GitLab? > GitLab is a DevSecOps platform for source code management, CI/CD, issue tracking, and software delivery workflows. > > \-- [https://about.gitlab.com/](https://about.gitlab.com/) ## Preparation The following placeholders are used in this guide: - `gitlab.company` is the FQDN of the GitLab installation. - `authentik.company` is the FQDN of the authentik installation. If you enable GitLab's `omniauth_auto_sign_in_with_provider` setting later, GitLab redirects every sign-in attempt to authentik. To use GitLab built-in authentication, open `https://gitlab.company/users/sign_in?auto_sign_in=false`. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration GitLab supports single sign-on with SAML or OpenID Connect (OIDC). Choose one method and follow the matching tab in the GitLab configuration section. ## GitLab configuration Apply the GitLab configuration for the SSO method that you configured in authentik. ### Configure SAML authentication #### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to `https://gitlab.company/users/auth/saml/callback`. - Set **Audience** to `https://gitlab.company`. - Under **Advanced protocol settings**, select an available **Signing certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Navigate to **System** > **Certificates** and expand the certificate that you selected for the SAML provider. Take note of the **Certificate Fingerprint (SHA1)** because it will be required later. #### Configure GitLab Edit the GitLab configuration file and add the following configuration: ```ruby title="/etc/gitlab/gitlab.rb" gitlab_rails['omniauth_enabled'] = true gitlab_rails['omniauth_allow_single_sign_on'] = ['saml'] gitlab_rails['omniauth_sync_email_from_provider'] = 'saml' gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml'] gitlab_rails['omniauth_sync_profile_attributes'] = ['email'] gitlab_rails['omniauth_block_auto_created_users'] = false gitlab_rails['omniauth_auto_link_saml_user'] = true gitlab_rails['omniauth_providers'] = [ { name: 'saml', label: 'authentik', args: { assertion_consumer_service_url: 'https://gitlab.company/users/auth/saml/callback', idp_cert_fingerprint: '', idp_sso_target_url: 'https://authentik.company/application/saml//', issuer: 'https://gitlab.company', name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent', attribute_statements: { email: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'], name: ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'], nickname: ['http://schemas.goauthentik.io/2021/02/saml/username'] } } } ] ``` Run `gitlab-ctl reconfigure` for a Linux package installation, or restart the container after making changes. ### Configure OIDC authentication #### Create an application and provider In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Take note of the **Client ID** and **Client Secret** because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` with the value `https://gitlab.company/users/auth/openid_connect/callback`. - Select any available signing key. - Under **Advanced protocol settings**, set **Subject mode** to **Based on the User's Email**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. #### Configure GitLab Edit the GitLab configuration file and add the following configuration: ```ruby title="/etc/gitlab/gitlab.rb" gitlab_rails['omniauth_enabled'] = true gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect'] gitlab_rails['omniauth_sync_email_from_provider'] = 'openid_connect' gitlab_rails['omniauth_sync_profile_from_provider'] = ['openid_connect'] gitlab_rails['omniauth_sync_profile_attributes'] = ['email'] gitlab_rails['omniauth_block_auto_created_users'] = false gitlab_rails['omniauth_auto_link_user'] = ['openid_connect'] gitlab_rails['omniauth_providers'] = [ { name: 'openid_connect', label: 'authentik', args: { name: 'openid_connect', scope: ['openid', 'profile', 'email'], response_type: 'code', issuer: 'https://authentik.company/application/o//', discovery: true, client_auth_method: 'query', uid_field: 'preferred_username', pkce: true, client_options: { identifier: '', secret: '', redirect_uri: 'https://gitlab.company/users/auth/openid_connect/callback' } } } ] ``` Run `gitlab-ctl reconfigure` for a Linux package installation, or restart the container after making changes. ### Configure SCIM provisioning *(optional)* GitLab SCIM for self-managed instances requires GitLab Premium or Ultimate and SAML single sign-on. GitLab SCIM supports user provisioning, but not group provisioning. 1. In GitLab, open the Admin area. 2. Navigate to **Settings** > **General**. 3. Expand **SCIM Token** and click **Generate a SCIM token**. 4. Take note of the **SCIM API endpoint URL** and **Your SCIM token** values because they will be required in authentik. 5. In authentik, navigate to **Applications** > **Providers** and click **Create**. 6. Select **SCIM Provider** as the provider type and click **Next**. 7. Enter the following values: - **Name**: choose a descriptive name. - **URL**: paste the SCIM API endpoint URL from GitLab. - **Token**: paste the SCIM token from GitLab. - **Compatibility Mode**: select **GitLab**. - **Group Property Mappings**: remove all selected mappings. 8. Click **Finish** to save the provider. 9. Navigate to **Applications** > **Applications** and select your GitLab application. 10. Click **Edit**. 11. In the **Backchannel Providers** field, select the SCIM provider that you created. 12. Click **Update** to save the application. ## Configuration verification To confirm that authentik is properly configured with GitLab, open GitLab and select the authentik sign-in option. After successful authentication, you are redirected back to GitLab and signed in. ## Resources - [GitLab Docs - SAML SSO for GitLab Self-Managed](https://docs.gitlab.com/integration/saml/) - [GitLab Docs - Use OpenID Connect as an authentication provider](https://docs.gitlab.com/administration/auth/oidc/) - [GitLab Docs - Configure SCIM for GitLab Self-Managed or GitLab Dedicated](https://docs.gitlab.com/administration/settings/scim_setup/) --- ## Integrate with Gravitee ## What is Gravitee? > Gravitee is an API management platform used to secure, observe, and govern API, event, and AI agent interactions. > > \-- [https://www.gravitee.io/](https://www.gravitee.io/) ## Preparation The following placeholders are used in this guide: - `gravitee.company` is the FQDN of the Gravitee installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Gravitee with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` for each Gravitee UI that will use authentik: - Management Console: `https://gravitee.company/console/` - Developer Portal: `https://gravitee.company/user/login` - If your Developer Portal is served from a different path, use its login route instead, such as `https://gravitee.company/classic/user/login` or `https://gravitee.company/next/log-in`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Gravitee configuration 1. Log in to the Gravitee Management Console as an administrator. 2. Navigate to **Organization** > **Console** > **Authentication**. 3. Click **+ Add an identity provider**. 4. Select **OpenID Connect** as the provider type. 5. Configure the following settings: - **Name**: `authentik` - **Allow portal authentication to use this identity provider**: enable this option if Developer Portal users should be able to log in with authentik. - **Client ID**: enter the Client ID from authentik. - **Client Secret**: enter the Client Secret from authentik. - **Token Endpoint**: `https://authentik.company/application/o/token/` - **Authorize Endpoint**: `https://authentik.company/application/o/authorize/` - **UserInfo Endpoint**: `https://authentik.company/application/o/userinfo/` - **UserInfo Logout Endpoint**: `https://authentik.company/application/o//end-session/` - **Scopes**: `openid profile email` - **User profile mapping**: - **ID**: `sub` - **First name**: `given_name` - **Email**: `email` 6. Click **Create**. 7. Return to the identity provider list and enable **Activate Identity Provider** for the authentik provider. ## Configuration verification To confirm that authentik is properly configured with Gravitee, open Gravitee and click the authentik login option. Verify that you are redirected to authentik for authentication and then back to Gravitee. ## Resources - [Gravitee Documentation - OpenID Connect](https://documentation.gravitee.io/apim/configure-and-manage-the-platform/manage-organizations-and-environments/authentication/openid-connect) - [Gravitee Documentation - Configure authentication with SSO](https://documentation.gravitee.io/apim/developer-portal/new-developer-portal/configure-authentication/configure-authentication-with-sso) --- ## Integrate with Jenkins ## What is Jenkins? > The leading open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project. > > \-- [https://www.jenkins.io/](https://www.jenkins.io/) ## Preparation The following placeholders are used in this guide: - `jenkins.company` is the FQDN of the Jenkins installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Jenkins with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://jenkins.company/securityRealm/finishLogin`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://jenkins.company/OicLogout`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Jenkins configuration 1. Log in to Jenkins as an administrator. 2. Navigate to **Manage Jenkins** > **Plugins** > **Available plugins**. 3. Search for the **OpenID Connect Authentication** plugin with the ID `oic-auth`, install it, and restart Jenkins. 4. After Jenkins restarts, navigate to **Manage Jenkins** > **Security**. 5. Under **Security Realm**, select **Login with OpenID Connect**. 6. Set the following fields: - **Client id**: enter the client ID from authentik. - **Client secret**: enter the client secret from authentik. - **Configuration mode**: select **Automatic configuration**. - **Well-known configuration endpoint**: `https://authentik.company/application/o//.well-known/openid-configuration` 7. Expand the **Well-known configuration endpoint** advanced settings and set **Override scopes** to `openid profile email`. 8. In **Advanced configuration**, expand **User fields** and set the following fields: - **User name field name**: `preferred_username` - **Full name field name**: `name` - **Email field name**: `email` - **Groups field name**: `groups` 9. In **Advanced configuration**, select **Logout from OpenID Provider** and set **Post logout redirect URL** to `https://jenkins.company/OicLogout`. 10. Under **Properties**, click **Add**, select **Enable Proof Key for Code Exchange (PKCE)**, and save the Jenkins security configuration. The Jenkins OpenID Connect Authentication plugin supports an escape hatch that can restore access if the OpenID Provider is unavailable or misconfigured. Configure it before saving the Jenkins security settings if you need a local recovery credential. ## Configuration verification To confirm that authentik is properly configured with Jenkins, log out of Jenkins and open the Jenkins integration from authentik. ## Resources - [Jenkins OpenID Connect Authentication plugin](https://plugins.jenkins.io/oic-auth/) - [Jenkins OpenID Connect Authentication plugin configuration](https://github.com/jenkinsci/oic-auth-plugin/blob/master/docs/configuration/README.md) --- ## Integrate with n8n ## What is n8n? > n8n is a workflow automation platform that combines AI capabilities with business process automation. > > \-- [https://n8n.io/](https://n8n.io/) ## Preparation The following placeholders are used in this guide: - `n8n.company` is the FQDN of the n8n installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. n8n OIDC SSO requires an Enterprise plan. You also need to be an n8n instance owner or administrator to configure SSO. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of n8n with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://n8n.company/rest/sso/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure role claims *(optional)* n8n can provision instance roles and project roles from OIDC claims. Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to keep n8n-specific role assignment scoped to this application. 1. Open the n8n application that you just created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each n8n role value that authentik should send, such as `global:admin` or `global:member`. 4. To provision project roles, create entitlements in the format `:`, such as `:editor`. 5. Bind the appropriate users or groups to each entitlement. 6. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **Scope Mapping** with the following settings: - **Name**: choose a descriptive name, such as `authentik n8n OAuth Mapping: OpenID 'n8n'`. - **Scope name**: `n8n` - **Expression**: ```python showLineNumbers instance_roles = {"global:member", "global:admin", "global:chatUser"} entitlement_names = { entitlement.name for entitlement in request.user.app_entitlements(provider.application) } claims = { "n8n_instance_role": "global:member", "n8n_projects": [], } for role in instance_roles: if role in entitlement_names: claims["n8n_instance_role"] = role break claims["n8n_projects"] = sorted( name for name in entitlement_names - instance_roles if ":" in name ) return claims ``` 7. Click **Finish**. 8. Navigate to **Applications** > **Providers** and edit the n8n provider. 9. Under **Advanced protocol settings** > **Selected Scopes**, add the scope mapping that you just created. 10. Click **Update**. ## n8n configuration 1. Log in to n8n as an instance owner or administrator. 2. Navigate to **Settings** > **SSO**. 3. Under **Select Authentication Protocol**, select **OIDC**. 4. Confirm that the redirect URL shown by n8n is `https://n8n.company/rest/sso/oidc/callback`. 5. Configure the following settings: - **Discovery Endpoint**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Client ID**: Client ID from authentik - **Client Secret**: Client Secret from authentik 6. Click **Save settings**. 7. Set **OIDC** to **Activated**. If n8n is running behind a load balancer or reverse proxy and shows an internal redirect URL, set `N8N_EDITOR_BASE_URL` to the public n8n URL, then re-check the redirect URL before saving the SSO configuration. ### Enable role provisioning *(optional)* If you configured the optional `n8n` scope mapping in authentik, use n8n's SSO role assignment settings to consume those claims. When SSO role provisioning is enabled, n8n re-evaluates roles on every login and can remove access that is not reflected in the IdP response. 1. In n8n, navigate to **Settings** > **SSO**. 2. Set **Additional scopes** to `n8n`. 3. Set **Role assignment** to **Instance roles via SSO** or **Instance and project roles via SSO**. 4. Set **Role mapping method** to **Map rules on your IdP**. 5. Click **Save settings**. ## Configuration verification To confirm that authentik is properly configured with n8n, log out of n8n and sign in again using SSO. You should be redirected to authentik and returned to n8n after authentication. If you enabled role provisioning, sign in with a user that has an n8n application entitlement and verify that n8n assigned the expected instance role or project role. ## Resources - [n8n Docs - Set up OIDC](https://docs.n8n.io/user-management/oidc/setup/) - [n8n Docs - SSO environment variables](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/use-environment-variables/sso/) --- ## Integrate with NocoDB ## What is NocoDB? > NocoDB is a no-code database platform that provides a spreadsheet interface for creating applications and workflows with data from databases and other sources. > > \-- [https://nocodb.com/](https://nocodb.com/) ## Preparation The following placeholder is used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. OIDC SSO is available on NocoDB Cloud Business plans and higher, and on licensed self-hosted Business plans and higher. NocoDB Cloud also requires domain verification before you configure SSO. Domain verification is outside the scope of this guide. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of NocoDB with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` with a temporary value of `https://temp.temp`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## NocoDB configuration ### Configure the OIDC provider 1. Log in to NocoDB as an administrator and open the SSO settings for your plan: - For a Business plan, navigate to **Workspace Settings** > **Authentication**. - For an Enterprise plan, open the user menu in the bottom-left corner, select **Admin Panel**, and then select **Single Sign-On (SSO)**. 2. Click **New Provider** and select **OpenID Connect (OIDC)**. 3. Enter a **Display name**, such as `authentik`. NocoDB uses this name on the login page. 4. Copy the **Redirect URL**. You need this value to update the authentik provider in the next section. 5. Configure the following settings, but keep the configuration page open: - **Client ID**: Client ID from authentik - **Client Secret**: Client Secret from authentik - **Authorization URL**: `https://authentik.company/application/o/authorize/` - **Token URL**: `https://authentik.company/application/o/token/` - **Userinfo URL**: `https://authentik.company/application/o/userinfo/` - **JWK Set URL**: `https://authentik.company/application/o//jwks/` - **Scope**: `openid profile email offline_access` - **Username Attribute**: `email` ### Update the authentik provider 1. In a separate browser tab, log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the provider that you created for NocoDB. 3. Replace the temporary **Redirect URI** with the **Redirect URL** that you copied from NocoDB. Keep the URI type set to `Strict` `Authorization`. 4. Click **Update** to save the provider. ### Save the NocoDB provider Return to the NocoDB configuration page and click **Save**. ## Configuration verification To confirm that authentik is properly configured with NocoDB, log out of NocoDB and click **Sign in with authentik**. You should be redirected to authentik and returned to NocoDB after authentication. If the SSO option does not appear immediately, refresh the NocoDB login page. ## Resources - [NocoDB Docs - Authentication & SSO](https://nocodb.com/docs/product-docs/account-settings/authentication) - [NocoDB Docs - Configure an OIDC provider](https://nocodb.com/docs/product-docs/account-settings/authentication/oidc-sso/auth0) - [NocoDB Docs - SSO FAQs](https://nocodb.com/docs/product-docs/account-settings/authentication/FAQs) --- ## Integrate with Node-RED ## What is Node-RED? > Node-RED is a programming tool for wiring together hardware devices, APIs and online services in new and interesting ways. > > It provides a browser-based editor that makes it easy to wire together flows using the wide range of nodes in the palette that can be deployed to its runtime in a single-click. > > \-- [https://nodered.org/](https://nodered.org/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of authentik. - `nodered.company` is the FQDN of Node-RED. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This integration requires modifying the Node-RED `settings.js` file and installing the `passport-openidconnect` package. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Node-RED with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://nodered.company/auth/strategy/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Node-RED configuration ### Install the Passport strategy Use npm to install `passport-openidconnect` in the Node-RED user directory. In the official Node-RED Docker container, this directory is `/data`; for a standard installation, it is usually `~/.node-red`. ```shell npm install passport-openidconnect ``` ### Configure editor authentication Edit the Node-RED `settings.js` file to use the external authentication source through `passport-openidconnect`. Group-based permissions are not implemented in this example, so every user who successfully authenticates receives full editor permissions. ```js title="settings.js" adminAuth: { type: "strategy", strategy: { name: "openidconnect", label: "Sign in with authentik", icon: "fa-cloud", strategy: require("passport-openidconnect").Strategy, options: { issuer: "https://authentik.company/application/o//", authorizationURL: "https://authentik.company/application/o/authorize/", tokenURL: "https://authentik.company/application/o/token/", userInfoURL: "https://authentik.company/application/o/userinfo/", clientID: "", clientSecret: "", callbackURL: "https://nodered.company/auth/strategy/callback", scope: ["email", "profile", "openid"], proxy: true, }, }, users: function(user) { return Promise.resolve({ username: user, permissions: "*" }); }, }, ``` Restart Node-RED after saving `settings.js`. ## Configuration verification To confirm that authentik is properly configured with Node-RED, open Node-RED and sign in with authentik. You should be redirected to authentik and returned to the Node-RED editor after authentication. ## Resources - [Node-RED Docs - Securing Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red#oauthopenid-based-authentication) - [Node-RED Docs - Settings file](https://nodered.org/docs/user-guide/runtime/settings-file) - [Node-RED Docs - Running under Docker](https://nodered.org/docs/getting-started/docker) - [Passport.js - passport-openidconnect](https://www.passportjs.org/packages/passport-openidconnect/) --- ## Integrate with SonarQube ## What is SonarQube? > SonarQube Server is a self-managed static analysis tool for continuous code inspection. > > \-- [https://www.sonarsource.com/products/sonarqube/](https://www.sonarsource.com/products/sonarqube/) ## Preparation The following placeholders are used in this guide: - `sonarqube.company` is the FQDN of the SonarQube installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. To support the integration of SonarQube with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://sonarqube.company/oauth2/callback/saml`. - Set the **Audience** to `sonarqube`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **Service Provider Binding** to **Post**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## SonarQube configuration 1. Log in to SonarQube as an administrator. 2. Navigate to **Administration** > **Configuration** > **General Settings** > **Authentication** > **SAML**. 3. Click **Create Configuration** and configure the following settings: - **Application ID**: `sonarqube` - **Provider Name**: `authentik` - **Provider ID**: `https://authentik.company/application/saml//metadata/` - **SAML login URL**: `https://authentik.company/application/saml//` - **Identity provider certificate**: paste the signing certificate that you selected for the authentik SAML provider. You can download it from the authentik SAML provider page, under **Related objects** > **Download signing certificate**. - **SAML user login attribute**: `http://schemas.goauthentik.io/2021/02/saml/username` - **SAML user name attribute**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` - **SAML user email attribute**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` 4. Click **Save configuration**. 5. Click **Test Configuration** to start a SAML test sign-in. 6. After the test succeeds, click **Enable configuration**. ## Configuration verification To confirm that authentik is properly configured with SonarQube, log out of SonarQube and open the integration. Click **Log in with authentik** and confirm that you are redirected to authentik for authentication and then back to SonarQube. ## Resources - [SonarQube Server documentation - Overview of SAML support](https://docs.sonarsource.com/sonarqube-server/instance-administration/authentication/saml/overview) - [SonarQube Server documentation - With Keycloak](https://docs.sonarsource.com/sonarqube-server/instance-administration/authentication/saml/how-to-set-up-keycloak) --- ## Integrate with Weblate ## What is Weblate? > Weblate is a copylefted libre software web-based continuous localization system, used by over 2500 libre projects and companies in more than 165 countries. > > \-- [https://weblate.org/](https://weblate.org/) ## Preparation The following placeholders are used in this guide: - `weblate.company` is the FQDN of the Weblate installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. To support the integration of Weblate with authentik, you need to create SAML property mappings and an application/provider pair in authentik. ### Create property mappings 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Create the following **SAML Provider Property Mapping**s: - **Name**: `Weblate full name` - **SAML Attribute Name**: `urn:oid:2.5.4.3` - **Expression**: ```python return request.user.name ``` - **Name**: `Weblate username` - **SAML Attribute Name**: `urn:oid:0.9.2342.19200300.100.1.1` - **Expression**: ```python return request.user.username ``` - **Name**: `Weblate email` - **SAML Attribute Name**: `urn:oid:0.9.2342.19200300.100.1.3` - **Expression**: ```python return request.user.email ``` ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://weblate.company/accounts/complete/saml/`. - Set the **Audience** to `https://weblate.company/accounts/metadata/saml/`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Add the property mappings that you created in the previous section to **Property mappings**. - Set **Default relay state** to `weblate`. - Set **Service Provider Binding** to **Post**. - Set **Default NameID Policy** to **Persistent**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Open the provider that you created, expand **Related objects**, and copy the signing certificate from **Download signing certificate**. You will use the certificate value when configuring Weblate. ## Weblate configuration The SAML identity provider in Weblate must be named `weblate`. ### Configure a Docker installation If you run Weblate with Docker, set the following environment variables: ```env title=".env" WEBLATE_ENABLE_HTTPS=1 WEBLATE_SAML_IDP_ENTITY_ID=https://authentik.company/application/saml//metadata/ WEBLATE_SAML_IDP_URL=https://authentik.company/application/saml// WEBLATE_SAML_IDP_X509CERT= ``` To require users to authenticate with SAML, also set the following environment variables: ```env title=".env" WEBLATE_REGISTRATION_OPEN=0 WEBLATE_REGISTRATION_ALLOW_BACKENDS=saml WEBLATE_REQUIRE_LOGIN=1 WEBLATE_NO_EMAIL_AUTH=1 ``` Set `WEBLATE_SAML_IDP_X509CERT` to the certificate body from the authentik signing certificate. Remove the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. ### Configure a non-container installation For a non-container installation, install Weblate with the `saml` extra, create a SAML certificate and private key for Weblate, add the SAML authentication backend, and configure the authentik identity provider in your Weblate settings. ```python title="settings.py" ENABLE_HTTPS = True AUTHENTICATION_BACKENDS = ( "social_core.backends.email.EmailAuth", "social_core.backends.saml.SAMLAuth", "weblate.accounts.auth.WeblateUserBackend", ) SOCIAL_AUTH_SAML_SP_PUBLIC_CERT = """ """ SOCIAL_AUTH_SAML_SP_PRIVATE_KEY = """ """ SOCIAL_AUTH_SAML_ENABLED_IDPS = { "weblate": { "entity_id": "https://authentik.company/application/saml//metadata/", "url": "https://authentik.company/application/saml//", "x509cert": "", }, } ``` To require users to authenticate with SAML, disable open registration, allow SAML-created accounts, require login, and remove `social_core.backends.email.EmailAuth` from `AUTHENTICATION_BACKENDS`. ## Configuration verification To confirm that authentik is properly configured with Weblate, log out of Weblate and open the integration. You should be redirected to authentik and returned to Weblate after authentication. ## Resources - [Weblate documentation - Authentication](https://docs.weblate.org/en/latest/admin/auth.html#saml-authentication) - [Weblate documentation - Docker environment variables](https://docs.weblate.org/en/latest/admin/install/docker.html#saml) - [Python Social Auth documentation - SAML](https://python-social-auth.readthedocs.io/en/latest/backends/saml.html) --- ## Integrate with Apple Business Manager ## What is Apple Business Manager? > Apple Business Manager, now Apple Business, helps organizations deploy, manage, and secure Apple devices, apps, services, and Managed Apple Accounts. > > \-- [https://www.apple.com/business/](https://www.apple.com/business/) Apple Business federated authentication lets users sign in to assigned iPhone, iPad, Mac, Apple Vision Pro, Shared iPad, and iCloud on the web with their identity provider credentials. In this integration, authentik is the OpenID Connect (OIDC) identity provider and the Shared Signals Framework (SSF) transmitter that Apple Business uses for backchannel security events. ```mermaid sequenceDiagram autonumber participant User participant Apple participant authentik User->>Apple: Sign in with a Managed Apple Account Apple-->>authentik: Redirect to authentik authentik-->>Apple: Return OIDC authentication response Apple-->>authentik: Register SSF stream authentik-->>Apple: Send security event tokens Apple-->>User: Complete sign-in ``` ## Preparation By the end of this integration, your users will be able to use their authentik credentials to sign in to Apple services and enroll Apple devices with Managed Apple Accounts. Your authentik instance must be reachable from the internet on an HTTPS domain. In Apple Business, you need a verified domain and a user whose role has permission to configure domains, federation, and identity provider connections. The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `example.com` is the verified domain that you want to federate in Apple Business. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Before you configure federated authentication, review these Apple Business requirements and ownership effects: - Users should sign in with the email address that matches their Managed Apple Account. - Devices that use federated authentication require iOS 15.5, iPadOS 15.5, macOS 12.4, visionOS 1.1, or later. - Apple requires the domain to be locked and the Domain Capture process to be turned on. - Users with roles that can configure federation and identity provider connections cannot sign in using federated authentication. - After Apple Business validates the identity provider connection, users cannot create new unmanaged Apple Accounts on the federated domain. Domain verification, domain locking, and Domain Capture affect Apple Account ownership for your whole domain. Review Apple's domain documentation before you turn them on. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Apple Business Manager with authentik, you need to create scope mappings, a signing key, an OAuth2/OpenID provider, an SSF provider, and an application that uses both providers. ### Create scope mappings Apple Business needs the `ssf.manage` and `ssf.read` scopes for SSF access. The profile scope mapping below sends the user's given and family name in the OIDC profile claim. Adjust the expression if your authentik deployment stores name components in dedicated attributes. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **Scope Mapping** and set the following values: - **Name**: `Apple Business Manager profile` - **Scope Name**: `profile` - **Expression**: ```python given_name, _, family_name = request.user.name.partition(" ") return { "given_name": given_name, "family_name": family_name, } ``` 4. Click **Finish**. 5. Click **Create**, select **Scope Mapping**, and set the following values: - **Name**: `Apple Business Manager ssf.read` - **Scope Name**: `ssf.read` - **Expression**: `return {}` 6. Click **Finish**. 7. Click **Create**, select **Scope Mapping**, and set the following values: - **Name**: `Apple Business Manager ssf.manage` - **Scope Name**: `ssf.manage` - **Expression**: `return {}` 8. Click **Finish**. ### Create a signing key Create or import a certificate-key pair that authentik can use to sign OIDC tokens and SSF security event tokens. 1. In the authentik Admin interface, navigate to **System** > **Certificates**. 2. Choose one of the following options: - To create a new key, click **Generate Certificate-Key Pair**, provide a **Certificate Name**, and click **Generate Certificate-Key Pair**. - To import an existing key, click **Import Existing Certificate-Key Pair**, provide a **Certificate Name**, paste the certificate and private key, and click **Import Certificate-Key Pair**. 3. Note the certificate name because you will select it for both providers. ### Create an OAuth2/OpenID provider 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click **New Provider**. 2. Select **OAuth2/OpenID Provider** as the provider type. 3. Provide a name, select an authorization flow, and set the following values: - Note the **Client ID** and **Client Secret** values because you need them when configuring Apple Business. - Under **Protocol settings**, add the following **Redirect URIs/Origins (RegEx)** value: - `Strict` `Authorization`: `https://gsa-ws.apple.com/grandslam/GsService2/acs` - Under **Protocol settings**, set **Signing Key** to the certificate-key pair you created. - Under **Advanced protocol settings** > **Scopes**, add the following mappings to **Selected Scopes**: - `Apple Business Manager profile` - `Apple Business Manager ssf.read` - `Apple Business Manager ssf.manage` - `authentik default OAuth Mapping: OpenID 'offline_access'` 4. Click **Create**. ### Create an SSF provider 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click **New Provider**. 2. Select **Shared Signals Framework Provider** as the provider type. 3. Provide a name and set the following values: - **Signing Key**: select the same certificate-key pair that you selected for the OAuth2/OpenID provider. - **Federated OAuth2/OpenID Providers**: select the OAuth2/OpenID provider that you created for Apple Business. 4. Click **Create**. The SSF provider **URL** value is available only after the SSF provider is assigned to an application as a backchannel provider. ### Assign stream creation permission Apple Business tests the SSF stream connection during federation setup. The authentik user that Apple redirects to during that test must either be a superuser or have the **Add stream to SSF provider** permission on the SSF provider. If you are not using a superuser account for the test, assign the permission to the test account: 1. In the authentik Admin interface, navigate to **Directory** > **Roles** and click **New Role**. 2. Provide a name for the new role and click **Create Role**. 3. Open the role, select the **Users** tab, and add the authentik user that you will use for the Apple Business connection test. 4. Navigate to **Applications** > **Providers** and open the SSF provider that you created. 5. Select the **Permissions** tab and click **Assign Role Object Permission**. 6. Select the role, toggle on **Add stream to SSF provider**, and click **Assign Role Object Permission**. ### Create an application 1. In the authentik Admin interface, navigate to **Applications** > **Applications**. 2. Click **New Application** > **with Existing Provider...** and set the following values: - **Application Name**: `Apple Business Manager` - **Provider**: select the OAuth2/OpenID provider that you created. - **Backchannel Providers**: select the SSF provider that you created. 3. Click **Create application**. 4. Navigate to **Applications** > **Providers** and open the SSF provider. 5. On the **Overview** tab, note the **URL** value because Apple Business uses it as the **SSF Config URL**. 6. Navigate to **Applications** > **Providers** and open the OAuth2/OpenID provider. 7. On the **Overview** tab, note the **OpenID Configuration URL** value. ## Apple Business Manager configuration With the authentik values ready, configure Apple Business to trust authentik as a custom identity provider. ### Add and verify the domain Domain verification proves that your organization controls the domain that you want to use for Managed Apple Accounts. The DNS and ownership work happens in Apple Business and your DNS provider, so only the high-level workflow is included here. 1. Log in to Apple Business as a user whose role can view, edit, and delete organization domains. 2. Navigate to **Settings** > **Domains**. 3. Click **Add**, select **Add Domain**, enter `example.com`, and click **Add Domain**. 4. Click **Verify** next to the domain. 5. Copy the TXT record that Apple Business displays and add it to your DNS provider. 6. After the DNS record is published, return to **Settings** > **Domains** and click **Check Now** for the domain. ### Lock the domain Locking a domain permanently prevents new unmanaged Apple Accounts from being created with that domain unless the domain is removed from Apple Business. 1. In Apple Business, navigate to **Settings** > **Domains**. 2. Select the domain, click **Manage**, and lock the domain. 3. Review the ownership impact, then click **Lock Domain**. ### Configure and test the identity provider connection 1. In Apple Business, navigate to **Settings** > **Domains**. 2. Click **Get Started** next to **User sign-in and directory sync**. 3. Select **Custom Identity Provider** and click **Continue**. 4. Provide a name for the connection, for example `authentik`. 5. Set the following values: - **Client ID**: the Client ID from the authentik OAuth2/OpenID provider. - **Client Secret**: the Client Secret from the authentik OAuth2/OpenID provider. - **SSF Config URL**: the URL from the authentik SSF provider. - **OpenID Config URL**: the OpenID Configuration URL from the authentik OAuth2/OpenID provider. 6. Click **Continue**. 7. When Apple Business redirects you to authentik, sign in as the authentik user that has permission to create streams for the SSF provider. 8. After the test succeeds, click **Done**. If the connection test fails, verify the following settings: - The authentik instance is reachable from the internet over HTTPS. - The Client ID and Client Secret values match the authentik OAuth2/OpenID provider. - The OAuth2/OpenID provider has the Apple redirect URI, the Apple scope mappings, the `offline_access` scope, and a signing key. - The SSF provider has a signing key and includes the OAuth2/OpenID provider under **Federated OAuth2/OpenID Providers**. - The application uses the OAuth2/OpenID provider as its main provider and the SSF provider as a backchannel provider. - The authentik user used for the Apple Business connection test can create streams for the SSF provider. ### Turn on Domain Capture Domain Capture affects every unmanaged Apple Account that uses the domain. Apple notifies affected users and starts a 30-day transfer window. 1. In Apple Business, navigate to **Settings** > **Domains**. 2. Click **Get Started with Domain Capture**. 3. Review the affected accounts, confirm that the domain is locked, and click **Start Domain Capture**. ### Turn on federated authentication 1. In Apple Business, navigate to **Settings** > **Domains**. 2. In the **Domains** section, click **Manage** next to the domain. 3. Click **Turn on Sign in with your Identity Provider**. 4. Turn on **Sign in with your Identity Provider**. ## Configuration verification To confirm that authentik is properly configured with Apple Business Manager, open Apple Business in a private browsing window and sign in with an account in the federated domain that is allowed to use federated authentication. You should be redirected to authentik to authenticate, then redirected back to Apple Business. You can also sign in to an assigned Apple device with the user's Managed Apple Account to confirm the device sign-in flow. ## Resources - [Apple Business User Guide - Intro to federated authentication with Apple Business](https://support.apple.com/guide/business/intro-to-federated-authentication-axmb19317543/web) - [Apple Business User Guide - Use federated authentication with your identity provider in Apple Business](https://support.apple.com/guide/business/federated-authentication-identity-provider-axmfcab66783/web) - [Apple Business User Guide - Verify a domain in Apple Business](https://support.apple.com/guide/business/verify-a-domain-axm48c3280c0/web) - [Apple Business User Guide - Lock a domain in Apple Business](https://support.apple.com/guide/business/lock-a-domain-axmce04f4299/web) - [Apple Business User Guide - Capture a domain in Apple Business](https://support.apple.com/guide/business/capture-a-domain-axm512ce43c3/web) --- ## Integrate with Fleet ## What is Fleet? > Fleet is an open source device management platform for managing and securing laptops, desktops, servers, and mobile devices across an organization. > > \-- [https://fleetdm.com/](https://fleetdm.com/) ## Preparation By the end of this integration, your users will be able to log in to Fleet using their authentik credentials. The following placeholders are used in this guide: - `fleet.company` is the FQDN of the Fleet installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Your authentik and Fleet instances must both be accessible over HTTPS. ## authentik configuration To support the integration of Fleet with authentik, you need to create an application/provider pair in authentik. The values below configure SSO for Fleet users. If you also need SSO for end-user authentication in the macOS setup experience, create a separate application/provider pair and use the end-user Assertion Consumer Service (ACS) URL listed below. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to `https://fleet.company/api/v1/fleet/sso/callback`. - For end-user authentication in the macOS setup experience, set **ACS URL** to `https://fleet.company/api/v1/fleet/mdm/sso/callback` instead. - Set **Audience** to `https://fleet.company`. - Under **Advanced protocol settings**, select an available **Signing Certificate** and ensure that **Sign assertions** and **Sign responses** are enabled. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Create Application** to save the new application and provider. ### Retrieve provider metadata 1. Navigate to **Applications** > **Providers** and click the Fleet SAML provider. 2. Under **Related objects** > **Metadata**, click **Copy download URL**. This metadata URL is required when configuring Fleet. ## Fleet configuration Configure Fleet to trust authentik as the SAML identity provider. ### Configure Fleet users 1. Log in to Fleet as an administrator. 2. Navigate to **Settings** > **Integrations** > **Single sign-on (SSO)** > **Fleet users**. 3. Check **Enable single sign-on** and use the following values: - **Identity provider name**: `authentik`. - **Entity ID**: `https://fleet.company`. This value must match the **Audience** value configured in authentik. - **Metadata URL**: the metadata URL that you copied from authentik. If you downloaded the metadata file from authentik instead, paste the contents of the XML file into **Metadata**. - **Allow SSO login initiated by identity provider**: check this box to allow users to log in to Fleet from authentik. - **Create user and sync permissions on login** *(optional)*: check this box if you use Fleet Premium and want Fleet to create users on their first SSO login. If authentik does not send Fleet role attributes, Fleet creates new users with the global observer role. 4. Click **Save**. If you do not enable just-in-time user provisioning, create each Fleet user before they log in with SSO. The Fleet user's email address must match their authentik email address, and their Fleet **Authentication** method must be set to **Single sign-on**. ### Configure end-user authentication *(optional)* Use this section only if you created an authentik application/provider pair with the end-user ACS URL for the macOS setup experience. 1. In Fleet, navigate to **Settings** > **Integrations** > **Single sign-on (SSO)** > **End users**. 2. Configure the form with the following values: - **Identity provider name**: `authentik`. - **Entity ID**: `https://fleet.company`. This value must match the **Audience** value configured in authentik. - **Metadata URL**: the metadata URL for the authentik provider that uses the end-user ACS URL. If you downloaded the metadata file from authentik instead, paste the contents of the XML file into **Metadata**. 3. Click **Save**. Fleet setup experience settings, EULA requirements, and Apple MDM enrollment settings are outside the scope of this guide. ## Configuration verification To confirm that authentik is properly configured with Fleet, open Fleet and click **Sign on with authentik**. After authenticating with authentik, you should be redirected back to Fleet and logged in. For end-user authentication, start the setup experience on a test macOS device assigned to Fleet and confirm that Fleet redirects the user to authentik. ## Resources - [Fleet documentation - Single sign-on (SSO)](https://fleetdm.com/docs/deploy/single-sign-on-sso) - [Fleet guide - End-user authentication](https://fleetdm.com/guides/end-user-authentication) --- ## Integrate with MeshCentral ## What is MeshCentral? > MeshCentral is a free, open source, web-based platform for remote device management. > > \-- [https://meshcentral.com](https://meshcentral.com) ## Preparation The following placeholders are used in this guide: - `meshcentral.company` is the FQDN of the MeshCentral installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of MeshCentral with authentik, you need to create an application and provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://meshcentral.company/auth-oidc-callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## MeshCentral configuration Edit the `config.json` file for your MeshCentral deployment, and add the OIDC authentication strategy to the domain that should use authentik. The example below configures the default MeshCentral domain, `""`. For Docker deployments, `config.json` is located in the host directory that is mapped to `/opt/meshcentral/meshcentral-data`. ```json title="config.json" { "domains": { "": { "authStrategies": { "oidc": { "issuer": "https://authentik.company/application/o//", "client": { "client_id": "", "client_secret": "" } } } } } } ``` Restart your MeshCentral instance to apply the updated configuration. ## Configuration verification To confirm that authentik is properly configured with MeshCentral, open your MeshCentral instance and click the OpenID Connect sign-in button. After you authenticate with authentik, MeshCentral should redirect you back and sign you in. ## Resources - [MeshCentral documentation: Using the OpenID Connect Strategy](https://docs.meshcentral.com/meshcentral/openidConnectStrategy/) --- ## Integrate with Omnissa Workspace ONE Access ## What is Omnissa Workspace ONE Access? > Omnissa Access, formerly Workspace ONE Access, is an identity and access management solution that provides SSO, adaptive access policies, and identity federation for applications and devices. > > \-- [https://www.omnissa.com/products/omnissa-access/](https://www.omnissa.com/products/omnissa-access/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Before you configure authentik, start the OpenID Connect (OIDC) identity provider setup in Omnissa Workspace ONE Access so that you can copy the redirect URI that Omnissa generates. 1. Log in to your Omnissa Workspace ONE Access tenant as an administrator. 2. Navigate to **Integrations** > **Identity Providers**. 3. Click **Add** and select **OpenID Connect IDP**. 4. Scroll down to the **Redirect URI** section and note the URL shown under **Integrate with Open ID Connect Provider using Redirect URI below**. This URL must be registered as the redirect URI in authentik. You can leave the form open in another browser tab while configuring authentik. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Omnissa Workspace ONE Access with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring Omnissa Workspace ONE Access. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - **Protocol Settings**: - **Redirect URI**: - `Strict` `Authorization`: the redirect URI that you noted in the Preparation section. - `Strict` `Authorization`: `awgb://oauth2`. This URI is used by the Workspace ONE mobile applications. - **Signing Key**: select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Omnissa Workspace ONE Access configuration 1. Return to the OpenID Connect IDP form you opened during the Preparation section. If you closed it, navigate again to **Integrations** > **Identity Providers**, click **Add**, and select **OpenID Connect IDP**. 2. Configure the form as follows: - Under **General Information**: - **Identity Provider Name**: a descriptive name, for example `authentik`. - Under **Authentication Configuration**: - **Configuration Type**: select **Automatic Discovery**. - **Configuration URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - Under **Client Details**: - **Client ID**: the Client ID from the authentik provider. - **Client Secret**: the Client Secret from the authentik provider. - Under **User Lookup Attribute**: - **Open ID User Identifier Attribute**: the authentik claim that matches the users in Omnissa Workspace ONE Access, for example `preferred_username`. - **Omnissa Access User Identifier Attribute**: the matching Omnissa Access user attribute, for example `userName`. - Under **Users**: select the directory or directories whose users are allowed to authenticate using authentik. - Under **Network**: select the network ranges from which this identity provider can be used (for example, `ALL RANGES`). - Under **Authentication Method**: - **Authentication Method Name**: a name that you can later select in your access policies, for example `authentik`. 3. Click **Add** to create the identity provider. ### Add the new authentication method to an access policy Creating the identity provider alone does not make it usable. Add the new authentication method to one or more **Access Policies** so that Omnissa Workspace ONE Access knows when to apply it. 1. Navigate to **Resources** > **Policies**. 2. Open the access policy that targets the applications you want to use authentik for (typically the **default\_access\_policy\_set**, or an application-specific policy). 3. Edit the relevant policy rules and add the **Authentication Method Name** you configured above (for example, `authentik`) to the ordered list of authentication methods. The exact policy structure depends on your Omnissa Workspace ONE Access deployment, the network ranges, device types, and user groups you want to target, and is out of scope for this guide. Refer to the Omnissa Workspace ONE Access documentation for details on access policies. ## Configuration verification To confirm that authentik is properly configured with Omnissa Workspace ONE Access, log out of Workspace ONE Access (or open the Workspace ONE Intelligent Hub app on a mobile device) and start the login flow. Select the new authentik authentication method when prompted. You should be redirected to authentik to log in, then redirected back to Workspace ONE. ## Resources - [Omnissa Product Documentation - Add and Configure an OpenID Connect Third-Party Identity Provider in Omnissa Access](https://docs.omnissa.com/bundle/workspace-one-access-managing-authentication-guideVSaaS/page/AddandConfigureanOpenIDConnectThird-PartyIdentityProviderinWorkspaceONEAccessCloudOnly.html) - [Omnissa Product Documentation - Managing the Default Access Policy in Omnissa Access](https://docs.omnissa.com/bundle/workspace-one-access-managing-authentication-guideVSaaS/page/ManagingtheDefaultAccessPolicyinWorkspaceONEAccess.html) --- ## Integrate with AppFlowy ## What is AppFlowy? > AppFlowy is an open-source workspace collaboration platform that teams can use to create, manage, and collaborate on documents, databases, and projects. > > \-- [https://appflowy.com](https://appflowy.com) ## Preparation The following placeholders are used in this guide: - `appflowy.company` is the FQDN of the AppFlowy installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of AppFlowy with authentik, you need to create a certificate and an application/provider pair in authentik. ### Create a certificate-key pair 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **System** > **Certificates** and click **Generate**. 3. Set the following required fields: - **Common name**: provide a descriptive name. - **Private key algorithm**: `RSA` 4. Click **Generate** and copy the **Certificate** and **Private key** values because they will be required later. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **ACS URL**: `https://appflowy.company/gotrue/sso/saml/acs` - **Audience**: `https://appflowy.company/gotrue/sso/saml/metadata` - Under **Advanced protocol settings**: - **Signing certificate**: select the certificate created earlier - **Sign assertions**: enabled - **Sign responses**: enabled - **Verification certificate**: select the same certificate - **NameID Property Mapping**: `authentik default SAML Mapping: Email` - **Default relay state**: `https://appflowy.company/auth/callback` - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Copy metadata download link 1. Navigate to **Applications** > **Providers** and click the provider that you created in the previous section. 2. Under **Related objects** > **Metadata**, click **Copy download URL**. This URL is the SAML metadata URL and it will be required in the next section. ## AppFlowy configuration ### Convert the certificate and private key AppFlowy requires the private key in PKCS#1 and single-line base64 format. Convert the certificate and private key from the certificate-key pair that you created in authentik. 1. Convert the private key to PKCS#1 format: ```bash openssl rsa -in .pem -traditional -out key_pkcs1.pem ``` 2. Convert the PKCS#1 private key to a single-line base64 string: ```bash sed -n '/^-----BEGIN RSA PRIVATE KEY-----$/,/^-----END RSA PRIVATE KEY-----$/p' key_pkcs1.pem \ | sed '/^-----/d' \ | tr -d '\n' ``` Copy the output of this command for the `GOTRUE_SAML_PRIVATE_KEY` value in a later section. 3. Convert the certificate to a single-line format with `\n` escapes: ```bash awk 'NF { sub(/\r/, ""); printf "%s\\n", $0 }' .pem ``` Copy the output of this command for the `AUTH_SAML_CERT` value in a later section. 1. Convert the private key to PKCS#1 format: ```powershell openssl rsa -in .pem -traditional -out key_pkcs1.pem ``` 2. Convert the PKCS#1 private key to a single-line base64 string: ```powershell ((Get-Content key_pkcs1.pem) | Where-Object { $_ -notmatch '^-{5}' }) -join '' ``` Copy the output of this command for the `GOTRUE_SAML_PRIVATE_KEY` value in a later section. 3. Convert the certificate to a single-line format with `\n` escapes: ```powershell ((Get-Content .pem) | ForEach-Object { $_.TrimEnd() + '\n' }) -join '' ``` Copy the output of this command for the `AUTH_SAML_CERT` value in a later section. ### Configure metadata URL 1. Log in to the AppFlowy Admin Console at `https://appflowy.company/console`. 2. Click **Create SSO** in the sidebar. 3. Set **Metadata Url** to the SAML metadata URL from authentik. 4. Click **Create**. ### Configure AppFlowy environment file Add the following environment variables to your AppFlowy installation: ```env title=".env" AUTH_SAML_ENABLED=true GOTRUE_SAML_ENABLED=true AUTH_SAML_ENTRY_POINT=https://authentik.company/application/saml// AUTH_SAML_ISSUER=https://authentik.company/application/saml//metadata/ AUTH_SAML_CALLBACK_URL=https://appflowy.company/gotrue/sso/saml/acs AUTH_SAML_DEFAULT_REDIRECT_URL=https://appflowy.company/app # From the conversion steps above GOTRUE_SAML_PRIVATE_KEY= AUTH_SAML_CERT= ``` If you have disabled signup in AppFlowy, first create or invite the users who will sign in with SAML. Restart AppFlowy to apply the changes. ## Configuration verification To confirm that authentik is properly configured with AppFlowy, open the AppFlowy application from the authentik User interface. After a successful login, you should be signed in to AppFlowy. ## Resources - [AppFlowy documentation - How to log in using Okta SAML 2.0](https://appflowy.com/docs/How-to-log-in-using-Okta-SAML-2) - [AppFlowy documentation - How to log in using SAML 2.0](https://appflowy.com/docs/How-to-log-in-using-SAML-2) --- ## Integrate with BookStack ## What is BookStack? > BookStack is a simple, self-hosted, easy-to-use platform for organizing and storing information. > > \-- [https://www.bookstackapp.com/](https://www.bookstackapp.com/) ## Preparation The following placeholders are used in this guide: - `bookstack.company` is the FQDN of the BookStack installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. BookStack can use either OpenID Connect (OIDC) or SAML 2.0 for authentication. Choose one protocol and follow the matching tab throughout this guide. ## authentik configuration To support the integration of BookStack with authentik using OIDC, you need to create an application/provider pair in authentik. ### Create an application and provider In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring BookStack. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because you will use them when configuring BookStack. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://bookstack.company/oidc/callback`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://bookstack.company`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://bookstack.company/login`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://bookstack.company/login?prevent_auto_init=true`. - Select an RSA **Signing Key**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## BookStack configuration Update the BookStack `.env` file with the OIDC settings, then restart BookStack. ```env title=".env" AUTH_METHOD=oidc OIDC_NAME=authentik OIDC_DISPLAY_NAME_CLAIMS=name OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_ISSUER=https://authentik.company/application/o// OIDC_ISSUER_DISCOVER=true OIDC_END_SESSION_ENDPOINT=true ``` If BookStack should immediately redirect users to authentik instead of showing the login button, also add the following setting: ```env title=".env" AUTH_AUTO_INITIATE=true ``` ### Configure role sync *(optional)* BookStack can map authentik groups to BookStack roles when the group names match BookStack role display names. If you need a different matching value for a role, edit the role in BookStack and set its **External Authentication IDs** value. ```env title=".env" OIDC_USER_TO_GROUPS=true OIDC_GROUPS_CLAIM=groups ``` If BookStack should remove roles that no longer match the user's authentik groups, also add the following setting: ```env title=".env" OIDC_REMOVE_FROM_GROUPS=true ``` If you change an existing BookStack installation from local authentication to OIDC, BookStack does not automatically link users by email address. Before switching the authentication method, log in to BookStack as an administrator and update each local user's **External Authentication ID** to the identifier that BookStack will receive from authentik. ## Configuration verification To confirm that authentik is properly configured with BookStack, open BookStack and click **Login with authentik**. ## authentik configuration To support the integration of BookStack with authentik using SAML, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring BookStack. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **ACS URL**: `https://bookstack.company/saml2/acs` - **Audience**: `https://bookstack.company/saml2/metadata` - **SLS URL**: `https://bookstack.company/saml2/sls` - **SLS Binding**: `Redirect` - **Logout Method**: `Front-channel (Iframe)` - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## BookStack configuration Update the BookStack `.env` file with the SAML settings, then restart BookStack. ```env title=".env" AUTH_METHOD=saml2 SAML2_NAME=authentik SAML2_EMAIL_ATTRIBUTE=http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress SAML2_EXTERNAL_ID_ATTRIBUTE=http://schemas.goauthentik.io/2021/02/saml/uid SAML2_DISPLAY_NAME_ATTRIBUTES=http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name SAML2_IDP_ENTITYID=https://authentik.company/application/saml//metadata/ SAML2_AUTOLOAD_METADATA=true ``` If BookStack should immediately redirect users to authentik instead of showing the login button, also add the following setting: ```env title=".env" AUTH_AUTO_INITIATE=true ``` ### Configure role sync *(optional)* BookStack can map authentik groups to BookStack roles when the group names match BookStack role display names. If you need a different matching value for a role, edit the role in BookStack and set its **External Authentication IDs** value. ```env title=".env" SAML2_USER_TO_GROUPS=true SAML2_GROUP_ATTRIBUTE=http://schemas.xmlsoap.org/claims/Group ``` If BookStack should remove roles that no longer match the user's authentik groups, also add the following setting: ```env title=".env" SAML2_REMOVE_FROM_GROUPS=true ``` If you change an existing BookStack installation from local authentication to SAML, BookStack does not automatically link users by email address. Before switching the authentication method, log in to BookStack as an administrator and update each local user's **External Authentication ID** to the identifier that BookStack will receive from authentik. ## Configuration verification To confirm that authentik is properly configured with BookStack, open BookStack and click **Login with authentik**. ## Resources - [BookStack OpenID Connect authentication](https://www.bookstackapp.com/docs/admin/oidc-auth/) - [BookStack SAML 2.0 authentication](https://www.bookstackapp.com/docs/admin/saml2-auth/) --- ## Integrate with DokuWiki ## What is DokuWiki? > DokuWiki is a simple to use and highly versatile open source wiki software that doesn't require a database. > > \-- [https://www.dokuwiki.org/dokuwiki](https://www.dokuwiki.org/dokuwiki) ## Preparation The following placeholders are used in this guide: - `dokuwiki.company` is the FQDN of the DokuWiki installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of DokuWiki with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** because it will be required later. - Under **UI Settings**, you can set the **Launch URL** to `https://dokuwiki.company/doku.php?id=start&oauthlogin=generic` to log in directly to DokuWiki from the authentik Application Dashboard without clicking the DokuWiki OAuth login button. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://dokuwiki.company/doku.php`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://dokuwiki.company/doku.php`. - Select any available signing key. - Under **Advanced protocol settings**, add the following OAuth mapping under **Scopes**: `authentik default OAuth Mapping: OpenID 'offline_access'`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## DokuWiki configuration In DokuWiki, open the **Administration** interface and navigate to **Extension Manager**. Install the following extensions: - [OAuth](https://www.dokuwiki.org/plugin\:oauth) - [OAuth Generic](https://www.dokuwiki.org/plugin\:oauthgeneric) Next, navigate to **Configuration Settings** and update the **oauth** and **oauthgeneric** options. For **oauth**, select `plugin»oauth»register-on-auth`. When using `preferred_username` as the user identifier, ensure that the [Allow users to change username](/docs/sys-mgmt/settings#allow-users-to-change-username) setting is disabled to prevent authentication issues. You can configure DokuWiki to use either `sub` or `preferred_username` as the UID field under `plugin»oauthgeneric»json-user`. The `sub` option uses a unique, stable identifier for the user, while `preferred_username` uses the username configured in authentik. DokuWiki supports switching between `sub` and `preferred_username` as the user identifier at any time, but this change only applies to users logging in for the first time after the switch. For all existing users, their contributions remain linked to the initial identifier type. Past contributions are not re-associated with the new identifier when switching. It is strongly recommended to decide on the identifier during initial setup and avoid switching it later. For **oauthgeneric**: - Set `plugin»oauthgeneric»key` to the **Client ID** from authentik. - Set `plugin»oauthgeneric»secret` to the **Client Secret** from authentik. - Set `plugin»oauthgeneric»authurl` to `https://authentik.company/application/o/authorize/`. - Set `plugin»oauthgeneric»tokenurl` to `https://authentik.company/application/o/token/`. - Set `plugin»oauthgeneric»userurl` to `https://authentik.company/application/o/userinfo/`. - Set `plugin»oauthgeneric»logouturl` to `https://authentik.company/application/o//end-session/`. - Set `plugin»oauthgeneric»authmethod` to `Bearer Header`. - Set `plugin»oauthgeneric»scopes` to `email, openid, profile, offline_access`. - Select `plugin»oauthgeneric»needs-state`. - Set `plugin»oauthgeneric»json-user` to `preferred_username`. - Set `plugin»oauthgeneric»json-name` to `name`. - Set `plugin»oauthgeneric»json-mail` to `email`. - Set `plugin»oauthgeneric»json-grps` to `groups`. - Set `plugin»oauthgeneric»color` to `#fd4b2d`. After you update the plugin settings, navigate to **Administration** > **Configuration Settings** > **Authentication** and set **Authentication backend** to **oauth**. ## Configuration verification To confirm that authentik is properly configured with DokuWiki, log out, open DokuWiki, and click the new OAuth login button. ## Resources - [DokuWiki OAuth plugin](https://www.dokuwiki.org/plugin\:oauth) - [DokuWiki Generic OAuth plugin](https://www.dokuwiki.org/plugin\:oauthgeneric) --- ## Integrate with Dropbox Sign ## What is Dropbox Sign? > Dropbox Sign is an electronic signature platform for preparing, sending, signing, and tracking documents and agreements. > > \-- [https://sign.dropbox.com/](https://sign.dropbox.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. SAML SSO requires a Dropbox Sign Premium plan. ## authentik configuration To support the integration of Dropbox Sign with authentik, you need to create property mappings and an application/provider pair in authentik. ### Create property mappings Dropbox Sign expects the SAML assertion to include `FirstName` and `LastName` attributes. Because authentik stores a user's full name as a single string, create SAML provider property mappings that split the full name into first and last names. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the property mapping type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `Dropbox Sign FirstName` - **SAML Attribute Name**: `FirstName` - **Expression**: ```python name = request.user.name or request.user.username return name.split(" ", 1)[0] ``` 5. Click **Finish** to save the property mapping. 6. Repeat steps 2-5 to create the following additional SAML provider property mapping: - **Name**: `Dropbox Sign LastName` - **SAML Attribute Name**: `LastName` - **Expression**: ```python name = request.user.name or request.user.username return name.rsplit(" ", 1)[-1] if " " in name else "" ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to `https://app.hellosign.com/account/ssoLogIn`. - Set **Audience** to `https://app.hellosign.com`. - Under **Advanced protocol settings**: - Set **Signing Certificate** to any available certificate. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Set **Default NameID Policy** to `Email address`. - Add the `Dropbox Sign FirstName` and `Dropbox Sign LastName` property mappings that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download and prepare the signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the name of the newly created Dropbox Sign provider. 3. Under **Related objects** > **Download signing certificate**, click **Download**. 4. Open the downloaded certificate file in plain text, remove the first and last lines (`-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`), then remove all line breaks from the remaining certificate text. This certificate text will be required in the next section. ## Dropbox Sign configuration 1. Log in to Dropbox Sign as an administrator. 2. Hover over your email address in the top-right corner, then select **Admin console**. 3. In the left sidebar, click **Security**, then locate **SSO**. 4. Configure the following required settings: - **Identity Provider Single Sign-On URL**: `https://authentik.company/application/saml//` - **Identity Provider Issuer**: `https://authentik.company/application/saml//metadata/` - **X.509 Certificate**: paste the certificate text that you prepared from the authentik signing certificate. 5. Keep **Allow standard logins for admins** enabled while testing the SAML configuration. 6. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with Dropbox Sign, open the Dropbox Sign application from the authentik Application Dashboard. You should be redirected to Dropbox Sign and signed in as the matching Dropbox Sign user. After you verify that SAML SSO works, decide whether to disable **Allow standard logins for admins** in Dropbox Sign. ## Resources - [Dropbox Help - Dropbox Sign SAML SSO configuration](https://help.dropbox.com/security/dropbox-sign-saml-sso-configuration) --- ## Integrate with GLPI ## What is GLPI? > GLPI is a free and open-source IT asset management and service desk application. It helps organizations manage hardware, software, tickets, users, and IT services in one central system. > > \-- [https://www.glpi-project.org](https://www.glpi-project.org) ## Preparation The following placeholders are used in this guide: - `glpi.company` is the FQDN of the GLPI installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This guide uses the community [samlSSO](https://github.com/DonutsNL/samlsso) plugin for GLPI 11 and later. For GLPI 10, use the older `glpisaml` release series from the same project. ### Install the samlSSO plugin 1. Log in to GLPI as an administrator. 2. Navigate to **Setup** > **Plugins** and install the **samlSSO** plugin from the GLPI Marketplace. 3. Enable the plugin. If the plugin is not available from the Marketplace in your installation, download a compatible release from the [samlSSO GitHub releases](https://github.com/DonutsNL/samlsso/releases), extract it to `/plugins/samlsso`, then install and enable it from **Setup** > **Plugins**. ### Create a SAML application in GLPI Create the GLPI-side SAML configuration first so that you can copy the generated service provider endpoints into authentik. 1. Navigate to **Setup** > **samlSSO**. 2. Click **Add** and configure the following settings: - On the **General** tab: - **Friendly name**: `authentik` - **Is active**: enabled - On the **Security** tab: - **Strict**: enabled - **JIT user creation**: enabled 3. Click **Save**. 4. Open the `authentik` samlSSO configuration, navigate to the **Service Provider** tab, and note the **AcsUrl** and **SloUrl** values. ## authentik configuration To support the integration of GLPI with authentik, you need to create property mappings and an application/provider pair in authentik. ### Create property mappings GLPI uses the SAML `givenname` and `surname` claims when creating users through JIT provisioning. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings**, click **Create**, select **SAML Provider Property Mappings**, and click **Next**. 3. Configure the first mapping for the user's given name: - **Name**: `givenname` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname` - **Expression**: ```python return request.user.name.split(" ", 1)[0] ``` 4. Click **Finish**. 5. Repeat the process to create a mapping for the user's surname: - **Name**: `surname` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname` - **Expression**: ```python return request.user.name.split(" ", 1)[-1] ``` 6. Click **Finish**. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. Alternatively, you can first create a provider separately, then create the application and connect it with the provider. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name, the authorization flow to use for this provider, and the following required configurations: - **ACS URL**: the **AcsUrl** value from GLPI. - **SLS URL**: the **SloUrl** value from GLPI. - Under **Advanced protocol settings**, select any available **Signing Certificate**. - Under **Advanced protocol settings**, set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Under **Advanced protocol settings**, add the `givenname` and `surname` property mappings that you created earlier. Leave the managed email property mapping selected. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click the provider that you created. 2. Under **Related objects** > **Download signing certificate**, click **Download**. The downloaded file is required when configuring the identity provider settings in GLPI. ## GLPI configuration ### Configure the identity provider 1. Log in to GLPI as an administrator and navigate to **Setup** > **samlSSO**. 2. Click the `authentik` samlSSO configuration. 3. On the **Identity Provider** tab, configure the following settings: - **Entity ID**: `https://authentik.company/application/saml//metadata/` - **SSO URL**: `https://authentik.company/application/saml//` - **SLO URL**: `https://authentik.company/application/saml//` - **X509 certificate**: paste the contents of the signing certificate file that you downloaded from authentik. 4. Click **Save**. ### Configure JIT import rules *(optional)* You can use JIT import rules to assign GLPI profiles, groups, and entities when samlSSO creates a user. 1. Navigate to **Setup** > **samlSSO** > **JIT import rules** and click **Add**. 2. Provide a **Name**, select a **Logical operator**, set **Active** to **Yes**, and click **Add**. 3. On the **Criteria** tab, create criteria that match the users that should receive the rule's actions. 4. On the **Actions** tab, create the actions that GLPI applies to matching users. - To grant access to child entities, add an action that sets `recursive` to `yes`. 5. Return to the **Rule** tab and click **Save**. ## Configuration verification To confirm that authentik is properly configured with GLPI, log out of GLPI and click the **authentik** login button on the right side. After you authenticate with authentik, GLPI signs you in. ## Resources - [samlSSO plugin repository](https://github.com/DonutsNL/samlsso) - [GLPI Help Center - Plugins](https://help.glpi-project.org/documentation/modules/configuration/plugins) - [GLPI Help Center - SAML plugin](https://help.glpi-project.org/doc-plugins/plugins-glpi/saml) --- ## Integrate with Karakeep ## What is Karakeep? > A self-hostable bookmark-everything app (links, notes and images) with AI-based automatic tagging and full-text search. > > \-- [https://karakeep.app/](https://karakeep.app/) ## Preparation The following placeholders are used in this guide: - `karakeep.company` is the FQDN of the Karakeep installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Karakeep with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://karakeep.company/api/auth/callback/custom`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Karakeep configuration Karakeep uses environment variables to configure OAuth. Add the following variables to the environment file for the Karakeep `web` container: ```env title=".env" NEXTAUTH_URL=https://karakeep.company OAUTH_CLIENT_ID= OAUTH_CLIENT_SECRET= OAUTH_WELLKNOWN_URL=https://authentik.company/application/o//.well-known/openid-configuration OAUTH_PROVIDER_NAME=authentik ``` If Karakeep already has local accounts that should sign in through authentik with the same email address, you can also set the following variable. Only enable this setting when you trust authentik as the OAuth provider for those account email addresses. ```env title=".env" OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true ``` To make authentik the only login method for Karakeep, you can add the following variables: ```env title=".env" DISABLE_PASSWORD_AUTH=true DISABLE_SIGNUPS=true OAUTH_AUTO_REDIRECT=true ``` Restart the Karakeep server to apply the changes. ## Configuration verification To confirm that authentik is properly configured with Karakeep, open Karakeep and click **Sign in with authentik**. You should be redirected to authentik, then returned to Karakeep after a successful login. ## Resources - [Karakeep Docs - Configuration](https://docs.karakeep.app/configuration/environment-variables/) - [Karakeep source - authentication configuration](https://github.com/karakeep-app/karakeep/blob/main/apps/web/server/auth.ts) --- ## Integrate with KitchenOwl ## What is KitchenOwl? > KitchenOwl is a smart self-hosted grocery list and recipe manager. Easily add items to your shopping list before you go shopping. You can also create recipes and set up meal plans to help you organize your cooking. > > \-- [https://kitchenowl.org/](https://kitchenowl.org/) ## Preparation The following placeholders are used in this guide: - `kitchenowl.company` is the FQDN of the KitchenOwl installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of KitchenOwl with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value as it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret** values because they will be required later. - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://kitchenowl.company/signin/redirect` and `kitchenowl:/signin/redirect`. 3. Click **Submit** to save the new application and provider. ## KitchenOwl configuration To enable OIDC login with KitchenOwl, update your backend environment variables to include the following: ```env title=".env" FRONT_URL=https://kitchenowl.company OIDC_ISSUER=https://authentik.company/application/o/ OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= ``` Restart the KitchenOwl backend service for the changes to take effect. ### Use the legacy mobile redirect URI *(optional)* KitchenOwl uses `kitchenowl:/signin/redirect` for mobile app sign-in. If the mobile app cannot complete sign-in with your OIDC provider, set the following environment variable: ```env title=".env" OIDC_RFC_COMPLIANT_REDIRECT=False ``` Then update the authentik provider and replace `kitchenowl:/signin/redirect` with `kitchenowl:///signin/redirect`. ### Link existing accounts When signing in using OIDC, you're either logged into the linked account or, if none exists, a new account is created. Account creation will fail if the identity provider returns an email address that is already associated with a KitchenOwl account. If you've already started using KitchenOwl or created an account first, you can link an OIDC account to your existing KitchenOwl account. Navigate to **Settings**, click your profile in the top-right corner, and then click **Linked Accounts** and follow the on-screen instructions to link your account. Account links are permanent and can only be removed by deleting the KitchenOwl account. Users that signed in using OIDC are normal users that, after setting a password, can also sign in using their username and password. Deleting a user from your OIDC authority will not delete a user from KitchenOwl. ## Configuration verification To confirm that authentik is properly configured with KitchenOwl, log out and log back in via authentik. You should see a **Sign in with OIDC** button at the bottom of the login page. Click on it and ensure you can successfully log in using single sign-on. ## Resources - [KitchenOwl Documentation - OpenID Connect](https://docs.kitchenowl.org/latest/self-hosting/oidc/) --- ## Integrate with Mealie ## What is Mealie? > Mealie is a self-hosted recipe manager and meal planner. Easily add recipes by providing the URL and Mealie will automatically import the relevant data or add a family recipe with the UI editor. > > \-- [https://mealie.io/](https://mealie.io/) ## Preparation The following placeholders are used in this guide: - `mealie.company` is the FQDN of the Mealie installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Mealie with authentik, you need to create an application/provider pair and application entitlements in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** because they are required later. - Add two **Redirect URIs** of type `Strict` `Authorization`: - `https://mealie.company/login` - `https://mealie.company/login?direct=1` - Select any available signing key. - Under **Advanced protocol settings**, add **authentik default OAuth Mapping: Application Entitlements** to **Selected Scopes**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements Use application entitlements to define the Mealie roles that authentik sends to Mealie. 1. Open the Mealie application that you created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create two entitlements, and note their names because they are required later: - `mealie-users` - `mealie-admins` 4. Expand the `mealie-users` entitlement, click **Bind existing group/user**, and bind the users or groups that should access Mealie. 5. Expand the `mealie-admins` entitlement, click **Bind existing group/user**, and bind the users or groups that should become Mealie administrators. Users with this entitlement do not also need the `mealie-users` entitlement. Mealie treats these values as identity provider groups, but authentik sends them from application entitlements. This keeps Mealie-specific authorization scoped to the Mealie application. ## Mealie configuration To enable OIDC login with Mealie, update your environment variables to include the following: ```env title=".env" OIDC_AUTH_ENABLED=true OIDC_PROVIDER_NAME=authentik OIDC_CONFIGURATION_URL=https://authentik.company/application/o//.well-known/openid-configuration OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_GROUPS_CLAIM=entitlements OIDC_USER_GROUP=mealie-users OIDC_ADMIN_GROUP=mealie-admins ``` Restart the Mealie service for the changes to take effect. ### Configure login behavior *(optional)* To redirect users directly to authentik from the Mealie login page, extend their sessions as if **Remember Me** was selected, and hide the username and password fields, add these environment variables: ```env title=".env" OIDC_AUTO_REDIRECT=true OIDC_REMEMBER_ME=true ALLOW_PASSWORD_LOGIN=false ``` Restart the Mealie service for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with Mealie, open Mealie and log in via authentik. In Mealie, click the user profile icon in the top-left corner. Then click **Members**, and confirm that users with the `mealie-admins` entitlement are **Admin** users in Mealie. ## Resources - [Mealie OpenID Connect authentication](https://docs.mealie.io/documentation/getting-started/authentication/oidc-v2/) - [Mealie backend configuration](https://docs.mealie.io/documentation/getting-started/installation/backend-config/#openid-connect-oidc) --- ## Integrate with NetBox ## What is NetBox? > NetBox is the world's most popular platform for understanding, operating, automating, and securing networks. > > \-- [https://netboxlabs.com/products/netbox/](https://netboxlabs.com/products/netbox/) ## Preparation The following placeholders are used in this guide: - `netbox.company` is the FQDN of the NetBox installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of NetBox with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://netbox.company/oauth/complete/oidc/`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure NetBox entitlements *(optional)* NetBox can create local groups from an OIDC `groups` claim by using a custom Social Auth pipeline. To control those groups with app-specific authentik grants, create an OAuth2 scope mapping that exposes application entitlements as the `groups` claim. 1. In authentik, navigate to **Customization** > **Property Mappings** and click **New Property Mapping**. 2. Select **OAuth2 Scope Mapping** and use the following values: - **Name**: `NetBox entitlements` - **Scope name**: `netbox` - **Expression**: ```python return { "name": request.user.name, "given_name": request.user.name, "preferred_username": request.user.username, "groups": [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ], } ``` 3. Open the NetBox provider that you created earlier and add `NetBox entitlements` to the selected **Scopes**. 4. Open the NetBox application and create the required **Application entitlements**. Use an entitlement named `superusers` for users that should receive NetBox superuser access through the optional pipeline below, and bind each entitlement to the users or groups that should receive it. ## NetBox configuration NetBox supports SSO through the `python-social-auth` library. Configure the generic OpenID Connect backend, then restart NetBox so the configuration is loaded. Use the authentik provider URL without `/.well-known/openid-configuration`. python-social-auth discovers the OpenID configuration from that endpoint. ### Configure NetBox Docker Add the following environment variables to your NetBox Docker environment file: ```env title=".env" REMOTE_AUTH_ENABLED=true REMOTE_AUTH_BACKEND=social_core.backends.open_id_connect.OpenIdConnectAuth SOCIAL_AUTH_OIDC_OIDC_ENDPOINT=https://authentik.company/application/o// SOCIAL_AUTH_OIDC_KEY= SOCIAL_AUTH_OIDC_SECRET= SOCIAL_AUTH_OIDC_SCOPE=openid email profile LOGOUT_REDIRECT_URL=https://authentik.company/application/o//end-session/ ``` If you configured the optional NetBox entitlements scope mapping, set `SOCIAL_AUTH_OIDC_SCOPE` to `openid email netbox`. ### Configure a non-Docker installation Add the following settings to the NetBox configuration file: ```python title="/opt/netbox/netbox/netbox/configuration.py" REMOTE_AUTH_ENABLED = True REMOTE_AUTH_BACKEND = "social_core.backends.open_id_connect.OpenIdConnectAuth" SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = "https://authentik.company/application/o//" SOCIAL_AUTH_OIDC_KEY = "" SOCIAL_AUTH_OIDC_SECRET = "" SOCIAL_AUTH_OIDC_SCOPE = ["openid", "email", "profile"] LOGOUT_REDIRECT_URL = "https://authentik.company/application/o//end-session/" SOCIAL_AUTH_BACKEND_ATTRS = { "oidc": ("authentik", "login"), } ``` If you configured the optional NetBox entitlements scope mapping, set `SOCIAL_AUTH_OIDC_SCOPE` to `["openid", "email", "netbox"]`. ### Sync groups and superuser status *(optional)* To manage NetBox groups from authentik, create a custom Social Auth pipeline. The default authentik `profile` scope exposes authentik group names as the `groups` claim. If you configured the optional NetBox entitlements scope mapping, the `netbox` scope exposes application entitlement names instead. Create `custom_pipeline.py` in the NetBox package directory. In the official NetBox Docker image, mount or add this file at `/opt/netbox/netbox/netbox/custom_pipeline.py`. ```python title="/opt/netbox/netbox/netbox/custom_pipeline.py" from users.models import Group SUPERUSER_GROUP = "superusers" def _claim_groups(response): groups = response.get("groups", []) if isinstance(groups, str): return {groups} return set(groups) def sync_groups(response, user, backend, *args, **kwargs): groups = [ Group.objects.get_or_create(name=group_name)[0] for group_name in sorted(_claim_groups(response)) ] user.groups.set(groups) def set_superuser(response, user, backend, *args, **kwargs): user.is_superuser = SUPERUSER_GROUP in _claim_groups(response) user.save(update_fields=["is_superuser"]) ``` Add the pipeline configuration to the NetBox configuration file. For NetBox Docker, place this setting in a Python configuration file that is loaded from the mounted `configuration/` directory, such as `configuration/authentik.py`. ```python title="/opt/netbox/netbox/netbox/configuration.py" SOCIAL_AUTH_PIPELINE = ( "social_core.pipeline.social_auth.social_details", "social_core.pipeline.social_auth.social_uid", "social_core.pipeline.social_auth.social_user", "social_core.pipeline.user.get_username", "social_core.pipeline.user.create_user", "social_core.pipeline.social_auth.associate_user", "netbox.authentication.user_default_groups_handler", "social_core.pipeline.social_auth.load_extra_data", "social_core.pipeline.user.user_details", "netbox.custom_pipeline.sync_groups", "netbox.custom_pipeline.set_superuser", ) ``` Restart NetBox after creating or updating the custom pipeline. ## Configuration verification To confirm that authentik is properly configured with NetBox, open NetBox and select **authentik** on the login page. After a successful login, NetBox opens. If you enabled the optional group sync pipeline, verify that the user has the expected NetBox groups and superuser status. ## Resources - [NetBox documentation - Authentication](https://netboxlabs.com/docs/netbox/administration/authentication/overview/) - [NetBox documentation - Configuration](https://netboxlabs.com/docs/netbox/configuration/) - [NetBox Docker - Configuration](https://github.com/netbox-community/netbox-docker/blob/release/configuration/configuration.py) - [Python Social Auth - OIDC](https://python-social-auth.readthedocs.io/en/latest/backends/oidc.html) --- ## Integrate with Notion ## What is Notion? > Notion is a workspace for notes, docs, projects, wikis, and collaboration. > > \-- [https://www.notion.com](https://www.notion.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. SAML SSO requires a Notion Business or Enterprise plan. SCIM provisioning requires a Notion Enterprise plan. Notion requires domain verification before SAML SSO can be enabled; domain verification is outside the scope of this guide. ## authentik configuration To support the integration of Notion with authentik, you need to create SAML property mappings and an application/provider pair in authentik. ### Create property mappings Notion uses the SAML NameID as the user's email address. It can also consume SAML attributes for the user's email address, first name, last name, and profile photo. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Create four **SAML Provider Property Mapping**s with the following settings: - **Email mapping**: - **Name**: `Notion emailAddress` - **SAML Attribute Name**: `emailAddress` - **Expression**: ```python return request.user.email ``` - **First name mapping**: - **Name**: `Notion firstName` - **SAML Attribute Name**: `firstName` - **Expression**: ```python name = request.user.name.strip() return name.split(" ", 1)[0] if name else request.user.username ``` - **Last name mapping**: - **Name**: `Notion lastName` - **SAML Attribute Name**: `lastName` - **Expression**: ```python name = request.user.name.strip() return name.rsplit(" ", 1)[1] if " " in name else "" ``` - **Profile photo mapping**: - **Name**: `Notion profilePhoto` - **SAML Attribute Name**: `profilePhoto` - **Expression**: ```python avatar = request.user.avatar if "://" not in avatar: return "" return avatar ``` ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to `https://temp.temp`. You will replace this after completing the Notion configuration. - Set **Audience** to `https://www.notion.so/sso/saml`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Set **Default NameID Policy** to `Email address`. - Add the four property mappings that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. If you add the SCIM provider as a backchannel provider later, only users who can view this application are synchronized. 3. Click **Submit** to save the new application and provider. ## Notion configuration ### Configure SAML SSO 1. Log in to Notion as a workspace owner. 2. Open the SAML SSO settings: - **Business Plan**: navigate to **Settings** > **General**. If you want access controlled through SAML or SCIM, remove all entries from **Allowed email domains**; otherwise, users with those domains can still join outside IdP provisioning. Then, open **Settings** > **Identity**. - **Enterprise Plan**: open the workspace switcher, select **Manage organization**, and open the **General** tab. 3. Enable **SAML SSO**. 4. In the SAML SSO configuration modal, under **Identity Provider Details**, select **Identity Provider URL** and enter `https://authentik.company/application/saml//metadata/`. 5. Copy the **Assertion Consumer Service (ACS) URL** from Notion. 6. Save the SAML SSO configuration. ### Update the authentik provider 1. In authentik, navigate to **Applications** > **Providers**. 2. Edit the SAML provider that you created for Notion. 3. Set **ACS URL** to the **Assertion Consumer Service (ACS) URL** that you copied from Notion. 4. Click **Update**. ### Create a SCIM API token *(optional)* You can configure SCIM provisioning to sync users and groups from authentik to Notion. Notion requires one SCIM API token per workspace. If you add the SCIM provider as a backchannel provider later, only users who can view this application are synchronized. 1. Log in to Notion as an Enterprise Plan organization owner. 2. Open the workspace switcher and select **Manage organization**. 3. In the **General** tab, select **SCIM provisioning**. 4. Copy an existing token or click **Add token** to create a new token. ### Create a SCIM property mapping *(optional)* Notion requires the SCIM `userName` field to contain the user's email address. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SCIM Provider Mapping** and click **Next**. 4. Enter the following values: - **Name**: `Notion SCIM user` - **Expression**: ```python given_name, family_name = request.user.name, " " formatted = request.user.name + " " if " " in request.user.name: given_name, _, family_name = request.user.name.partition(" ") formatted = request.user.name avatar = request.user.avatar photos = None if "://" in avatar: photos = [{"value": avatar, "type": "photo"}] emails = [] if request.user.email != "": emails = [{ "value": request.user.email, "type": "work", "primary": True, }] return { "userName": request.user.email, "name": { "formatted": formatted, "givenName": given_name, "familyName": family_name, }, "displayName": request.user.name, "photos": photos, "active": request.user.is_active, "emails": emails, } ``` 5. Click **Finish**. ### Create a SCIM provider *(optional)* 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **Create**. - **Choose a Provider type**: select **SCIM Provider** as the provider type. - **Configure the Provider**: provide a name for the provider, and the following required configurations. - **URL**: `https://api.notion.com/scim/v2` - **Token**: paste the SCIM API token from Notion. - Under **Attribute mapping**: - Remove `authentik default SCIM Mapping: User` from **Selected User Property Mappings** and add `Notion SCIM user`. - Under **Selected Group Property Mappings**, add `authentik default SCIM Mapping: Group`. 3. Click **Finish** to save the provider. ### Set the SCIM provider as a backchannel provider *(optional)* 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click the name of your Notion application. 3. Click the plus (+) icon next to **Backchannel Providers** and select the SCIM provider that you created. 4. Click **Save Changes**. ## Configuration verification To confirm that authentik is properly configured with Notion, open Notion and log in with SAML SSO. To confirm that SCIM is properly configured, open the Notion SCIM provider in authentik and click the run button on the **Full sync for SCIM provider** task. After the sync completes, verify that users with access to the Notion application are provisioned in Notion. ## Resources - [Notion Help Center - SAML SSO](https://www.notion.com/help/saml-sso-configuration) - [Notion Help Center - Set up Identity Provider (IdP) for SAML SSO](https://www.notion.com/help/set-up-identity-provider-for-saml-sso) - [Notion Help Center - Provision users & groups with SCIM](https://www.notion.com/help/provision-users-and-groups-with-scim) - [Notion Help Center - Set up Identity Provider (IdP) for SCIM](https://www.notion.com/help/set-up-identity-provider-for-scim) --- ## Integrate with Outline ## What is Outline? > Your team's knowledge base. > > \-- [https://www.getoutline.com](https://www.getoutline.com) ## Preparation The following placeholders are used in this guide: - `outline.company` is the FQDN of the Outline installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Outline with authentik, you need to create a scope mapping and an application/provider pair in authentik. ### Create an email verification scope mapping Outline requires the email scope to return a value of `email_verified: True`. As of [authentik 2025.10](/docs/releases/2025/v2025.10.md#default-oauth-scope-mappings), the default behavior is to return `email_verified: False`, so a custom scope mapping is required for Outline to allow authentication. Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification) for instructions on how to create the required custom scope mapping. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://outline.company/auth/oidc.callback`. - Under **Advanced protocol settings**: - Set the **Subject Mode** to **Based on the User's username**. - Add `OAuth Mapping: OpenID 'email' with "email_verified"` to the **Selected Scopes**. - Remove the `authentik default OAuth Mapping: OpenID 'email'` scope. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Outline configuration To configure Outline to use authentik, add the following variables to your Outline environment file: ```env title=".env" OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_AUTH_URI=https://authentik.company/application/o/authorize/ OIDC_TOKEN_URI=https://authentik.company/application/o/token/ OIDC_USERINFO_URI=https://authentik.company/application/o/userinfo/ OIDC_LOGOUT_URI=https://authentik.company/application/o//end-session/ OIDC_DISPLAY_NAME=authentik ``` Restart Outline to apply the changes. ## Configuration verification To confirm that authentik is properly configured with Outline, open Outline and log in with authentik. ## Resources - [Outline Hosting - OIDC](https://docs.getoutline.com/s/hosting/doc/oidc-8CPBm6uC0I) - [Outline Hosting - Authentication](https://docs.getoutline.com/s/hosting/doc/authentication-7ViKRmRY5o) --- ## Integrate with Paperless-ng ## What is Paperless-ng? > Paperless-ng is an application that indexes scanned documents, makes them searchable, and stores document metadata. It was a fork of the original Paperless project and is no longer maintained. > > \-- [https://github.com/jonaswinkler/paperless-ng](https://github.com/jonaswinkler/paperless-ng) Paperless-ng supports remote-user authentication through HTTP headers. This guide uses authentik as a forward auth proxy in front of Paperless-ng and configures Paperless-ng to trust the username header set by authentik. ## Preparation The following placeholders are used in this guide: - `paperless.company` is the FQDN of the Paperless-ng installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Paperless-ng signs in users based on the trusted remote-user header. Configure your reverse proxy so that requests from clients cannot set or override the `X-Authentik-Username` header before the request reaches Paperless-ng. Do not expose Paperless-ng directly to the internet when remote-user authentication is enabled. ## authentik configuration To support the integration of Paperless-ng with authentik, you need to create an application/provider pair in authentik. This guide assumes that Paperless-ng is already deployed behind a reverse proxy that supports authentik forward auth. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **Proxy Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **Mode** to **Forward auth (single application)**. - Set **External host** to `https://paperless.company`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure proxy outpost The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. Add the Paperless-ng application to a proxy outpost that will serve it: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Outposts**. 3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. 4. Under **Available Applications**, select the Paperless-ng application and move it to **Selected Applications**. 5. Click **Update** to save your changes. ## Paperless-ng configuration If you run Paperless-ng with Docker, add the following environment variables to `docker-compose.env`. For non-Docker installations, add the same values to `paperless.conf`. ```env title="docker-compose.env" PAPERLESS_ENABLE_HTTP_REMOTE_USER=true PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME=HTTP_X_AUTHENTIK_USERNAME PAPERLESS_LOGOUT_REDIRECT_URL=https://paperless.company/outpost.goauthentik.io/sign_out ``` To sign in to an existing Paperless-ng user, the authentik username must match the Paperless-ng username. If the username does not exist, Paperless-ng can create a separate user for the remote-user username. Configure your reverse proxy to use the authentik outpost as the forward auth endpoint for `https://paperless.company`. Requests to `/outpost.goauthentik.io` must be routed to the authentik outpost, and all other requests must be routed to Paperless-ng. After making these changes, restart Paperless-ng and reload your reverse proxy. ## Configuration verification To verify the login flow, open Paperless-ng. You should be redirected to authentik before the Paperless-ng web interface is shown. ## Resources - [Paperless-ng documentation - Configuration](https://paperless-ngx.readthedocs.io/en/ng-1.5.0/configuration.html) --- ## Integrate with Paperless-ngx ## What is Paperless-ngx? > Paperless-ngx is a community-supported open-source document management system that transforms your physical documents into a searchable online archive. > > \-- [https://docs.paperless-ngx.com/](https://docs.paperless-ngx.com/) ## Preparation The following placeholders are used in this guide: - `paperless.company` is the FQDN of the Paperless-ngx installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Paperless-ngx with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://paperless.company/accounts/oidc/authentik/login/callback/`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Paperless-ngx configuration Add the following settings to your Paperless-ngx configuration file: Paperless-ngx reads Docker configuration from `docker-compose.env`. ```env title="docker-compose.env" PAPERLESS_APPS=allauth.socialaccount.providers.openid_connect PAPERLESS_SOCIALACCOUNT_PROVIDERS={"openid_connect":{"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"authentik","name":"authentik","client_id":"","secret":"","settings":{"server_url":"https://authentik.company/application/o//.well-known/openid-configuration","fetch_userinfo":true}}],"SCOPE":["openid","profile","email"]}} PAPERLESS_LOGOUT_REDIRECT_URL=https://authentik.company/application/o//end-session/ PAPERLESS_SOCIAL_AUTO_SIGNUP=true PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS=true ``` Restart Paperless-ngx for the changes to take effect: ```shell docker compose down && docker compose up -d ``` For standalone installations, Paperless-ngx searches for `paperless.conf` in the following locations and uses the first file that it finds: - The path defined by `PAPERLESS_CONFIGURATION_PATH`. - `/path/to/paperless/paperless.conf`. - `/etc/paperless.conf`. - `/usr/local/etc/paperless.conf`. ```env title="paperless.conf" PAPERLESS_APPS=allauth.socialaccount.providers.openid_connect PAPERLESS_SOCIALACCOUNT_PROVIDERS={"openid_connect":{"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"authentik","name":"authentik","client_id":"","secret":"","settings":{"server_url":"https://authentik.company/application/o//.well-known/openid-configuration","fetch_userinfo":true}}],"SCOPE":["openid","profile","email"]}} PAPERLESS_LOGOUT_REDIRECT_URL=https://authentik.company/application/o//end-session/ PAPERLESS_SOCIAL_AUTO_SIGNUP=true PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS=true ``` Restart Paperless-ngx for the changes to take effect: ```shell sudo systemctl restart paperless-* ``` Remove `PAPERLESS_SOCIAL_AUTO_SIGNUP` if you want to allow only pre-created Paperless-ngx users to sign in with authentik. ### Link existing users *(optional)* To add authentik authentication to an existing Paperless-ngx user, log in to Paperless-ngx with local authentication, click the profile icon in the top-right, click **My Profile**, and then click **Connect new social account**. ### Configure group sync *(optional)* To sync groups from authentik, create matching groups in Paperless-ngx and add the following setting to your Paperless-ngx configuration file: ```env title="docker-compose.env or paperless.conf" PAPERLESS_SOCIAL_ACCOUNT_SYNC_GROUPS=true ``` With the default authentik `profile` scope, Paperless-ngx can read the `groups` claim. If you use a custom authentik scope mapping that publishes group names under another claim, set `PAPERLESS_SOCIAL_ACCOUNT_SYNC_GROUPS_CLAIM` to that claim name and include the scope that contains the claim in `PAPERLESS_SOCIALACCOUNT_PROVIDERS`. ### Disable local login *(optional)* After you have validated SSO, you can disable the Paperless-ngx username and password login form: ```env title="docker-compose.env or paperless.conf" PAPERLESS_DISABLE_REGULAR_LOGIN=true PAPERLESS_REDIRECT_LOGIN_TO_SSO=true ``` This does not disable the Django admin login or local credential authentication through the Paperless-ngx API. ## Configuration verification To confirm that authentik is properly configured with Paperless-ngx, open Paperless-ngx, click the **authentik** login button, and complete the authentik sign-in flow. ## Resources - [Paperless-ngx documentation - Configuration](https://docs.paperless-ngx.com/configuration/#authentication-sso) - [Paperless-ngx documentation - OpenID Connect and social authentication](https://docs.paperless-ngx.com/advanced_usage/#openid-connect-and-social-authentication) - [django-allauth documentation - OpenID Connect](https://docs.allauth.org/en/latest/socialaccount/providers/openid_connect.html) --- ## Integrate with Papra ## What is Papra? > An open-source document management platform designed to help you organize, secure, and archive your files effortlessly. > > \-- [https://papra.app/](https://papra.app/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `papra.company` is the FQDN of the Papra installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Papra with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://papra.company/api/auth/oauth2/callback/authentik`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Papra configuration To support the integration of Papra with authentik, add the following environment variable to your Papra deployment: ```env title=".env" AUTH_PROVIDERS_CUSTOMS=[{"providerId":"authentik","providerName":"authentik","providerIconUrl":"https://authentik.company/static/dist/assets/icons/icon.svg","clientId":"","clientSecret":"","type":"oidc","discoveryUrl":"https://authentik.company/application/o//.well-known/openid-configuration","scopes":["openid","profile","email"]}] ``` The `providerId` value must match the final segment of the redirect URI that you configured in authentik. Restart your Papra deployment to apply the configuration. ## Configuration verification To confirm that authentik is properly configured with Papra, open Papra and click **Login with authentik**. After you authenticate, Papra redirects you to the dashboard. ## Resources - [Papra Docs - Setup Custom OAuth2 Providers](https://docs.papra.app/guides/setup-custom-oauth2-providers/) --- ## Integrate with Snipe-IT ## What is Snipe-IT? > A free open source IT asset/license management system. > > \-- [https://snipeitapp.com](https://snipeitapp.com) ## Preparation The following placeholders are used in this guide: - `inventory.company` is the FQDN of the Snipe-IT installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Configure Snipe-IT with an HTTPS `APP_URL` before you enable SAML. Snipe-IT generates its SAML entity ID, ACS URL, SLS URL, and metadata URL from that value. If SAML login is enabled and you need to use Snipe-IT's local login form, open `https://inventory.company/login?nosaml`. ## authentik configuration To support the integration of Snipe-IT with authentik, you need an LDAP application/provider pair, an LDAP bind service account, an LDAP outpost, and a SAML application/provider pair. LDAP sync creates the Snipe-IT users, and SAML authenticates those users. ### Create an LDAP application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **LDAP Provider** as the provider type. - **Configure the Provider**: provide a name, select the bind flow, and note the **Base DN** because it will be required later. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create a service account 1. Navigate to **Directory** > **Users** and click **New User**. 2. Select **Service Account**. 3. Set **Username** to `snipeit-user`. 4. Click **Next**. 5. Copy the generated app password from the confirmation screen because it will be required later. If you configured bindings on the LDAP application, ensure that `snipeit-user` is allowed by those bindings so that Snipe-IT can bind to the LDAP provider. ### Assign LDAP search permissions 1. Navigate to **Directory** > **Roles** and click **Create**. 2. Create a role named `Snipe-IT LDAP search`. 3. Click the role that you created and open the **Users** tab. 4. Click **Add existing user**, select `snipeit-user`, and click **Assign**. 5. Navigate to **Applications** > **Providers**. 6. Click the LDAP provider that you created and open the **Permissions** tab. 7. Click **Assign Object Permissions**. 8. Select the role that you created, enable **Search full LDAP directory**, and click **Assign**. ### Create an LDAP outpost 1. Navigate to **Applications** > **Outposts** and click **New Outpost**. 2. Configure the following settings: - **Name**: enter a descriptive name, such as `Snipe-IT LDAP`. - **Type**: select **LDAP**. - **Applications**: select the LDAP application that you created. 3. Click **Create**. ### Create a SAML application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to `https://inventory.company/saml/acs`. - Set **Audience** to `https://inventory.company`. - Set **SLS URL** to `https://inventory.company/saml/sls`. - Under **Advanced protocol settings**, select any available **Signing Certificate** and enable **Sign assertions**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 2. Click **Submit** to save the new application and provider. ### Copy the SAML metadata URL 1. Navigate to **Applications** > **Providers**. 2. Click the SAML provider that you created. 3. Under **Related objects** > **Metadata**, click **Copy download URL**. ## Snipe-IT configuration ### Configure LDAP 1. Log in to Snipe-IT as an administrator. 2. Click the gear icon and select **LDAP**. 3. Configure the following settings: - **LDAP Integration**: enabled. - **LDAP Password Sync**: enabled. - **Active Directory**: disabled. - **LDAP Server**: `ldap://authentik.company`. - **LDAP Bind Username**: `cn=snipeit-user,ou=users,dc=ldap,dc=goauthentik,dc=io`. - **LDAP Bind Password**: enter the service account password from authentik. - **Base Bind DN**: `ou=users,dc=ldap,dc=goauthentik,dc=io`. - **LDAP Filter**: `&(objectClass=user)`. - **LDAP Username Field**: `mail`. - **LDAP Authentication query**: `mail=`. - **LDAP Last Name Field**: `sn`. - **LDAP First Name Field**: `givenname`. - **LDAP Email Field**: `mail`. 4. Click **Save**. 5. Click **Test LDAP Synchronization** to confirm that Snipe-IT can search the directory. 6. Enter an email address and password for an authentik user and click **Test LDAP Login** to confirm that Snipe-IT can authenticate through the LDAP provider. If you changed the LDAP provider **Base DN** in authentik, replace `dc=ldap,dc=goauthentik,dc=io` in the Snipe-IT settings with your configured Base DN. Snipe-IT imports users only when the mapped first name and last name values are present. authentik maps the LDAP `sn` attribute to the user's full name by default. To send a separate last name, employee number, department, or other Snipe-IT user field, add those values as custom user attributes in authentik. ### Synchronize users 1. In Snipe-IT, navigate to **People**. 2. Click **LDAP Sync**. 3. Select the location for the synchronized users. 4. Click **Synchronize**. ### Configure SAML 1. Click the gear icon and select **SAML**. 2. Configure the following settings: - **SAML enabled**: enabled. - **SAML IdP Metadata**: paste the SAML metadata URL from authentik. - **SAML Force Login**: enabled. - **SAML Single Log Out**: enabled. 3. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with Snipe-IT, open Snipe-IT, log out, and then log back in with SAML. Snipe-IT has a known issue validating signed SAML Single Logout messages, which produces the error `There was an error with SAML SLS: invalid_logout_response Reason: Signature validation failed. Logout Response rejected`. If you encounter this, add `security.logoutResponseSigned=false` to the **SAML Custom Settings** field on the Snipe-IT SAML settings page. See the [Snipe-IT SAML documentation](https://snipe-it.readme.io/docs/saml) for details. ## Resources - [Snipe-IT documentation - LDAP Sync & Login](https://snipe-it.readme.io/docs/ldap-sync-login) - [Snipe-IT documentation - SAML](https://snipe-it.readme.io/docs/saml) --- ## Integrate with Stirling PDF ## What is Stirling PDF? > Stirling PDF is an open-source PDF editor and processor for reading, editing, signing, converting, and automating PDF documents. > > \-- [https://stirling.com/](https://stirling.com/) ## Preparation The following placeholders are used in this guide: - `stirling-pdf.company` is the FQDN of the self-hosted Stirling PDF installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This guide applies to self-hosted Stirling PDF Server and Enterprise deployments. The hosted application at [https://stirling.com/app/](https://stirling.com/app/) uses Stirling-managed sign-in providers and does not use the self-hosted OIDC configuration in this guide. Before you begin, activate a Stirling PDF Server or Enterprise license and ensure that you can log in with a local administrator account. Keep local login enabled until you have verified the integration. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Stirling PDF with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` with a value of `https://stirling-pdf.company/login/oauth2/code/authentik`. - Select any available signing key. - **Configure Bindings** *(recommended)*: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to control which users can access Stirling PDF and be registered automatically. 3. Click **Submit** to save the new application and provider. ## Stirling PDF configuration Add the following environment variables to the Stirling PDF configuration: ```env title=".env" SYSTEM_BACKENDURL="https://stirling-pdf.company" SECURITY_ENABLELOGIN="true" SECURITY_OAUTH2_ENABLED="true" SECURITY_OAUTH2_ISSUER="https://authentik.company/application/o//" SECURITY_OAUTH2_CLIENTID="" SECURITY_OAUTH2_CLIENTSECRET="" SECURITY_OAUTH2_PROVIDER="authentik" ``` Restart Stirling PDF to apply the configuration. Stirling PDF automatically creates OIDC users with the standard user role. To grant administrative access to an OIDC user, first log in through authentik, then use the local administrator account to change that user's role on the **Users** page. ## Configuration verification To confirm that authentik is properly configured with Stirling PDF, open Stirling PDF and click **Sign in with Authentik**. After you authenticate, Stirling PDF creates the user account and opens the application. ## Resources - [Stirling PDF documentation - OAuth 2.0 Single Sign-On Configuration](https://docs.stirlingpdf.com/Configuration/OAuth%20SSO%20Configuration/) - [Stirling PDF documentation - Paid Offerings](https://docs.stirlingpdf.com/Paid-Offerings/) --- ## Integrate with Tandoor ## What is Tandoor? > Tandoor is a recipe manager for storing, searching, sharing, and planning recipes, shopping lists, and meal plans. > > \-- [https://tandoor.dev/](https://tandoor.dev/) ## Preparation The following placeholders are used in this guide: - `tandoor.company` is the FQDN of the Tandoor installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Tandoor with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, a slug, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value as it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://tandoor.company/accounts/oidc/authentik/login/callback/`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Tandoor configuration Add the following environment variables to your Tandoor configuration. Replace the placeholders with values from your authentik instance. ```env title=".env" SOCIAL_PROVIDERS=allauth.socialaccount.providers.openid_connect SOCIALACCOUNT_PROVIDERS='{"openid_connect":{"APPS":[{"provider_id":"authentik","name":"authentik","client_id":"","secret":"","settings":{"server_url":"https://authentik.company/application/o//.well-known/openid-configuration"}}]}}' ``` The `provider_id` value in the `SOCIALACCOUNT_PROVIDERS` configuration is `authentik`, which matches the redirect URI path that you configured in authentik. After the first social sign-in, use Tandoor to invite or assign the user to the appropriate recipe space. For private single-space instances, Tandoor also supports default access settings for social-login users; review the Tandoor documentation before enabling them because they apply to new social-login users. Restart the Tandoor service for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with Tandoor, log out of Tandoor, then use the **Sign in using authentik** button on the login page and verify that single sign-on succeeds. ## Resources - [Tandoor authentication documentation](https://docs.tandoor.dev/features/authentication/) - [Tandoor configuration documentation](https://docs.tandoor.dev/system/configuration/) - [django-allauth OpenID Connect provider documentation](https://docs.allauth.org/en/latest/socialaccount/providers/openid_connect.html) --- ## Integrate with Wiki.js ## What is Wiki.js? > Wiki.js is an open source wiki application built on Node.js for creating and managing documentation. > > \-- [https://js.wiki/](https://js.wiki/) ## Preparation The following placeholders are used in this guide: - `wiki.company` is the FQDN of the Wiki.js installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ### Get the callback URL In Wiki.js, open **Administration** > **Authentication**, add a **Generic OpenID Connect / OAuth2** strategy, and copy the **Callback URL / Redirect URI** from the **Configuration Reference** section. You will use this URL as the redirect URI in authentik. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Wiki.js with authentik, create an application/provider pair in authentik. If you want authentik to manage Wiki.js group membership, also create application entitlements and send them in a custom OIDC claim. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** because they will be required later. - Add the Wiki.js **Callback URL / Redirect URI** as a **Strict** **Authorization** redirect URI. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements *(optional)* Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to define the Wiki.js group names that authentik sends to Wiki.js. Skip this section if you want Wiki.js to manage groups locally. 1. Open the application that you created. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each Wiki.js group that users should receive, such as `Administrators`. 4. Open each entitlement and bind the users or groups that should receive it. The entitlement names must exactly match the Wiki.js group names. ### Create a group claim scope mapping *(optional)* Wiki.js can map users to groups from an array claim in the UserInfo response. To send the Wiki.js application entitlements as that claim, create a custom scope mapping. 1. In authentik, navigate to **Customization** > **Property Mappings** and click **New Property Mapping**. 2. Select **Scope Mapping**. 3. Provide a descriptive name. 4. Set **Scope name** to `profile`. 5. Set **Expression** to: ```python return { "wiki-groups": [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ] } ``` 6. Click **Create**. 7. Navigate to **Applications** > **Providers** and edit the Wiki.js provider. 8. Under **Advanced protocol settings**, select the new mapping in **Available Scopes** and move it to **Selected Scopes**. 9. Click **Save Changes**. ## Wiki.js configuration In Wiki.js, open the **Generic OpenID Connect / OAuth2** authentication strategy and configure these settings: - **Client ID**: `` - **Client Secret**: `` - **Authorization Endpoint URL**: `https://authentik.company/application/o/authorize/` - **Token Endpoint URL**: `https://authentik.company/application/o/token/` - **User Info Endpoint URL**: `https://authentik.company/application/o/userinfo/` - **Issuer**: `https://authentik.company/application/o//` - **Logout URL**: `https://authentik.company/application/o//end-session/` If users should be created automatically when they first sign in with authentik, enable **Allow self-registration** and select the Wiki.js group that new users should initially receive in **Assign to group**. In recent Wiki.js versions, **Assign to group** takes precedence over **Map Groups**. If you keep self-registration disabled, you must create users in Wiki.js manually and ensure their email addresses match their authentik email addresses. ### Map groups *(optional)* If you configured the `wiki-groups` scope mapping in authentik, configure these additional strategy settings: - **Map Groups**: Enabled - **Groups Claim**: `wiki-groups` When **Map Groups** is enabled, Wiki.js assigns the user to each matching Wiki.js group from the claim and removes the user from existing Wiki.js groups that are not present in the claim. If authentik uses a self-signed certificate, configure Wiki.js to trust the root certificate of your CA. ```env title=".env" NODE_EXTRA_CA_CERTS=/path/to/root-ca.pem ``` Save the authentication strategy. ## Configuration verification To confirm that authentik is properly configured with Wiki.js, open Wiki.js and log in with authentik. ## Resources - [Wiki.js authentication documentation](https://docs.requarks.io/auth) - [Wiki.js Generic OpenID Connect / OAuth2 strategy definition](https://github.com/Requarks/wiki/blob/main/server/modules/authentication/oidc/definition.yml) - [Wiki.js Generic OpenID Connect / OAuth2 strategy implementation](https://github.com/Requarks/wiki/blob/main/server/modules/authentication/oidc/authentication.js) --- ## Integrate with YouTrack ## What is YouTrack? > YouTrack is a project management and team collaboration tool for tracking tasks, managing projects, maintaining knowledge bases, supporting customers, and collaborating across teams. > > \-- [https://www.jetbrains.com/youtrack/](https://www.jetbrains.com/youtrack/) ## Preparation The following placeholders are used in this guide: - `youtrack.company` is the FQDN of the YouTrack installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of YouTrack with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** and **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Enable **Sign assertions**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Username`. Make sure that the [Allow users to change username](/docs/sys-mgmt/settings#allow-users-to-change-username) setting is disabled to prevent authentication issues. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Get the certificate fingerprint 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **System** > **Certificates** and expand the certificate that you selected in the previous section. 3. Take note of the **Certificate Fingerprint (SHA256)**. This value is required in the next section. ## YouTrack configuration 1. Log in to YouTrack as a Low-level Admin or higher. 2. Click the **Administration** cog near the bottom of the page, hover over **Access Management**, and then select **Auth Modules**. 3. Click **New module**, then select **SAML 2.0**. 4. Fill out the form with the following information: - **Name**: set a descriptive name, such as `authentik`. - **SAML SSO URL**: `https://authentik.company/application/saml//` - **IdP entity ID**: `https://authentik.company/application/saml//metadata/` - **Certificate fingerprint**: enter the **Certificate Fingerprint (SHA256)** value from authentik. 5. Click **Finish** to create the module. 6. Take note of the **ACS URL** and **SP entity ID** values that YouTrack generates. These values are required in the next section. 7. Click **Save** to apply the settings. 8. Click **Enable** to enable the module. ### Update the authentik provider 1. Return to the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the SAML provider that you created earlier. 3. Under **Protocol settings**, set the following values: - **ACS URL**: set to the **ACS URL** value from YouTrack. - **Audience**: set to the **SP entity ID** value from YouTrack. 4. Click **Update** to save the provider. 5. Return to the YouTrack SAML 2.0 auth module and click **Test login**. YouTrack should redirect you to authentik for authentication and then back to YouTrack. ## Configuration verification To confirm that authentik is properly configured with YouTrack, log out of YouTrack and sign in with the SAML 2.0 auth module. You should be redirected to authentik and, after authenticating, returned to YouTrack. ## Resources - [YouTrack Server Documentation - SAML 2.0 Auth Module](https://www.jetbrains.com/help/youtrack/server/saml-authentication-module.html) --- ## Integrate with Arcane ## What is Arcane? > Arcane is a modern Docker management platform that provides a web interface for managing containers, images, volumes, networks, projects, and related Docker workflows. > > \-- [https://getarcane.app/](https://getarcane.app/) ## Preparation The following placeholders are used in this guide: - `arcane.company` is the FQDN of the Arcane installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Arcane with authentik, you need to create an application/provider pair in authentik. ### Create custom scope mapping Arcane blocks account merging when an existing local account has the same email address as the OIDC user and the OIDC provider returns `email_verified: false`. If you plan to enable account merging in Arcane, create a custom email scope mapping that returns `email_verified: true`. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. - **Select type**: select **Scope Mapping**. - **Configure the Scope Mapping**: Provide a descriptive name (e.g. `Arcane Email Scope`), and an optional description. - **Scope name**: `email` - **Expression**: ```python showLineNumbers return { "email": request.user.email, "email_verified": True } ``` 3. Click **Finish** to save the property mapping. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://arcane.company/auth/oidc/callback`. - Select any available signing key. - Under **Advanced protocol settings**: - If you created the custom scope mapping, remove the `authentik default OAuth Mapping: OpenID 'email'` scope, and add the custom scope mapping. - If you plan to configure Arcane role mappings, add the `authentik default OAuth Mapping: Application Entitlements` scope mapping. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements *(optional)* If you want Arcane to assign roles from authentik, create one application entitlement for each Arcane role mapping that you plan to configure. 1. In the authentik Admin interface, navigate to **Applications** > **Applications** and click the Arcane application. 2. Click the **Application entitlements** tab, and then click **Create entitlement**. 3. Enter a name for the entitlement, such as `arcane-admins`, and click **Create**. 4. Expand the entitlement details, click **Bind existing group/user**, and bind the entitlement to the users or groups that should receive the matching Arcane role. ## Arcane configuration Arcane can be configured from the web interface or with environment variables. Use the web interface unless you manage Arcane configuration through deployment files. ### Configure OIDC in the web interface 1. Log in to Arcane as an administrator. 2. Navigate to **Settings** > **Security** > **OIDC Authentication**. 3. Configure the following values: - **Enable OIDC Authentication**: enable this option. - **OIDC Client ID**: enter the **Client ID** from authentik. - **OIDC Client Secret**: enter the **Client Secret** from authentik. - **OIDC Issuer URL**: `https://authentik.company/application/o/` - **Provider Display Name**: `authentik` - **OIDC Account Merging**: enable this option if you want OIDC logins to link to existing Arcane accounts by matching email address. If you enable this option, use the custom email scope mapping in the authentik provider. 4. Copy the **Redirect URI** shown by Arcane and verify that it matches `https://arcane.company/auth/oidc/callback`. 5. Save and test the connection. ### Configure environment variables *(optional)* Add the following environment variables to your Arcane `.env` file: ```env title=".env" APP_URL=https://arcane.company OIDC_ENABLED=true OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_ISSUER_URL=https://authentik.company/application/o/ OIDC_PROVIDER_NAME=authentik OIDC_SCOPES="openid email profile" ``` If you want OIDC logins to link to existing Arcane accounts by matching email address, also add the following setting and use the custom email scope mapping in the authentik provider: ```env title=".env" OIDC_MERGE_ACCOUNTS=true ``` Restart Arcane to apply the changes. ### Configure role mappings *(optional)* Arcane can map OIDC claim values to Arcane roles. This guide uses authentik application entitlements as the source of those claim values. If you configured Arcane in the web interface: 1. In Arcane, navigate to **Settings** > **Security** > **OIDC Authentication**. 2. Set **Scopes** to `openid email profile entitlements`. 3. Set **OIDC Groups Claim** to `roles`. 4. Under **OIDC Mappings**, click **Create OIDC mapping**. 5. Set **Claim value** to the authentik application entitlement name, select the Arcane **Role**, select the **Environment scope**, and save the mapping. If you configured Arcane with environment variables, update your `.env` file: ```env title=".env" OIDC_SCOPES="openid email profile entitlements" OIDC_GROUPS_CLAIM=roles OIDC_ROLE_MAPPINGS='[{"claimValue":"arcane-admins","roleId":"role_admin"}]' ``` Restart Arcane to apply the changes. ## Configuration verification To confirm that authentik is properly configured with Arcane, open Arcane and select **Sign in with authentik**. ## Resources - [Arcane Docs - OIDC Single Sign-On](https://getarcane.app/docs/configuration/sso) --- ## Integrate with Incus ## What is Incus? > Incus is an open-source manager for Linux system containers, application containers, and virtual machines. > > \-- [https://linuxcontainers.org/incus/](https://linuxcontainers.org/incus/) ## Preparation The following placeholders are used in this guide: - `incus.company` is the FQDN of the Incus server. - `authentik.company` is the FQDN of the authentik installation. By default, every user who authenticates through the configured OIDC provider has full access to Incus. Before allowing untrusted users to authenticate, configure Incus to authorize OIDC clients with OpenFGA, which is the only authorization method that Incus supports for OIDC clients. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Incus with authentik, you need to create an application/provider pair and configure a device code flow in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** value because it is required later. - Set **Client type** to `Public`. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://incus.company/oidc/callback`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://incus.company`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage access to Incus and its listing on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. If users access Incus through a port other than `443`, include that port in both redirect URIs. For example, use `https://incus.company:8443/oidc/callback` and `https://incus.company:8443` when connecting directly to the Incus server on port `8443`. ### Apply a device code flow The Incus CLI uses the OAuth device authorization grant, which requires a device code flow on the brand that serves `authentik.company`. This flow is set per brand and is shared by every application that uses this grant, so it is not specific to Incus. If the brand already has one, skip this section; otherwise follow [Create and apply a device code flow](/docs/add-secure-apps/providers/oauth2/device_code/#create-and-apply-a-device-code-flow). ## Incus configuration From an Incus client that has administrative access to the server, set the authentik issuer and the Incus provider's client ID: ```bash incus config set oidc.issuer "https://authentik.company/application/o//" incus config set oidc.client.id "" ``` If you use an Incus cluster, these settings are applied to all cluster members. ## Configuration verification To confirm that authentik is properly configured with Incus, add the Incus server as a remote from a client that is not already trusted: ```bash incus remote add incus https://incus.company ``` Follow the displayed URL to complete the device code flow in authentik. After authentication, run `incus list incus:` and confirm that Incus returns the instance list. ## Resources - [Incus documentation - Remote API authentication](https://linuxcontainers.org/incus/docs/main/authentication/#openid-connect-authentication) - [Incus documentation - OpenID Connect server configuration](https://linuxcontainers.org/incus/docs/main/server_config/#openid-connect-configuration) - [Incus documentation - Authorization](https://linuxcontainers.org/incus/docs/main/authorization/) --- ## Integrate with Portainer ## What is Portainer? > Portainer is the operational control plane that lets enterprise IT teams run Kubernetes and Docker environments consistently, safely, predictably, and at scale. > > \-- [https://www.portainer.io/](https://www.portainer.io/) ## Preparation The following placeholders are used in this guide: - `portainer.company` is the FQDN of the Portainer installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Portainer with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` with the value `https://portainer.company/`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Portainer configuration 1. Log in to Portainer as a user with administrative privileges. 2. Navigate to **Settings** > **Authentication**. 3. Under **Authentication method**, select **OAuth**. 4. Configure the following settings: - **Use SSO**: enabled. - **Automatic user provisioning**: enabled. 5. Under **Provider**, select **Custom**. 6. Under **OAuth Configuration**, enter the following values: - **Client ID**: the **Client ID** from the authentik provider. - **Client Secret**: the **Client Secret** from the authentik provider. - **Authorization URL**: `https://authentik.company/application/o/authorize/` - **Access Token URL**: `https://authentik.company/application/o/token/` - **Resource URL**: `https://authentik.company/application/o/userinfo/` - **Redirect URL**: `https://portainer.company/` - **Logout URL**: `https://authentik.company/application/o//end-session/` - **User Identifier**: `preferred_username`, or `email` if you prefer to use email addresses as identifiers. - **Scopes**: `openid profile email` 7. Click **Save settings**. Do not use commas in the **Scopes** field. Use spaces only. ### Configure automatic team membership *(optional)* If you are using [Portainer Business Edition (BE)](https://www.portainer.io/take-3), it is possible to configure automatic team membership. This allows you to grant access to teams and environments, and automatically grant admin access to certain users based on authentik application entitlements. It is only possible to configure automatic group membership in Portainer BE. This cannot be configured in the Community Edition. This section assumes that you already have two teams configured in Portainer: `engineering` and `sysadmins`. See [Portainer's documentation](https://docs.portainer.io/admin/user/teams) for information on managing teams and access to environments based on team membership. This section also assumes that two application entitlements have been created in authentik: `Portainer Admins` and `Portainer Users`. You can choose any entitlement names and replace `Portainer Admins` and `Portainer Users` later in this guide with your chosen names. #### Create application entitlements 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and open the Portainer application. 3. Click the **Application entitlements** tab. 4. Create two entitlements named `Portainer Admins` and `Portainer Users`. 5. Open each entitlement and bind the users or groups that should receive it. #### Create a property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. - **Select type**: select **Scope Mapping**. - **Configure the Scope Mapping**: Provide a descriptive name (e.g. `authentik portainer OpenID Mapping: OAuth 'groups'`), and an optional description. - **Scope name**: `groups` - **Expression**: ```python showLineNumbers entitlement_names = { entitlement.name for entitlement in request.user.app_entitlements(provider.application) } groups = [] if "Portainer Admins" in entitlement_names: groups.append("admin") if "Portainer Users" in entitlement_names: groups.append("user") return { "groups": groups } ``` This expression filters on the entitlement names `Portainer Admins` and `Portainer Users`. You can use any entitlements that exist on the Portainer application. Ensure that the names entered here exactly match those set up in authentik, as they are case-sensitive. 3. Click **Finish**. 4. Navigate to **Applications** > **Providers**. 5. Select your provider for Portainer and click **Edit**. 6. Under **Advanced protocol settings** > **Scopes**, add the property mapping created in the previous step to **Selected Scopes**. 7. Click **Update** to save your changes to the provider. Since access to Portainer is based on application entitlements, configure a [binding](/docs/add-secure-apps/bindings-overview/) for the application in authentik so that access is restricted to the same users or groups that should be able to sign in to Portainer. #### Update the Portainer settings 1. Log in to Portainer as a user with administrative privileges. 2. Navigate to **Settings** > **Authentication**. 3. Under **Team Membership**, toggle **Automatic team membership** to **ON**, and complete configuration as follows: - **Claim name**: `groups` - **Statically assigned teams**: Add two team mappings with the following values: - **claim value regex** `^user$` **maps to team** `engineering`. - **claim value regex** `^admin$` **maps to team** `sysadmins`. - **Default team**: `engineering` - **Admin mapping**: - Toggle **Assign admin rights to group(s)** to **ON**. - Add one admin mapping and set **claim value regex** to `^admin$`. 4. Under **Provider** > **OAuth Configuration**, append `groups` to **Scopes**. The full value for **Scopes** should then be `openid profile email groups`. 5. Click **Save settings**. ## Configuration verification To verify the integration of authentik with Portainer, log out of Portainer, then on the login page click **Login with OAuth**. You should be redirected to authentik and, after successful authentication, automatically logged in to Portainer. ## Resources - [Portainer Documentation - Authenticate via OAuth](https://docs.portainer.io/admin/settings/authentication/oauth) - [Portainer Documentation - Add a new team](https://docs.portainer.io/admin/user/teams/add) - [Portainer Documentation - Manage access to environments](https://docs.portainer.io/admin/environments/access) --- ## Integrate with Proxmox VE ## What is Proxmox VE? > Proxmox VE is an open-source virtualization platform for managing virtual machines, containers, storage, and networks from a web interface or CLI. > > \-- [https://www.proxmox.com/en/products/proxmox-virtual-environment](https://www.proxmox.com/en/products/proxmox-virtual-environment) ## Preparation The following placeholders are used in this guide: - `proxmox.company` is the FQDN of the Proxmox VE installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Proxmox VE with authentik, you need to create an application/provider pair in authentik. If you want Proxmox VE to map permissions from OIDC group data, you can also create application entitlements. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug**, because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations: - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://proxmox.company:8006`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements *(optional)* Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) if you want authentik to send Proxmox VE group values for permission mapping. 1. Open the Proxmox VE application in authentik. 2. Click the **Application entitlements** tab. 3. Create entitlements for the Proxmox VE groups that authentik should send, then bind each entitlement to the appropriate users or groups. Use Proxmox VE-compatible group names, such as `pve-admins`. 4. Navigate to **Applications** > **Providers**. 5. Select your provider for Proxmox VE and click **Edit**. 6. Under **Advanced protocol settings** > **Selected Scopes**, add `authentik default OAuth Mapping: OpenID 'entitlements'`. 7. Click **Update**. Proxmox VE appends `-` to OIDC group names. For example, with a Proxmox VE realm named `authentik`, an entitlement named `pve-admins` is mapped as the Proxmox VE group `pve-admins-authentik`. ## Proxmox VE configuration ### Configure the realm in the web interface 1. Log in to the Proxmox VE web interface using an administrative account. 2. Navigate to **Datacenter** > **Permissions** > **Realms**. 3. Click **Add** and select **OpenID Connect Server**. 4. Configure the following settings: - **Issuer URL**: `https://authentik.company/application/o//` - **Realm**: enter a name for this authentication source, such as `authentik`. - **Client ID**: enter the **Client ID** from the authentik provider. - **Client Key**: enter the **Client Secret** from the authentik provider. - **Username Claim**: select `username`. - **Autocreate Users**: enable this option if Proxmox VE should create users during their first login. - **Default**: enable this option if this realm should be pre-selected on the login screen. 5. If you created application entitlements for Proxmox VE group mapping, also configure the following settings: - **Scopes**: `email profile entitlements` - **Groups Claim**: `entitlements` - **Autocreate Groups**: enable this option if Proxmox VE should create groups during login when they do not already exist. 6. Click **Add** to save the realm. ### Configure the realm with the CLI *(optional)* To configure the OpenID Connect realm from the CLI, SSH into any Proxmox VE cluster node and run the following command: ```bash pveum realm add authentik \ --type openid \ --issuer-url https://authentik.company/application/o// \ --client-id "" \ --client-key "" \ --username-claim username \ --autocreate 1 ``` If you created application entitlements for Proxmox VE group mapping, add the following options to the command: ```bash --scopes "email profile entitlements" --groups-claim entitlements --groups-autocreate 1 ``` ### Assign permissions After the realm is configured, go to **Datacenter** > **Permissions** and assign roles to the users or groups that should access Proxmox VE resources. ## Configuration verification To verify the integration of authentik with Proxmox VE, log out of Proxmox VE, select the authentik realm on the login page, and sign in. If you set the authentik realm as the default, it is automatically selected on the login page. ## Resources - [Proxmox VE documentation - User Management](https://pve.proxmox.com/pve-docs/chapter-pveum.html) - [Proxmox VE documentation - pveum](https://pve.proxmox.com/pve-docs/pveum.1.html) - [Proxmox VE source - OpenID authentication plugin](https://github.com/proxmox/pve-access-control/blob/master/src/PVE/Auth/OpenId.pm) - [Proxmox VE source - OpenID realm form](https://github.com/proxmox/pve-manager/blob/master/www/manager6/dc/AuthEditOpenId.js) --- ## Integrate with Rancher ## What is Rancher? > Rancher is a complete software stack for teams adopting containers. > > \-- [https://www.rancher.com/](https://www.rancher.com/) ## Preparation The following placeholders are used in this guide: - `rancher.company` is the FQDN of the Rancher installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Rancher with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - Set **Launch URL** to `https://rancher.company`. - Note the **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://rancher.company/verify-auth`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. Rancher uses the OIDC `sub` claim as its unique user identifier. After users have logged in with this provider, keep the authentik provider's subject mode stable unless you plan to remap users in Rancher. ## Rancher configuration 1. Log in to Rancher as an administrator. 2. In the upper-left corner, click ☰ > **Users & Authentication**. 3. In the left navigation menu, click **Auth Provider**, then select **Generic OIDC**. 4. Complete the **Configure an OIDC account** form with the following values: - **Client ID**: enter the Client ID from authentik. - **Client Secret**: enter the Client Secret from authentik. - **Rancher URL**: `https://rancher.company/verify-auth`. - **Issuer**: `https://authentik.company/application/o//`. - **Scopes**: `openid profile email`. - **Rancher API Host**: if this field is shown, enter `https://rancher.company`. 5. If you changed the default OIDC claim names in authentik, use Rancher's custom claim fields to map the `name`, `email`, or `groups` claims. Rancher can use authentik's default `groups` claim without additional configuration. 6. Click **Enable**. Rancher redirects you to authentik to validate the configuration. ## Configuration verification To confirm that authentik is properly configured with Rancher, open Rancher and log in with authentik. ## Resources - [Rancher documentation - Configure Generic OIDC](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc) --- ## Integrate with VMware Cloud Director ## What is VMware Cloud Director? > VMware Cloud Director is a platform that enables service providers and enterprises to create multi-tenant virtual data centers (VDCs) from underlying VMware vSphere infrastructure. It supports self-service resource provisioning, secure tenant isolation, and management of compute, storage, and networking via web portals and APIs. > > \-- [https://www.vmware.com/products/cloud-infrastructure/cloud-director](https://www.vmware.com/products/cloud-infrastructure/cloud-director) ## Preparation The following placeholders are used in this guide: - `clouddirector.company` is the FQDN of the VMware Cloud Director instance. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of VMware Cloud Director with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization`: - For a provider-level integration, use `https://clouddirector.company/login/oauth?service=provider`. - For a tenant-level integration, use `https://clouddirector.company/login/oauth?service=tenant:`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Open the provider that you created and note the **OpenID Configuration URL** value because it will be required later. ## VMware Cloud Director configuration 1. Log in to VMware Cloud Director with your local administrator account. 2. Navigate to **Administration** > **Identity Providers** > **OIDC**. 3. If you are configuring OIDC for the first time, confirm that the client configuration redirect URI matches the redirect URI that you configured in authentik. For tenant-level configuration, VMware Cloud Director displays the organization-specific URI. 4. Click **Configure**. 5. In the wizard, configure the following values: - **Client ID**: enter the Client ID from authentik. - **Client Secret**: enter the Client Secret from authentik. - **Configuration Discovery**: enable this option. - **IDP Well-known Configuration Endpoint**: enter the **OpenID Configuration URL** from the authentik provider. 6. Click **Next**. 7. On the **Endpoint** page, VMware Cloud Director fills the endpoint values from the **IDP Well-known Configuration Endpoint**. Confirm the values, then click **Next**. 8. On the **Scopes** page, keep `openid`, `profile`, and `email`. Add any additional scopes that your environment requires, then click **Next**. 9. On the **Claim Mapping** page, make sure that the user and group claim names match the claims from authentik. The authentik `profile` scope includes a `groups` claim containing the user's authentik group names. Click **Next**. 10. On the **Key Configuration** page, enable **Automatic Key Refresh** if you want VMware Cloud Director to refresh signing keys from authentik automatically. Configure the **Key Refresh Period** and **Key Refresh Strategy** for your environment, then click **Next**. 11. On the **Button Label** page, optionally customize the label that appears on the login page, then click **Save**. ### Map groups to roles VMware Cloud Director authorizes OIDC users through imported users or groups that are assigned to Cloud Director roles. To use authentik group membership for authorization, import the relevant authentik groups and map each group to a role. 1. Navigate to the group management page: - For a provider-level integration, navigate to **Administration** > **Provider Access Control** > **Groups**. - For a tenant-level integration, navigate to **Administration** > **Access Control** > **Groups**. 2. Click **Import Groups** and configure the following values: - **Source**: select **OIDC**. - **Enter the group names**: enter each authentik group name on a separate line. - **Assign Role**: select the Cloud Director role to assign to the imported groups. 3. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with VMware Cloud Director, log out of Cloud Director and log back in using **Sign in with OIDC**. If you configured a custom button label, use that button instead. ## Resources - [VMware Cloud Director documentation - Configure your system to use an OpenID Connect identity provider](https://techdocs.broadcom.com/us/en/vmware-cis/cloud-director/vmware-cloud-director/10-6/configure-your-system-to-use-an-openid-connect-identity-provider.html) - [VMware Cloud Director documentation - Configure your system to use an OpenID Connect identity provider using your tenant portal](https://techdocs.broadcom.com/us/en/vmware-cis/cloud-director/vmware-cloud-director/10-6/map-for-vmware-cloud-director-tenant-portal-guide-10-6/configuring-identity-providers-using-your-tenant-portal-tenant/configure-your-system-to-use-an-openid-connect-identity-provider-tenant.html) --- ## Integrate with VMware vCenter ## What is VMware vCenter? > VMware vCenter Server provides centralized management for VMware vSphere infrastructure, including ESXi hosts, virtual machines, and dependent services. > > \-- [https://www.vmware.com/products/cloud-infrastructure/vcenter/future-overview](https://www.vmware.com/products/cloud-infrastructure/vcenter/future-overview) ## Preparation The following placeholders are used in this guide: - `vcenter.company` is the FQDN of the VMware vCenter server. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This guide uses the VMware vCenter Okta identity provider flow with authentik as the OIDC and SCIM provider. VMware vCenter requires vSphere 8.0 Update 1 or later for this flow. Before starting, verify that VMware Identity Services are active, that vCenter can reach authentik's OIDC endpoints, and that authentik can reach the vCenter Tenant URL for SCIM provisioning. ## authentik configuration To support the integration of VMware vCenter with authentik, you need to create an application/provider pair in authentik. After vCenter generates the SCIM details, you will also create a SCIM provider and attach it to the application. ### Create an application and provider In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily add a **Redirect URI** of type `Strict` `Authorization` as `https://temp.temp`. You will replace this with the redirect URI generated by vCenter. - Select any available signing key. - Note the **Client ID** and **Client Secret** values because they are required later. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. If you add the SCIM provider as a backchannel provider later, only users who can view this application are synchronized. 3. Click **Submit** to save the new application and provider. 4. Open the OAuth2/OpenID provider that you created and note the **OpenID Configuration URL** value because it is required later. ## VMware vCenter configuration ### Configure the identity provider 1. Log in to the vSphere Client as an administrator. 2. Navigate to **Administration** > **Single Sign On** > **Configuration**. 3. Click **Change Provider**, then select **Okta**. 4. In the **Configure Main Identity Provider** wizard, review the prerequisites and click **Run Prechecks**. 5. After the precheck passes, select the confirmation checkbox and click **Next**. 6. On the **Directory Information** page, configure the following settings: - **Directory Name**: enter a descriptive name, such as `authentik`. - **Domain Name(s)**: enter the domain that contains the users and groups that you will synchronize from authentik, then click the plus (+) icon to add it. 7. Click **Next**. 8. On the **OpenID Connect** page, configure the following settings: - **Identity Provider Name**: `authentik` - **Client Identifier**: enter the **Client ID** value from authentik. - **Shared Secret**: enter the **Client Secret** value from authentik. - **OpenID Address**: enter the **OpenID Configuration URL** value from authentik. 9. Click **Next**, review the configuration, then click **Finish**. ### Collect generated values 1. On the **Single Sign On** > **Configuration** page, copy the **Redirect URI** value and save it for the next section. 2. Copy the **Tenant URL** value and save it for the SCIM provider configuration. 3. Under **User Provisioning**, click **Generate** to create a secret token. 4. Select the token lifespan, click **Copy to Clipboard**, and save the token in a secure location. ### Update the authentik provider 1. Return to the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the OAuth2/OpenID provider that you created. 3. Click **Edit**. 4. Replace the temporary **Redirect URI** value with the **Redirect URI** value from vCenter. Use the `Strict` matching mode and `Authorization` redirect URI type. 5. Click **Update**. ### Create a SCIM provider 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click **Create**. 2. Select **SCIM Provider** as the provider type and click **Next**. 3. Configure the following settings: - **Name**: provide a descriptive name. - **URL**: enter the **Tenant URL** value from vCenter. - **Token**: enter the secret token that you generated in vCenter. - **Verify SCIM server's certificates**: turn this off only if authentik cannot validate the certificate presented by vCenter. - **Compatibility Mode**: select **vCenter**. - **Group Filter**: select the authentik groups that should be synchronized to vCenter. 4. Click **Create**. 5. Navigate to **Applications** > **Applications** and open the VMware vCenter application. 6. Add the SCIM provider to **Backchannel Providers**. 7. Open the VMware vCenter SCIM provider and click the run button on the **Full sync for SCIM provider** task. ### Assign permissions 1. Return to the vSphere Client. 2. Navigate to **Administration** > **Access Control** > **Global Permissions**. 3. Click **Add**. 4. Select the domain that you created during the Okta identity provider configuration. 5. Enter the name of the synchronized user or group that should receive access. 6. Select the role to assign. The minimum role required for login is **Read-only**. 7. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with VMware vCenter, log out and open VMware vCenter. Sign in with the external identity provider, complete the authentik flow, and confirm that vCenter opens with the expected permissions. To confirm that SCIM is properly configured, open the VMware vCenter SCIM provider in authentik and verify that the latest sync completed without errors. In vCenter, confirm that synchronized users and groups are available when assigning permissions. ## Resources - [Broadcom TechDocs - Configure vCenter Server Identity Provider Federation for Okta](https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-authentication/vsphere-authentication-with-vcenter-single-sign-on-authentication/configuring-vcenter-server-identity-provider-federation-authentication/configure-vcenter-server-identity-provider-federation-for-okta-authentication.html) - [Broadcom Support - How to Enable Okta for vCenter Server](https://knowledge.broadcom.com/external/article/322197/how-to-enable-okta-for-vcenter-server.html) --- ## Integrate with Xen Orchestra ## What is Xen Orchestra? > Xen Orchestra provides a user-friendly web interface for every Xen-based hypervisor, including XenServer and XCP-ng. > > \-- [https://xen-orchestra.com/](https://xen-orchestra.com/) ## Preparation Xen Orchestra supports authentication plugins for OpenID Connect (OIDC), SAML, and LDAP. This guide uses the `auth-oidc` plugin. Xen Orchestra Appliance (XOA) includes this plugin. If you run Xen Orchestra from source, ensure that the `xo-server-auth-oidc` package is installed. The following placeholders are used in this guide: - `xenorchestra.company` is the FQDN of the Xen Orchestra installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Xen Orchestra with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://xenorchestra.company/signin/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure group claims *(optional)* Xen Orchestra can synchronize OIDC `groups` claim values to Xen Orchestra groups. Use application entitlements to keep these group values scoped to this Xen Orchestra application. 1. Open the Xen Orchestra application that you created in authentik. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each Xen Orchestra group value that authentik should send. 4. Bind the appropriate users or groups to each entitlement. 5. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **Scope Mapping** with the following settings: - **Name**: choose a descriptive name, such as `authentik Xen Orchestra OAuth Mapping: OpenID 'profile'`. - **Scope name**: `profile` - **Expression**: ```python showLineNumbers return { "name": request.user.name, "given_name": request.user.name, "preferred_username": request.user.username, "nickname": request.user.username, "groups": sorted( entitlement.name for entitlement in request.user.app_entitlements(provider.application) ), } ``` 6. Click **Finish**. 7. Navigate to **Applications** > **Providers** and edit the Xen Orchestra provider. 8. Under **Advanced protocol settings** > **Selected Scopes**, remove `authentik default OAuth Mapping: OpenID 'profile'` and add the scope mapping that you just created. 9. Click **Update**. ## Xen Orchestra configuration 1. Log in to Xen Orchestra as an administrator. 2. Navigate to **Settings** > **Plugins**. 3. Find the `auth-oidc` plugin and click **+** next to the plugin name to expand the configuration options. 4. Configure the following settings: - **Auto-discovery URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Client identifier (key)**: enter the Client ID from authentik. - **Client secret**: enter the Client Secret from authentik. - **Fill information (optional)**: select this option to show the advanced fields. - **Scopes**: `profile email` 5. Click **Save configuration**. 6. Toggle the switch next to the `auth-oidc` plugin name to enable it. If you want Xen Orchestra to identify users by their email addresses instead of their authentik usernames, set **Username field** to `email`. The first time a user signs in with OpenID Connect, Xen Orchestra creates a user without permissions. Assign the required ACLs to the user or to synchronized OIDC groups in Xen Orchestra. ## Configuration verification To confirm that authentik is properly configured with Xen Orchestra, log out of Xen Orchestra and click **Sign in with OpenID Connect** on the login page. You should be redirected to authentik and returned to Xen Orchestra after authentication. ## Resources - [Xen Orchestra Documentation - Users](https://docs.xen-orchestra.com/xo5/users#openid-connect) - [Xen Orchestra GitHub - auth-oidc plugin](https://github.com/vatesfr/xen-orchestra/tree/master/packages/xo-server-auth-oidc) --- ## Integrate with Apache Guacamole ## What is Apache Guacamole? > Apache Guacamole is a clientless remote desktop gateway. It supports standard protocols like VNC, RDP, and SSH. > > \-- [https://guacamole.apache.org/](https://guacamole.apache.org/) ## Preparation The following placeholders are used in this guide: - `guacamole.company` is the FQDN of the Guacamole installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Apache Guacamole with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** value because it will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://guacamole.company/`. If users access Apache Guacamole on a subpath, use the full URL that users enter in their browser. - Select any available signing key. - If you customize token validity, keep the **Access Token validity** at 300 minutes or less. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Apache Guacamole configuration Create an administrator account in Apache Guacamole before configuring single sign-on. Use the same username as the authentik user that will administer Apache Guacamole, and grant that user administrator permissions. This keeps the admin settings reachable if you need to revert the OpenID Connect configuration. This guide uses `preferred_username` as the Apache Guacamole user identifier. Ensure that the authentik [**Allow users to change username** setting](https://docs.goauthentik.io/docs/sys-mgmt/settings#allow-users-to-change-username) is disabled to prevent users from being mapped to a different Apache Guacamole account after a username change. Add the following variables to your Apache Guacamole environment file: ```env title=".env" OPENID_ENABLED=true OPENID_AUTHORIZATION_ENDPOINT=https://authentik.company/application/o/authorize/ OPENID_JWKS_ENDPOINT=https://authentik.company/application/o//jwks/ OPENID_ISSUER=https://authentik.company/application/o// OPENID_CLIENT_ID= OPENID_REDIRECT_URI=https://guacamole.company/ OPENID_USERNAME_CLAIM_TYPE=preferred_username ``` To automatically redirect unauthenticated users to authentik, add the following variable: ```env title=".env" EXTENSION_PRIORITY=openid ``` To show the Apache Guacamole login screen with an OpenID Connect login option, add the following variable instead: ```env title=".env" EXTENSION_PRIORITY=*,openid ``` If your deployment uses a custom `GUACAMOLE_HOME`, ensure that `guacamole.properties` includes the following setting so Apache Guacamole can read configuration from environment variables: ```properties title="/etc/guacamole/guacamole.properties" enable-environment-properties: true ``` Install the Apache Guacamole OpenID Connect authentication extension, then add the following settings: ```properties title="/etc/guacamole/guacamole.properties" openid-authorization-endpoint: https://authentik.company/application/o/authorize/ openid-jwks-endpoint: https://authentik.company/application/o//jwks/ openid-issuer: https://authentik.company/application/o// openid-client-id: openid-redirect-uri: https://guacamole.company/ openid-username-claim-type: preferred_username ``` To automatically redirect unauthenticated users to authentik, add the following setting: ```properties title="/etc/guacamole/guacamole.properties" extension-priority: openid ``` To show the Apache Guacamole login screen with an OpenID Connect login option, add the following setting instead: ```properties title="/etc/guacamole/guacamole.properties" extension-priority: *, openid ``` Restart Apache Guacamole after changing the OpenID Connect configuration. For Docker Compose deployments, recreate the Apache Guacamole container with `docker compose up`. ### Trust self-signed certificates *(optional)* When authentik uses a certificate signed by a private certificate authority, add that certificate authority certificate to the operating system trust store and to the Java trust store on the Apache Guacamole host. #### Add the certificate authority certificate to the operating system trust store On Debian-based operating systems, copy the certificate authority certificate to `/usr/local/share/ca-certificates/` with a `.crt` file extension, then run the following command: ```shell update-ca-certificates ``` On Synology systems, copy the certificate authority certificate to `/usr/syno/etc/security-profile/ca-bundle-profile/ca-certificates/` with a `.crt` file extension, then run the following command: ```shell update-ca-certificates.sh ``` #### Add the certificate authority certificate to the Java trust store Export the certificate authority certificate as a PKCS #12 file: ```shell openssl pkcs12 -export -in .crt -inkey .key -out .p12 -passout pass: ``` Import the certificate authority certificate into the Java trust store on the Apache Guacamole host: ```shell keytool -importkeystore -srckeystore .p12 -srcstoretype PKCS12 -keystore /opt/java/openjdk/lib/security/cacerts -deststorepass -noprompt -srcstorepass ``` Apache Guacamole versions earlier than 1.6 commonly used `/opt/java/openjdk/jre/lib/security/cacerts` for the Java trust store. ## Configuration verification To confirm that authentik is properly configured with Apache Guacamole, log out of Apache Guacamole and open it again. If you configured Apache Guacamole to show its login screen, click the OpenID Connect login option at the bottom-left corner of the login page and complete the authentik flow. ## Resources - [Apache Guacamole official documentation on OpenID Connect authentication](https://guacamole.apache.org/doc/gug/openid-auth.html) - [Apache Guacamole Docker image documentation](https://guacamole.apache.org/doc/gug/guacamole-docker.html) --- ## Integrate with Argo CD ## What is Argo CD? > Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. > > \-- [https://argoproj.github.io/cd/](https://argoproj.github.io/cd/) ## Preparation The following placeholders are used in this guide: - `argocd.company` is the FQDN of the Argo CD installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Argo CD with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://argocd.company/api/dex/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create the groups Using the authentik Admin interface, navigate to **Directory** > **Groups** and click **Create** to create the groups that Argo CD will use for RBAC: - `Argo CD Admins` for administrator users. - `Argo CD Viewers` for read-only users. After creating the groups, select a group, navigate to the **Users** tab, and manage its members by using the **Add existing user** and **Create user** buttons as needed. ## Argo CD configuration This guide uses the bundled Dex connector in Argo CD. With this configuration, Argo CD can use authentik for the web UI and the CLI, and can map authentik groups to Argo CD RBAC roles. ### Add the client secret In the `argocd-secret` Secret, add the following value to the `data` field: ```yaml title="argocd-secret" dex.authentik.clientSecret: ``` If you use the Argo CD Helm chart, add the client secret to `configs.secret.extra` instead: ```yaml title="values.yaml" configs: secret: extra: dex.authentik.clientSecret: ``` ### Configure Dex In the `argocd-cm` ConfigMap, add the following values to the `data` field: ```yaml title="argocd-cm" url: https://argocd.company dex.config: | connectors: - config: issuer: https://authentik.company/application/o// clientID: clientSecret: $dex.authentik.clientSecret insecureEnableGroups: true scopes: - openid - profile - email name: authentik type: oidc id: authentik ``` If you use the Argo CD Helm chart, add these values to `configs.cm` instead. ### Map the groups In the `argocd-rbac-cm` ConfigMap, add the following values to the `data` field: ```yaml title="argocd-rbac-cm" policy.csv: | g, Argo CD Admins, role:admin g, Argo CD Viewers, role:readonly ``` If you already use different group names in authentik, replace `Argo CD Admins` and `Argo CD Viewers` with the matching group names. If you do not need the read-only group, remove that line. If you use the Argo CD Helm chart, add these values to `configs.rbac` instead. Apply all modified manifests or Helm values. Group membership is evaluated when users authenticate, so users should log out and log back in after you change their Argo CD group membership. ## Configuration verification To confirm that authentik is properly configured with Argo CD, open Argo CD and log in with authentik. You should also be able to log in with the Argo CD CLI. ## Resources - [Argo CD documentation - User management and SSO](https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/) - [Argo CD documentation - RBAC configuration](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/) - [Argo CD Helm chart values](https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml) - [Dex documentation - OpenID Connect connector](https://dexidp.io/docs/connectors/oidc/) --- ## Integrate with Atlantis ## What is Atlantis? > Atlantis is an application for automating Terraform via pull requests. > > \-- [https://www.runatlantis.io](https://www.runatlantis.io) Atlantis does not provide native SSO for the web UI. This guide uses authentik's proxy provider as a forward auth layer in front of Atlantis, while keeping the Atlantis webhook endpoint reachable by your Git host. ## Preparation The following placeholders are used in this guide: - `atlantis.company` is the FQDN of the Atlantis installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Before beginning, ensure that Atlantis is already deployed behind a reverse proxy that supports authentik forward auth. ## authentik configuration To support the integration of Atlantis with authentik, you need to create an application/provider pair in authentik and assign it to a proxy outpost. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **Proxy Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **Mode** to **Forward auth (single application)**. - Set **External host** to `https://atlantis.company`. - Under **Advanced protocol settings**, set **Unauthenticated Paths** to the following value to allow Git host webhooks to reach Atlantis: ```text ^/events$ ``` - Under **Authentication settings**, disable **Intercept header authentication**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure proxy outpost The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. Add the Atlantis application to a proxy outpost that will serve it: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Outposts**. 3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. 4. Under **Available Applications**, select the Atlantis application and move it to **Selected Applications**. 5. Click **Update** to save your changes. ## Atlantis configuration No SSO configuration is required in Atlantis. Configure Atlantis so that its public URL matches the protected external host: ```env title=".env" ATLANTIS_ATLANTIS_URL=https://atlantis.company ``` If Atlantis web Basic Auth is enabled, disable it for a single authentik login prompt. Keep Basic Auth enabled only if you want users to complete both authentik authentication and a local Atlantis Basic Auth challenge. Configure your reverse proxy to use the authentik outpost as the forward auth endpoint for `https://atlantis.company`. Requests to `/outpost.goauthentik.io` must be routed to the authentik outpost. All other requests, including `/events`, must continue to be routed to Atlantis. Set your Git host webhook URL to `https://atlantis.company/events`. The `/events` endpoint is skipped by authentik so that Git host webhooks can reach Atlantis. Atlantis should still validate these webhook requests with its existing webhook secret or webhook authentication settings. ## Configuration verification To verify the login flow, open Atlantis. You should be redirected to authentik before the Atlantis web interface is shown. ## Resources - [Atlantis Docs - Deployment](https://www.runatlantis.io/docs/deployment.html) - [Atlantis Docs - Server Configuration](https://www.runatlantis.io/docs/server-configuration) - [Atlantis Docs - Security](https://www.runatlantis.io/docs/security) - [Atlantis Docs - Configuring Webhooks](https://www.runatlantis.io/docs/configuring-webhooks.html) - [Atlantis Docs - Webhook Secrets](https://www.runatlantis.io/docs/webhook-secrets) --- ## Integrate with Red Hat Ansible Automation Platform / AWX ## What is Red Hat Ansible Automation Platform / AWX? > Red Hat Ansible Automation Platform and AWX provide web interfaces, APIs, and automation services for running, scheduling, and managing Ansible automation across infrastructure and applications. > > \-- [https://www.redhat.com/en/technologies/management/ansible](https://www.redhat.com/en/technologies/management/ansible) ## Preparation The following placeholders are used in this guide: - `automation.company` is the FQDN of the Red Hat Ansible Automation Platform or AWX installation. - `authentik.company` is the FQDN of the authentik installation. AWX and automation controller in Red Hat Ansible Automation Platform 2.4 and earlier use the controller SAML settings. Red Hat Ansible Automation Platform 2.5 and newer use platform gateway authentication methods. Create or identify the SAML service provider certificate and private key that Red Hat Ansible Automation Platform or AWX will use for its own SAML service provider configuration. This is separate from the authentik signing certificate that you download later. ```shell openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650 -nodes ``` This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Red Hat Ansible Automation Platform or AWX with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - If you are configuring AWX or automation controller, set **ACS URL** to `https://automation.company/sso/complete/saml/`. - If you are configuring Red Hat Ansible Automation Platform 2.5 or newer, set **ACS URL** to `https://temp.temp`. You will update this value after creating the authentication method in Red Hat Ansible Automation Platform. - Set **Audience** to `https://automation.company`. - Under **Advanced protocol settings**, select an available **Signing Certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Create Application** to save the new application and provider. ### Copy the SAML values 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and open the SAML provider that you created. 2. Copy the **EntityID/Issuer** value. 3. Copy the **SAML Endpoint** value. 4. Under **Related objects** > **Download signing certificate**, click **Download**. ## Red Hat Ansible Automation Platform / AWX configuration Use the subsection that matches your installation. ### Configure AWX or automation controller 1. Log in to AWX or automation controller as an administrator. 2. Navigate to **Settings** and select **SAML settings** from the authentication settings. 3. Click **Edit**. 4. Set **SAML Service Provider Entity ID** to `https://automation.company`. 5. Set **SAML Service Provider Public Certificate** to the full contents of the service provider certificate that you created during preparation, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. 6. Set **SAML Service Provider Private Key** to the full contents of the service provider private key that you created during preparation, including the `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----` lines. 7. Set **SAML Service Provider Organization Info** to the following value: ```json { "en-US": { "name": "authentik", "url": "https://authentik.company", "displayname": "authentik" } } ``` 8. Set **SAML Service Provider Technical Contact** and **SAML Service Provider Support Contact** to the appropriate contact information for your environment: ```json { "givenName": "Admin Name", "emailAddress": "admin@company" } ``` 9. Set **SAML Enabled Identity Providers** to the following value. Replace `` with the downloaded authentik signing certificate, with the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines removed and the certificate entered as one line. ```json { "authentik": { "entity_id": "", "url": "", "x509cert": "", "attr_username": "http://schemas.goauthentik.io/2021/02/saml/username", "attr_user_permanent_id": "http://schemas.goauthentik.io/2021/02/saml/uid", "attr_email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "attr_first_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" } } ``` 10. Click **Save**. ### Configure Red Hat Ansible Automation Platform 2.5 or newer 1. Log in to Red Hat Ansible Automation Platform as an administrator. 2. Navigate to **Access Management** > **Authentication Methods**. 3. Click **Create authentication**. 4. Enter a name for the SAML configuration. 5. Set **Authentication type** to **SAML**. 6. Set **SAML Service Provider Entity ID** to `https://automation.company`. 7. Set **SAML Service Provider Public Certificate** to the full contents of the service provider certificate that you created during preparation, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. 8. Set **SAML Service Provider Private Key** to the full contents of the service provider private key that you created during preparation, including the `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----` lines. 9. Set **IdP Login URL** to the **SAML Endpoint** value from authentik. 10. Set **IdP Public Cert** to the full PEM certificate that you downloaded from authentik. 11. Set **Entity ID** to the **EntityID/Issuer** value from authentik. 12. Configure the user attribute fields: - **Groups**: `http://schemas.xmlsoap.org/claims/Group` - **User Email**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` - **Username**: `http://schemas.goauthentik.io/2021/02/saml/username` - **User First Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` - **User Permanent ID**: `http://schemas.goauthentik.io/2021/02/saml/uid` 13. Leave **SAML Assertion Consumer Service (ACS) URL** blank. Red Hat Ansible Automation Platform generates this value after you create the authentication method. 14. Set **SAML Service Provider Organization Info** to the following value: ```json { "en-US": { "name": "authentik", "url": "https://authentik.company", "displayname": "authentik" } } ``` 15. Set **SAML Service Provider Technical Contact** and **SAML Service Provider Support Contact** to the appropriate contact information for your environment: ```json { "givenName": "Admin Name", "emailAddress": "admin@company" } ``` 16. Select **Enabled**. 17. Click **Create Authentication Method**. 18. Open the authentication method that you created and copy the generated **SAML Assertion Consumer Service (ACS) URL**. ### Update the authentik provider Complete this subsection only for Red Hat Ansible Automation Platform 2.5 or newer. 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and open the SAML provider that you created. 2. Click **Edit**. 3. Set **ACS URL** to the generated **SAML Assertion Consumer Service (ACS) URL** from Red Hat Ansible Automation Platform. 4. Click **Save Changes**. ## Configuration verification To confirm that authentik is properly configured with Red Hat Ansible Automation Platform or AWX, open the integration and sign in with SAML. ## Resources - [AWX documentation - Setting up Enterprise Authentication](https://docs.ansible.com/projects/awx/en/24.6.1/administration/ent_auth.html) - [Red Hat Ansible Automation Platform 2.6 - Configure SAML authentication](https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/secure-proc_controller_set_up_saml) - [Red Hat Ansible Automation Platform 2.4 - Setting up enterprise authentication](https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4/html/automation_controller_administration_guide/controller-set-up-enterprise-authentication) --- ## Integrate with Chatwoot ## What is Chatwoot? > Chatwoot is an open source customer support platform for managing conversations across websites, email, social media, and messaging channels. > > \-- [https://www.chatwoot.com](https://www.chatwoot.com) ## Preparation The following placeholders are used in this guide: - `chatwoot.company` is the FQDN of the Chatwoot installation. For Chatwoot Cloud, use `app.chatwoot.com`. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. SAML SSO requires a Chatwoot Enterprise plan and a Chatwoot account administrator. ## authentik configuration To support the integration of Chatwoot with authentik, create SAML property mappings and an application/provider pair. ### Create property mappings Chatwoot requires the SAML assertion to include `email`, `first_name`, and `last_name` attributes. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** and click **Next**. 4. Create the following property mapping: - **Name**: `Chatwoot email` - **SAML Attribute Name**: `email` - **Expression**: ```python return request.user.email ``` 5. Click **Finish**. 6. Repeat steps 2-5 to create the following property mappings: - **First name mapping**: - **Name**: `Chatwoot first name` - **SAML Attribute Name**: `first_name` - **Expression**: ```python name = request.user.name.strip() return name.split(" ", 1)[0] if name else request.user.username ``` - **Last name mapping**: - **Name**: `Chatwoot last name` - **SAML Attribute Name**: `last_name` - **Expression**: ```python name = request.user.name.strip() return name.rsplit(" ", 1)[1] if " " in name else "" ``` ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. In Chatwoot, note the numeric account ID in the current page URL. It is the number after `/app/accounts/`. 3. In authentik, navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring Chatwoot. - **Choose a Provider type**: select **SAML Provider**. - **Configure the Provider**: provide a name or accept the auto-provided name, select the authorization flow to use for this provider, and configure the following settings: - **ACS URL**: `https://chatwoot.company/omniauth/saml/callback?account_id=` - **Audience**: `https://chatwoot.company/saml/sp/` - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `Chatwoot email`. - Set **Default NameID Policy** to **Email address**. - Add `Chatwoot email`, `Chatwoot first name`, and `Chatwoot last name` to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 4. Click **Submit** to save the application and provider. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created. 2. Under **Related objects** > **Download signing certificate**, click **Download**. The certificate contents are required when configuring Chatwoot. ## Chatwoot configuration After you enable SAML, users in the Chatwoot account must log in through the SAML identity provider instead of using their Chatwoot passwords. A user who belongs to multiple Chatwoot accounts must use SAML if any of those accounts has SAML configured. 1. Log in to Chatwoot as an account administrator. 2. Navigate to **Settings** > **Security**. 3. Enable **SAML SSO**. 4. Configure the following settings: - **SSO URL**: `https://authentik.company/application/saml//` - **Identity Provider Entity ID**: `https://authentik.company/application/saml//metadata/` - **Signing certificate in PEM format**: paste the contents of the certificate that you downloaded from authentik. 5. Click **Update SAML Settings**. 6. Under **Service Provider Information**, confirm that the **ACS URL** and **SP Entity ID** match the values that you configured in authentik. Chatwoot uses the SAML attributes to create a user's profile during their first SAML login. Later SAML logins do not update that profile data. ## Configuration verification To confirm that authentik is properly configured with Chatwoot, open Chatwoot, click **Login via SSO**, enter the email address of a user who belongs to the configured account, and click **Continue with SSO**. You should be redirected to authentik and then back to Chatwoot. ## Resources - [Chatwoot user guide - Setting up SAML authentication](https://www.chatwoot.com/hc/user-guide/articles/1758635327-setting-up-saml) - [Chatwoot Cloud pricing](https://www.chatwoot.com/pricing) - [Chatwoot self-hosted pricing](https://www.chatwoot.com/pricing/self-hosted-plans) --- ## Integrate with Coolify ## What is Coolify? > Coolify is an open-source and self-hostable platform for deploying applications, databases, and services to your own servers. > > \-- [https://coolify.io/](https://coolify.io/) ## Preparation The following placeholders are used in this guide: - `coolify.company` is the FQDN of the Coolify installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Coolify with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://coolify.company/auth/authentik/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Coolify configuration 1. Log in to Coolify as an administrator. 2. Navigate to **Settings** > **Authentication**. 3. In the **authentik** section, configure the following settings: - **Enabled**: enable the provider. - **Client ID**: enter the client ID from authentik. - **Client Secret**: enter the client secret from authentik. - **Redirect URI**: `https://coolify.company/auth/authentik/callback` - **Base URL**: `https://authentik.company` 4. Click **Save**. Coolify signs in users by matching the email address returned by authentik to a Coolify user. If a matching user does not exist, Coolify creates the user only when registration is enabled in **Settings** > **Advanced**. ## Configuration verification To confirm that authentik is properly configured with Coolify, log out of Coolify. On the login page, click **Login with authentik** and complete the authentik flow. ## Resources - [Coolify Docs - OAuth](https://coolify.io/docs/knowledge-base/oauth) - [Coolify Docs - Single Sign-On (SSO)](https://coolify.io/docs/knowledge-base/sso) - [Socialite Providers - authentik](https://socialiteproviders.com/authentik/) --- ## Integrate with Harbor ## What is Harbor? > Harbor is an open source container image registry that secures images with role-based access control, scans images for vulnerabilities, and signs images as trusted. A CNCF Graduated project, Harbor delivers compliance, performance, and interoperability to help you consistently and securely manage images across cloud native compute platforms like Kubernetes and Docker. > > \-- [https://goharbor.io](https://goharbor.io) ## Preparation The following placeholders are used in this guide: - `harbor.company` is the FQDN of the Harbor installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Harbor can switch from database authentication to OIDC only when no local users other than `admin` exist. If your Harbor instance already has local users, review Harbor's authentication-mode migration options before changing **Auth Mode**. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Harbor with authentik, you need to create an application/provider pair in authentik. Harbor can read authentik group names from the default `profile` scope. If you want Harbor-specific group and administrator grants instead of global authentik group names, configure the optional Harbor entitlements scope below. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Set **Launch URL** to `https://harbor.company`. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://harbor.company/c/oidc/callback`. - Select any available signing key. - Under **Advanced protocol settings** > **Scopes**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to **Selected Scopes**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure Harbor entitlements *(optional)* Harbor uses the OIDC `groups` claim for group membership and system administrator assignment. To expose application entitlements as Harbor groups, create an OAuth2 scope mapping that sends Harbor-specific entitlement names in the `groups` claim. 1. In authentik, navigate to **Customization** > **Property Mappings** and click **New Property Mapping**. 2. Select **OAuth2 Scope Mapping** and use the following values: - **Name**: `Harbor entitlements` - **Scope name**: `harbor` - **Expression**: ```python return { "name": request.user.name, "preferred_username": request.user.username, "groups": [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ], } ``` 3. Open the Harbor provider that you created earlier and add `Harbor entitlements` to the selected **Scopes**. 4. Open the Harbor application and create the required **Application entitlements**. If you want to grant Harbor system administrator privileges through OIDC, create an entitlement such as `harbor-admin` and bind it to the users or groups that should receive that access. ## Harbor configuration To support the integration of authentik with Harbor, you need to configure OIDC authentication. 1. Log in to the Harbor interface with a Harbor system administrator account. 2. Under **Administration**, navigate to **Configuration** and select the **Authentication** tab. 3. In the **Auth Mode** dropdown, select **OIDC** and provide the following values: - **OIDC Provider Name**: `authentik` - **OIDC Endpoint**: `https://authentik.company/application/o//` - **OIDC Client ID**: enter the Client ID from authentik. - **OIDC Client Secret**: enter the Client Secret from authentik. - **Group Claim Name**: `groups` - **OIDC Admin Group** *(optional)*: enter the authentik group name or Harbor entitlement name that should receive Harbor system administrator privileges. - **OIDC Scope**: `openid,profile,email,offline_access`. If you configured the optional Harbor entitlements scope mapping, use `openid,email,harbor,offline_access`. - **Automatic onboarding**: enable this setting. - **Username Claim**: `preferred_username` 4. Click **Test OIDC Server** to validate the configuration. 5. Click **Save**. After OIDC is enabled, Harbor shows **LOGIN VIA LOCAL DB** on the login page for the local Harbor administrator. You can also open `https://harbor.company/account/sign-in` directly to use local database authentication. If Harbor redirects users to an unexpected host, ensure that `hostname` or `external_url` is set correctly in `harbor.yml`. After updating `harbor.yml`, run Harbor's `prepare` script and restart Harbor. ### Use Docker or Helm with OIDC accounts Docker and Helm clients cannot complete browser-based OIDC redirects. After a user logs in to Harbor with authentik for the first time, they can use their Harbor CLI secret as the password for Docker or Helm. 1. Log in to Harbor with an OIDC user account. 2. Click the username at the top of the screen and select **User Profile**. 3. Click the clipboard icon to copy the CLI secret. 4. Use the CLI secret as the password when logging in from Docker or Helm. ## Configuration verification To confirm that authentik is properly configured with Harbor, open Harbor and click **LOGIN WITH AUTHENTIK** on the login page. After a successful login, Harbor opens. ## Resources - [Harbor documentation - Configure OIDC Provider Authentication](https://goharbor.io/docs/2.14.0/administration/configure-authentication/oidc-auth/) - [Harbor documentation - Configure the Harbor YML File](https://goharbor.io/docs/2.14.0/install-config/configure-yml-file/) - [Harbor documentation - Reconfigure Harbor and Manage the Harbor Lifecycle](https://goharbor.io/docs/2.14.0/install-config/reconfigure-manage-lifecycle/) --- ## Integrate with IIS ## What is IIS? > Internet Information Services (IIS) for Windows Server is a flexible, secure and manageable Web server for hosting anything on the Web. > > \-- [https://www.iis.net](https://www.iis.net) This guide uses authentik's proxy provider to protect an IIS-hosted site. ## Preparation The following placeholders are used in this guide: - `iis.company` is the FQDN of the IIS site that users access. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of IIS with authentik, you need to create an application/provider pair in authentik and assign it to a proxy outpost. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **Proxy Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **Mode** to **Proxy**. - Set **External host** to `https://iis.company`. - Set **Internal host** to the URL of the IIS backend site as reached by the authentik proxy outpost, such as `http://localhost:8080`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure proxy outpost The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. Add the IIS application to a proxy outpost that will serve it: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Outposts**. 3. Click the edit icon for the proxy outpost. 4. Under **Available Applications**, select the IIS application and move it to **Selected Applications**. 5. Click **Update** to save your changes. ## IIS configuration Use this option when the authentik proxy outpost should receive requests for `https://iis.company`. 1. Configure DNS or your reverse proxy so that `iis.company` routes to the authentik proxy outpost. 2. Configure the IIS backend site so that it is reachable from the authentik proxy outpost at the **Internal host** URL. 3. If the IIS backend site runs on the same Windows server, use a separate binding or port for the backend site, such as `http://localhost:8080`. No SSO configuration is required in IIS for this option. The authentik proxy outpost authenticates the user before forwarding allowed requests to IIS. Use this option when IIS should receive requests for `https://iis.company` and forward them to the authentik proxy outpost. The authentik proxy outpost then forwards authenticated requests to the IIS backend site. `preserveHostHeader` is a server-level ARR setting. Review other IIS reverse proxy sites before changing it on a shared IIS server. 1. Install the IIS **URL Rewrite** module and **Application Request Routing**. 2. In IIS Manager, select the server node, open **Application Request Routing Cache**, click **Server Proxy Settings**, enable **Enable proxy**, and apply the change. 3. From an elevated Command Prompt, configure ARR to preserve the original host header and avoid rewriting response `Location` headers: ```cmd title="Administrator Command Prompt" %windir%\System32\inetsrv\appcmd.exe set config -section:system.webServer/proxy /preserveHostHeader:"True" /reverseRewriteHostInResponseHeaders:"False" /commit:apphost ``` 4. Configure the public IIS site for `iis.company` to proxy requests to the authentik proxy outpost. If the site already has a `web.config` file, merge the `rewrite` section into the existing `system.webServer` section. ```xml title="web.config" ``` This example uses the outpost HTTP port. If the outpost uses HTTPS, use `https://authentik.company:9443/{R:1}`. 5. Configure the IIS backend site so that it is reachable from the authentik proxy outpost at the **Internal host** URL. The backend site must use a different binding, hostname, or port than the public IIS reverse proxy site to avoid routing requests back to itself. ## Configuration verification To confirm that authentik is properly configured with IIS, open the IIS site. You should be redirected to authentik before the IIS site is shown. ## Resources - [Microsoft IIS - Overview](https://www.iis.net/overview) - [Microsoft Learn - IIS Web Server Overview](https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-web-server-overview) - [Microsoft Learn - Install Application Request Routing Version 2](https://learn.microsoft.com/en-us/iis/extensions/installing-application-request-routing-arr/install-application-request-routing-version-2) - [Microsoft Learn - Reverse Proxy with URL Rewrite v2 and Application Request Routing](https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/reverse-proxy-with-url-rewrite-v2-and-application-request-routing) - [Microsoft Learn - ARR as generic proxy in Hotmail and SkyDrive](https://learn.microsoft.com/en-us/iis/extensions/configuring-application-request-routing-arr/arr-as-generic-proxy-in-hotmail-and-skydrive) --- ## Integrate with Keycloak ## What is Keycloak? > Keycloak is an open-source Identity and Access Management (IAM) platform. It can be used both as an Identity Provider and as an application. > > \-- [https://www.keycloak.org](https://www.keycloak.org) ## Preparation The following placeholders are used in this guide: - `keycloak.company` is the FQDN of the Keycloak installation. - `authentik.company` is the FQDN of the authentik installation. - `` is the name of the Keycloak realm where users log in. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## Configuration methods Keycloak supports OIDC and SAML identity providers. Select a protocol below and complete both the authentik and Keycloak configuration in that tab. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Keycloak with authentik using OIDC, create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://keycloak.company/realms//broker/authentik/endpoint`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Keycloak configuration ### Create an OIDC identity provider 1. Log in to Keycloak as an administrator. 2. Select the realm where you want users to log in. 3. Navigate to **Identity Providers** and click **OpenID Connect v1.0**. 4. Set the following fields: - **Alias**: `authentik` - **Display name**: `authentik` - **Discovery endpoint**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Client ID**: enter the client ID from authentik. - **Client Secret**: enter the client secret from authentik. 5. Click **Save**. ## authentik configuration To support the integration of Keycloak with authentik using SAML, create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://keycloak.company/realms//broker/authentik/endpoint`. - Set the **SLS URL** to `https://keycloak.company/realms//broker/authentik/endpoint`. - Set the **SLS Binding** to `Post`. - Set the **Logout Method** to `Back-channel (POST)`. - Set the **Audience** to `https://keycloak.company/realms/`. - Under **Advanced protocol settings**, set **Signing Certificate** to use any available certificate. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Keycloak configuration ### Create a SAML identity provider 1. Log in to Keycloak as an administrator. 2. Select the realm where you want users to log in. 3. Navigate to **Identity Providers** and click **SAML v2.0**. 4. Set the following fields: - **Alias**: `authentik` - **Display name**: `authentik` - **Service provider entity ID**: `https://keycloak.company/realms/` - **Use metadata descriptor URL**: enable this option. - **Metadata descriptor URL**: `https://authentik.company/application/saml//metadata/` 5. Click **Add**. ## Configuration verification To confirm that authentik is properly configured with Keycloak, open Keycloak and log in by selecting **authentik** on the login screen. ## Resources - [Keycloak Docs - Integrating identity providers](https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_broker) - [Keycloak Docs - OpenID Connect v1.0 identity providers](https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_broker_oidc) - [Keycloak Docs - SAML v2.0 identity providers](https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers) - [Keycloak Docs - SAML SP descriptor](https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_broker_saml_sp_descriptor) --- ## Integrate with Komodo ## What is Komodo? > Komodo is a web application for managing servers, builds, deployments, and automated procedures. > > \-- [https://komo.do/](https://komo.do/) ## Preparation The following placeholders are used in this guide: - `komodo.company` is the FQDN of your Komodo installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Komodo with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://komodo.company/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. - **Configure Launch URL** *(optional)*: set to `https://komodo.company/auth/oidc/login`. 3. Click **Submit** to save the new application and provider. ## Komodo configuration ### Set up OIDC connection Edit the following environment variables in your Komodo `compose.env` file, or set the equivalent values in your mounted `./komodo/core.config.toml` file: ```env title="compose.env" KOMODO_HOST=https://komodo.company KOMODO_OIDC_ENABLED=true KOMODO_OIDC_PROVIDER=https://authentik.company/application/o// KOMODO_OIDC_CLIENT_ID= KOMODO_OIDC_CLIENT_SECRET= ``` `KOMODO_HOST` must match the URL that users use to access Komodo, because Komodo uses it to build the OIDC callback URL. If Komodo Core must use an internal URL to reach authentik, set `KOMODO_OIDC_PROVIDER` to that internal provider URL and set `KOMODO_OIDC_REDIRECT_HOST=https://authentik.company`. The redirect host must not include the `/application/o//` path. To send unauthenticated users directly to authentik instead of showing the Komodo login page, add `KOMODO_OIDC_AUTO_REDIRECT=true`. Redeploy Komodo for the changes to take effect. ### Enable users Komodo creates OIDC users when they first sign in. New users must be enabled by a Komodo administrator unless you configure `KOMODO_ENABLE_NEW_USERS=true`. 1. Log in to Komodo via the OIDC button on the login page. 2. Complete the authentik login flow. 3. After you are redirected back to Komodo, the **User Not Enabled** message is displayed. 4. Log in to Komodo using a local administrator account. 5. In the sidebar, click **Settings**. Under **Users**, click the authentik user. The **User type** should be **OIDC**. 6. Click **Enable User**, and assign the desired permissions. ## Configuration verification To confirm that authentik is properly configured with Komodo, open Komodo and click **OIDC**. You should be redirected to authentik, and then returned to the Komodo dashboard. ## Resources - [Komodo Docs - Advanced Setup](https://komo.do/docs/setup/advanced) - [Komodo Docs - Permissioning](https://komo.do/docs/configuration/permissioning) --- ## Integrate with MinIO ## What is MinIO? > MinIO is an S3-compatible object storage platform for AI, analytics, and data-intensive workloads. > > \-- [https://www.min.io/](https://www.min.io/) ## Preparation The following placeholders are used in this guide: - `minio.company` is the FQDN of the MinIO installation. - `authentik.company` is the FQDN of the authentik installation. The [MinIO community repository](https://github.com/minio/minio) is no longer maintained, and legacy pre-built community binaries are no longer maintained. MinIO directs new deployments to [AIStor Free](https://www.min.io/download) or AIStor Enterprise. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of MinIO with authentik, you need to create a scope mapping, an application/provider pair, and application entitlements in authentik. ### Create a scope mapping MinIO uses the `policy` claim to assign MinIO policies to OIDC users. Create a scope mapping to pass authentik application entitlements as MinIO policy names. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property mappings** and click **Create**. 3. Select **Scope Mapping** as the property mapping type. 4. Configure the following settings: - **Name**: provide a descriptive name, such as `MinIO policies`. - **Scope name**: `minio` - **Expression**: ```python return { "policy": [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ], } ``` 5. Click **Finish**. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://minio.company/oauth_callback`. - Select any available signing key. - Under **Advanced protocol settings** > **Selected Scopes**, add the scope mapping that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the MinIO policies that this application should assign. 1. Open the MinIO application that you just created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each MinIO policy that users should be able to receive, such as `readonly`. 4. Bind the appropriate users or groups to each entitlement. The entitlement names must exactly match existing MinIO policy names. Users who authenticate without at least one matching policy have no permissions in MinIO. ## MinIO configuration Create the MinIO policies that correspond to your authentik application entitlement names before users sign in. You can create policies in the MinIO Console or with the `mc admin policy` commands. Designing bucket policies is outside the scope of this guide. You can set up OIDC in three different ways: with environment variables, the web interface, or the command line. You can configure MinIO OIDC settings using [environment variables](https://docs.min.io/aistor/reference/aistor-server/settings/iam/openid/). Add the following variables to your environment file: ```env title=".env" MINIO_IDENTITY_OPENID_CONFIG_URL="https://authentik.company/application/o//.well-known/openid-configuration" MINIO_IDENTITY_OPENID_CLIENT_ID="" MINIO_IDENTITY_OPENID_CLIENT_SECRET="" MINIO_IDENTITY_OPENID_DISPLAY_NAME="authentik" MINIO_IDENTITY_OPENID_SCOPES="openid,profile,email,minio" ``` Restart MinIO for the changes to take effect. In the MinIO Console, navigate to **Access** > **OpenID**, click **Add Configuration**, and configure the following settings: - **Name**: `authentik` - **Config URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Client ID**: Client ID from authentik - **Client Secret**: Client Secret from authentik - **Scopes**: `openid,profile,email,minio` - **Redirect URI**: `https://minio.company/oauth_callback` Click **Save**, then restart MinIO for the changes to take effect. Install and configure the MinIO Client (`mc`) with an alias for your MinIO deployment. The example below uses `myminio` as the alias. Run the following command to configure the OpenID provider: ```shell mc idp openid add myminio authentik \ config_url="https://authentik.company/application/o//.well-known/openid-configuration" \ client_id="" \ client_secret="" \ display_name="authentik" \ scopes="openid,profile,email,minio" \ redirect_uri="https://minio.company/oauth_callback" ``` Restart MinIO for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with MinIO, open MinIO and sign in with authentik. After authentication, verify that the signed-in user receives the expected MinIO policy permissions. ## Resources - [MinIO AIStor Docs - OpenID Connect Identity Management](https://docs.min.io/aistor/administration/iam/identity/oidc-identity/) - [MinIO AIStor Docs - OpenID Settings](https://docs.min.io/aistor/reference/aistor-server/settings/iam/openid/) - [MinIO AIStor Docs - OpenID Connect Access Management](https://docs.min.io/aistor/administration/iam/access/oidc-access/) - [MinIO AIStor Docs - mc idp openid add](https://docs.min.io/aistor/reference/cli/mc-idp-openid/mc-idp-openid-add/) --- ## Integrate with Nexterm ## What is Nexterm? > Nexterm is an open-source server management platform for SSH, VNC, and RDP. > > \-- [https://nexterm.dev/](https://nexterm.dev/) ## Preparation The following placeholders are used in this guide: - `nexterm.company` is the FQDN of the Nexterm installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Nexterm with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://nexterm.company/api/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Nexterm configuration 1. Log in to Nexterm as an administrator. 2. Navigate to **Settings** > **Authentication**. 3. Click **Add Provider**. 4. Set the following required settings: - **Display Name**: `authentik` - **Issuer URL**: `https://authentik.company/application/o//` - **Client ID**: the Client ID from authentik - **Client Secret**: the Client Secret from authentik - **Redirect URI**: `https://nexterm.company/api/auth/oidc/callback` 5. Save the provider. The trailing slash in the **Issuer URL** is required. ## Configuration verification To verify that authentik is correctly integrated with Nexterm, log out of Nexterm and select the authentik provider on the login page. You should be redirected to your authentik instance, and after successfully authenticating, you should return to Nexterm and be logged in automatically. ## Resources - [Nexterm OIDC Authentication documentation](https://docs.nexterm.dev/oidc) --- ## Integrate with Omni ## What is Omni? > Talos Omni ships with all the parts you otherwise need to glue together: fleet upgrade orchestration, encryption across sites, identity management, cluster templates. > > \-- [https://www.siderolabs.com/omni-for-kubernetes-cluster-management](https://www.siderolabs.com/omni-for-kubernetes-cluster-management) ## Preparation The following placeholders are used in this guide: - `omni.company` is the FQDN of the Omni installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Omni with authentik, you need to create a property mapping and application/provider pair in authentik. ### Create an email property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the property mapping type. 4. Set the following values: - **Name**: `Omni email` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` - **Expression**: ```python return request.user.email ``` 5. Click **Finish**. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **ACS URL**: `https://omni.company/saml/acs` - **Audience**: `https://omni.company/saml/metadata` - **SLS URL**: `https://omni.company/saml/slo` - **SLS Binding**: `Redirect` - **Logout Method**: `Front-channel (Iframe)` - **Signing Certificate**: select a signing certificate, either the `authentik Self-signed Certificate` or generate a certificate via **System** > **Certificate** - **Sign assertions**: `true` - **Sign responses**: `true` - **Property mappings**: `*property_mapping_name*` (e.g. `Omni Mapping`) - **NameID Property Mapping**: `*property_mapping_name*` (e.g. `Omni Mapping`) 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://omni.company/saml/acs`. - Set the **Audience** to `https://omni.company/saml/metadata`. - Under **Advanced protocol settings**: - Select an available **Signing certificate**. - Enable **Sign assertions** and **Sign responses**. - Add the `Omni email` property mapping that you created in the previous section to **Property mappings**. - Set **NameID Property Mapping** to `Omni email`. - Set **Default NameID Policy** to **Email address**. - **Configure Bindings** *(optional)*: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to control which users can access the Omni application from the **Application Dashboard** page. 3. Click **Submit**. ## Omni configuration For self-hosted Omni, enable SAML and set the authentik metadata URL in your Omni configuration. ```shell --auth-saml-enabled=true --auth-saml-url=https://authentik.company/application/saml//metadata/ ``` If you use the Sidero Labs Docker Compose deployment, add the flags to the `AUTH` value in your environment file. ```env title=".env" AUTH='--auth-saml-enabled=true \ --auth-saml-url=https://authentik.company/application/saml//metadata/' ``` Restart Omni for the changes to take effect. For Sidero Labs SaaS Omni, SAML must be enabled by Sidero Labs support or your account manager. Provide them with the authentik metadata URL from this section. ## Configuration verification To confirm that authentik is properly configured with Omni, open Omni, log out, and log back in with SAML. ## Resources - [Sidero Labs Documentation - Using SAML with Omni](https://docs.siderolabs.com/omni/security-and-authentication/using-saml-with-omni/overview) - [Sidero Labs Documentation - Configure Entra ID for Omni](https://docs.siderolabs.com/omni/security-and-authentication/using-saml-with-omni/how-to-configure-entraid-for-omni) - [Sidero Labs Documentation - Authentication and Authorization](https://docs.siderolabs.com/omni/security-and-authentication/authentication-and-authorization) - [Sidero Labs Documentation - Omni Configuration](https://docs.siderolabs.com/omni/reference/omni-configuration) --- ## Integrate with osTicket ## What is osTicket? > osTicket is a web-based, open source user support/ticketing solution. > > \-- [https://osticket.com](https://osticket.com) ## Preparation The following placeholders are used in this guide: - `osticket.company` is the FQDN of the osTicket installation. - `authentik.company` is the FQDN of the authentik installation. If osTicket is installed in a subdirectory, include that path before `/api/auth/oauth2` wherever this guide uses the osTicket redirect URI. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of osTicket with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://osticket.company/api/auth/oauth2`. - Select any available signing key. - Under **Advanced protocol settings**: - **Subject Mode**: `Based on the User's Email` - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## osTicket configuration Before you enable OAuth2 authentication for agents, create any osTicket Agent accounts that should use authentik with the same email addresses as their authentik users. osTicket can create End User accounts during OAuth2 sign-in, but Agent accounts must already exist. 1. Download the **Authentication :: Oauth2** plugin from [the osTicket website](https://osticket.com/download) and place it into the `include/plugins` folder of your osTicket installation. 2. Log in to osTicket as an administrator and open the **Admin Panel**. 3. Navigate to **Manage** > **Plugins**. 4. Click **Add New Plugin** and follow the on-screen instructions to install the OAuth2 plugin. 5. After the plugin is installed, click the OAuth2 plugin, set **Status** to `Active`, and click **Save Changes**. 6. Open the **Instances** tab, click **Add New Instance**, select **OAuth2 - Other**, and configure the following settings: - On the **Instance** tab: - **Name**: enter a name for the instance. - Set **Status** to `Enabled`. - On the **Config** tab: - **Name**: `authentik` - **Authentication Target**: select `Agents Only`, `End Users Only`, or `Agents and End Users`. - **Authentication Label**: `authentik` - **Redirect URI**: `https://osticket.company/api/auth/oauth2` - **Client Id**: enter the Client ID from authentik. - **Client Secret**: enter the Client Secret from authentik. - **Authorization Endpoint**: `https://authentik.company/application/o/authorize/` - **Token Endpoint**: `https://authentik.company/application/o/token/` - **Resource Details Endpoint**: `https://authentik.company/application/o/userinfo/` - **Scopes**: `openid email profile` - Under **User Attributes Mapping**: - **Given Name**: `name` - Clear the **Surname** field. 7. Click **Save Changes**. 8. If you enabled OAuth2 authentication for agents, navigate to **Admin Panel** > **Agents** and confirm that the provider is available. Select **Use any available backend** so that administrators can still log in if OAuth2 authentication is unavailable. ## Configuration verification To confirm that authentik is properly configured with osTicket, log out and open the osTicket integration from authentik. On the osTicket login page, click **Sign in with authentik** and authenticate with authentik. ## Resources - [osTicket Docs - OAuth2 Guide](https://docs.osticket.com/en/latest/Guides/OAuth2%20Guide.html) - [osTicket Docs - Okta Authentication (SSO) Guide](https://docs.osticket.com/en/latest/OAuth2/Okta%20Authentication%20%28SSO%29%20Guide.html) --- ## Integrate with pgAdmin ## What is pgAdmin? > pgAdmin is a management tool for PostgreSQL and derivative relational databases such as EnterpriseDB's EDB Advanced Server. It may be run either as a web or desktop application. > > \-- [https://www.pgadmin.org/](https://www.pgadmin.org/) ## Preparation The following placeholders are used in this guide: - `pgadmin.company` is the FQDN of the pgAdmin installation. - `authentik.company` is the FQDN of the authentik installation. This guide assumes that pgAdmin is running in Server mode. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of pgAdmin with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - **Protocol Settings**: - **Redirect URI**: - `Strict` `Authorization`: `https://pgadmin.company/oauth2/authorize` - **Signing Key**: select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## pgAdmin configuration To configure OIDC in pgAdmin, use either `config_local.py` or environment variables if you are deploying pgAdmin in a containerized setup. ### Configure with `config_local.py` 1. Locate or create the `config_local.py` file in the `/pgadmin4/` directory. 2. Add the following configuration to the file: ```py title="/pgadmin4/config_local.py" AUTHENTICATION_SOURCES = ["oauth2", "internal"] OAUTH2_CONFIG = [ { "OAUTH2_NAME": "authentik", "OAUTH2_DISPLAY_NAME": "authentik", "OAUTH2_CLIENT_ID": "", "OAUTH2_CLIENT_SECRET": "", "OAUTH2_SERVER_METADATA_URL": "https://authentik.company/application/o//.well-known/openid-configuration", "OAUTH2_SCOPE": "openid email profile", } ] ``` 3. Save the file and restart pgAdmin. ### Configure with environment variables For containerized deployments, set these environment variables: ```env title=".env" PGADMIN_CONFIG_AUTHENTICATION_SOURCES="['oauth2', 'internal']" PGADMIN_CONFIG_OAUTH2_CONFIG="[{'OAUTH2_NAME':'authentik','OAUTH2_DISPLAY_NAME':'authentik','OAUTH2_CLIENT_ID':'','OAUTH2_CLIENT_SECRET':'','OAUTH2_SERVER_METADATA_URL':'https://authentik.company/application/o//.well-known/openid-configuration','OAUTH2_SCOPE':'openid email profile'}]" ``` Restart the pgAdmin container after changing the environment variables. ### Adjust login policy *(optional)* To only allow authentik login, remove `internal` from `AUTHENTICATION_SOURCES` after at least one OAuth2 user has been promoted to the pgAdmin **Administrator** role: ```py title="/pgadmin4/config_local.py" AUTHENTICATION_SOURCES = ["oauth2"] ``` To require pgAdmin administrators to create OAuth2 users manually before those users can sign in, disable automatic user creation: ```py title="/pgadmin4/config_local.py" OAUTH2_AUTO_CREATE_USER = False ``` ## Configuration verification To confirm that authentik is properly configured with pgAdmin, open pgAdmin and click the **authentik** button on the login page. After signing in through authentik, you should be redirected back to pgAdmin. ## Resources - [pgAdmin documentation - Enabling OAUTH2 and OIDC Authentication](https://www.pgadmin.org/docs/pgadmin4/latest/oauth2.html) - [pgAdmin documentation - Container Deployment](https://www.pgadmin.org/docs/pgadmin4/latest/container_deployment.html) - [pgAdmin documentation - User Management](https://www.pgadmin.org/docs/pgadmin4/latest/user_management.html) --- ## Integrate with phpIPAM ## What is phpIPAM? > phpIPAM is an open-source web IP address management application. It helps you manage IP addresses, subnets, VLANs, locations, and related network inventory from a web interface. > > \-- [https://phpipam.net/](https://phpipam.net/) ## Preparation The following placeholders are used in this guide: - `phpipam.company` is the FQDN of the phpIPAM installation. - `authentik.company` is the FQDN of the authentik installation. - `admin-permission-group` is the authentik group for phpIPAM administrators. - `operator-permission-group` is the authentik group for phpIPAM users with read/write module access. - `guest-permission-group` is the authentik group for phpIPAM users with read-only module access. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of phpIPAM with authentik, you need to create an application/provider pair in authentik. This guide also configures SAML property mappings for phpIPAM just-in-time (JIT) user provisioning. ### Create groups Create or identify the authentik groups that control phpIPAM access. This guide uses the following example groups: - `admin-permission-group` - `operator-permission-group` - `guest-permission-group` Assign users to the group that matches the phpIPAM access level that they should receive. These groups are used in the SAML property mappings and in the application bindings. ### Create property mappings phpIPAM requires the `display_name` and `email` SAML attributes when JIT provisioning is enabled. You can also send `is_admin`, `groups`, and `modules` attributes to control phpIPAM roles, group memberships, and module permissions. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings**. 3. Click **Create** and select **SAML Provider Property Mapping**. 4. Create the following property mappings: - **Name**: `phpipam-display-name` - **SAML Attribute Name**: `display_name` - **Expression**: ```python return user.name ``` - **Name**: `phpipam-email` - **SAML Attribute Name**: `email` - **Expression**: ```python return user.email ``` - **Name**: `phpipam-is-admin` - **SAML Attribute Name**: `is_admin` - **Expression**: ```python return ak_is_group_member(request.user, name="admin-permission-group") ``` - **Name**: `phpipam-groups` - **SAML Attribute Name**: `groups` - **Expression**: ```python if ak_is_group_member(request.user, name="operator-permission-group"): return "Operators" if ak_is_group_member(request.user, name="guest-permission-group"): return "Guests" return "" ``` - **Name**: `phpipam-modules` - **SAML Attribute Name**: `modules` - **Expression**: ```python if ak_is_group_member(request.user, name="operator-permission-group"): return "*:2" if ak_is_group_member(request.user, name="guest-permission-group"): return "*:1" return "" ``` The example `groups` mapping sends phpIPAM group names. Adjust `Operators` and `Guests` to match the groups that exist in your phpIPAM installation. The example `modules` mapping grants read/write access to all modules for operators and read-only access to all modules for guests. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations: - Set the **ACS URL** to `https://phpipam.company/index.php?page=saml2`. - Set the **Audience** to `https://phpipam.company/`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Add the property mappings that you created in the previous section. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Username`. - **Configure Bindings** *(optional)*: create [bindings](/docs/add-secure-apps/bindings-overview/) for `admin-permission-group`, `operator-permission-group`, and `guest-permission-group` so that only members of those groups can access phpIPAM from authentik. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click the phpIPAM provider that you created in the previous section. 2. Under **Related objects** > **Download signing certificate**, click **Download**. 3. Open the downloaded certificate file and copy its contents. This value is required when you configure phpIPAM. ## phpIPAM configuration 1. Log in to phpIPAM as a local administrator. 2. Navigate to **Administration** > **Authentication Methods**. 3. Click **Create New** > **SAML2 Authentication**. 4. Configure the following fields: - **Description**: `authentik` - **Enable JIT**: enable this option. - **Client ID**: `https://phpipam.company/` - **IDP Issuer**: `https://authentik.company/application/saml//metadata/` - **IDP Login url**: `https://authentik.company/application/saml//` - **IDP Logout url**: `https://authentik.company/application/saml//` - **IDP X.509 public cert**: paste the contents of the signing certificate that you downloaded from authentik. 5. Click **Save**. ## Configuration verification To verify that authentik is correctly integrated with phpIPAM, log out of phpIPAM and open the phpIPAM login page. Click the SAML2 login link to sign in with authentik. After you sign in, phpIPAM creates or updates the local user with the SAML attributes from authentik. Test users from each permission group to confirm that the expected phpIPAM role, group membership, and module permissions are applied. ## Resources - [phpIPAM documentation - SAML2 authentication](https://github.com/phpipam/phpipam/blob/master/doc/Authentication/SAML2.md) - [phpIPAM documentation - SAML2 with Keycloak](https://github.com/phpipam/phpipam/blob/master/doc/Authentication/SAML2-with-Keycloak.md) --- ## Integrate with Plesk ## What is Plesk? > Plesk is a web hosting platform with a control panel that helps manage servers, applications, and websites through a comprehensive graphical user interface. It provides tools for web professionals, IT administrators, and hosting companies to simplify the process of hosting and managing websites. > > \-- [https://www.plesk.com](https://www.plesk.com) ## Preparation The following placeholders are used in this guide: - `plesk.company` is the FQDN of the Plesk installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. The Plesk OAuth Login extension applies only to existing additional administrator accounts. It maps OAuth logins to existing additional administrator accounts by email and does not apply to the main administrator, customer, or reseller accounts. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Plesk with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://plesk.company/modules/oauth/public/login.php`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Plesk configuration 1. Install the OAuth login extension: - Log in to your Plesk installation. - Navigate to **Extensions** in the left sidebar. - Select **Extensions Catalog**. - Search for "OAuth login". - Click **Install** next to the OAuth login extension. 2. Enable and configure OAuth authentication: - After installation, select **Extensions** > **OAuth Login** in the left sidebar. - Enable OAuth authentication using the toggle switch in the main configuration panel. 3. In the same panel, configure these OAuth settings: - **Type**: `OpenID Connect` - **Client ID**: enter the Client ID from your authentik provider - **Client Secret**: enter the Client Secret from your authentik provider - **Callback Host**: `https://plesk.company` - **Authorize URL**: `https://authentik.company/application/o/authorize/` - **Token URL**: `https://authentik.company/application/o/token/` - **Userinfo URL**: `https://authentik.company/application/o/userinfo/` - **Scopes**: `openid,email,profile` - **Login Button Text**: enter the text to display on the Plesk login page, for example `Log in with authentik` 4. Click **Save** to apply the settings. ## Configuration verification To confirm that authentik is properly configured with Plesk, open Plesk and complete the following steps: 1. Log out of Plesk. 2. Look for the OAuth login button on the login page. 3. Click the OAuth login button. 4. Verify that you are redirected to authentik for authentication. 5. After successful authentication, confirm that you can log in to your Plesk administrator account. ## Resources - [Plesk OAuth Login extension](https://www.plesk.com/extensions/oauth/) - [Authelia Plesk OpenID Connect integration](https://www.authelia.com/integration/openid-connect/clients/plesk/) --- ## Integrate with PowerDNS-Admin ## What is PowerDNS-Admin? > A PowerDNS web interface with advanced features. > > \-- [https://github.com/ngoduykhanh/PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin) ## Preparation The following placeholders are used in this guide: - `pdns-admin.company` is the FQDN of the PowerDNS-Admin installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of PowerDNS-Admin with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://pdns-admin.company/saml/authorized`. - Set the **Audience** to `pdns-admin`. - Under **Advanced protocol settings**, select an available **Signing certificate**. - Under **Advanced protocol settings**, select all managed SAML property mappings. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## PowerDNS-Admin configuration For Docker-based installations, set the following environment variables: ```env title=".env" SAML_ENABLED=True SAML_PATH=os.path.join(os.path.dirname(file), 'saml') SAML_METADATA_URL=https://authentik.company/application/saml//metadata/ SAML_METADATA_CACHE_LIFETIME=1 SAML_LOGOUT_URL=https://authentik.company/application/saml// SAML_SP_ENTITY_ID=pdns-admin SAML_SP_CONTACT_NAME=me SAML_SP_CONTACT_MAIL=me SAML_NAMEID_FORMAT=urn:oasis:names:tc:SAML:2.0:nameid-format:persistent SAML_ATTRIBUTE_USERNAME=http://schemas.goauthentik.io/2021/02/saml/username SAML_ATTRIBUTE_NAME=http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name SAML_ATTRIBUTE_EMAIL=http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress SAML_ATTRIBUTE_GROUP=http://schemas.xmlsoap.org/claims/Group SAML_GROUP_ADMIN_NAME= SAML_SIGN_REQUEST='False' SAML_ASSERTION_ENCRYPTED=False SAML_WANT_MESSAGE_SIGNED=False SAML_CERT=/saml.crt ``` Mount the signing certificate selected in authentik as a file in the Docker container. The path in the container must match the path configured in `SAML_CERT`. For example: ```yaml title="docker-compose.yml" services: powerdns-admin: image: powerdnsadmin/pda-legacy:latest restart: always ports: - 80:80 volumes: - ./saml.crt:/saml.crt:ro ``` Restart PowerDNS-Admin for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with PowerDNS-Admin, log out and log back in through authentik. ## Resources - [PowerDNS-Admin GitHub repository](https://github.com/PowerDNS-Admin/PowerDNS-Admin) - [PowerDNS-Admin environment variables](https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/master/docs/wiki/configuration/Environment-variables.md) --- ## Integrate with ProFTPD ## What is ProFTPD? > ProFTPD is a high-performance, extremely configurable, and secure FTP server, featuring Apache-like configuration and blazing performance. > > \-- [http://www.proftpd.org/](http://www.proftpd.org/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik LDAP outpost. This guide uses authentik's LDAP provider to authenticate ProFTPD users. ProFTPD must be able to reach the authentik LDAP outpost on the LDAP or LDAPS port that you expose. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of ProFTPD with authentik, you need to create an LDAP search group, a service account, an LDAP provider, an application, and an LDAP outpost. ### Create an LDAP search group 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups** and click **Create**. 3. Enter `LDAP search` as the name and click **Create**. ### Create a service account 1. Navigate to **Directory** > **Users** and click **Create a service account**. 2. Enter `ldapservice` as the username and click **Create**. 3. Copy the generated token. If you need to create another token later, navigate to **Directory** > **Tokens and App passwords** and click **Create**. 4. Navigate to **Directory** > **Groups**, click **LDAP search**, and open the **Users** tab. 5. Click **Add existing user**, select **ldapservice**, and click **Add**. A bind account authenticates the LDAP client to the LDAP server so the client can search for users and groups. ### Create an LDAP provider 1. Navigate to **Applications** > **Providers** and click **Create**. 2. Select **LDAP Provider** as the provider type. 3. Configure the following values: - **Name**: enter a descriptive name. - **Base DN**: enter the LDAP base DN for your environment and note it for the ProFTPD configuration. - **Search group**: select **LDAP search**. - **Certificate**: select the certificate that your LDAP clients should trust for LDAPS. 4. Click **Finish**. ### Create an application 1. Navigate to **Applications** > **Applications** and click **Create**. 2. Configure the following values: - **Name**: enter a descriptive name. - **Provider**: select the LDAP provider that you created. 3. Click **Create**. 4. Open the application, click the **Users** tab, and click **Add existing user**. 5. Select **ldapservice** and click **Add**. ### Create or update an LDAP outpost 1. Navigate to **Applications** > **Outposts**. 2. Create an LDAP outpost or edit an existing LDAP outpost. 3. Add the LDAP application that you created to the outpost. 4. Deploy the outpost where the ProFTPD host can reach it. ### Restrict FTP access *(optional)* To restrict FTP access to specific users, create a group such as `ftpusers` and add only the allowed users to that group. The ProFTPD configuration below shows a group filter that uses this group. ## ProFTPD configuration Install the ProFTPD LDAP plugin if it is packaged separately for your distribution. The package is commonly named `proftpd-ldap`. Check that `LoadModule mod_ldap.c` is enabled in `/etc/proftpd/modules.conf`. Edit the ProFTPD configuration file. Depending on your distribution, this file is usually `/etc/proftpd.conf` or `/etc/proftpd/proftpd.conf`. ```apacheconf title="/etc/proftpd/proftpd.conf" DefaultRoot /your/ftp/storage/dir LDAPAuthBinds on LDAPServer authentik.company:389 LDAPBindDN cn=ldapservice,ou=users, LDAPUsers ou=users, (&(objectClass=user)(cn=%u)(memberOf=cn=ftpusers,ou=groups,)) LDAPDefaultUID 1000 LDAPDefaultGID 1000 LDAPForceDefaultUID on LDAPForceDefaultGID on LDAPGenerateHomedir on LDAPGenerateHomedirPrefix /your/ftp/storage/dir LDAPGenerateHomedirPrefixNoUsername on LDAPLog /var/log/mod_ldap.log RequireValidShell off LDAPAttr uid cn LDAPSearchScope subtree ``` The example maps every FTP login to the local Linux user and group ID `1000` and uses a shared home directory. Ensure that the local user and group exist and can access `/your/ftp/storage/dir`. If you want each user to have a separate home directory, remove `LDAPGenerateHomedirPrefixNoUsername on` and configure the home directory behavior for your environment. If you do not configure `LDAPForceDefaultUID` and `LDAPForceDefaultGID`, ProFTPD uses the `uidNumber` and `gidNumber` values returned by authentik. If you do not configure `LDAPGenerateHomedir`, ProFTPD uses each user's `homeDirectory` value. Restart ProFTPD for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with ProFTPD, connect to the FTP server with an authentik user that is allowed by the LDAP filter. If login fails, check the LDAP plugin log: ```bash tail -f /var/log/mod_ldap.log ``` ## Resources - [ProFTPD project website](http://www.proftpd.org/) - [ProFTPD mod\_ldap documentation](http://www.proftpd.org/docs/contrib/mod_ldap.html) --- ## Integrate with QNAP NAS ## What is QNAP NAS? > QNAP designs and delivers network-attached storage, video surveillance, and networking solutions. > > \-- [https://www.qnap.com/](https://www.qnap.com/) ## Preparation The following placeholders are used in this guide: - `ldap.baseDN` is the base DN configured in the authentik LDAP provider. - `ldap.domain` is the FQDN that resolves to the authentik LDAP outpost. This is commonly derived from the base DN. For example, if `ldap.baseDN` is `dc=ldap,dc=goauthentik,dc=io`, then `ldap.domain` might be `ldap.goauthentik.io`. - `qnap.serviceAccount` is the authentik service account that QNAP NAS uses to bind to LDAP. - `qnap.serviceAccountPassword` is the app password generated for the service account by authentik. Connecting a QNAP NAS to authentik LDAP requires a two-step service configuration. First, use the QNAP web interface to store the encrypted bind password. Then, edit the generated LDAP configuration over SSH so QNAP can search authentik's LDAP structure. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. The QNAP LDAP client configuration has issues with passwords that are longer than 66 characters. Use a service account app password that is 66 characters or shorter. ## authentik configuration To support the integration of QNAP NAS with authentik, you need an LDAP application and provider, a service account with LDAP search permissions, and an LDAP outpost. ### Create the LDAP resources 1. Follow the [LDAP provider setup](/docs/add-secure-apps/providers/ldap/create-ldap-provider/) to create or reuse the LDAP application and provider, create a service account, assign the LDAP search permission, and create an LDAP outpost. 2. Use `qnap.serviceAccount` as the service account username and copy its generated app password as `qnap.serviceAccountPassword`. 3. Note the provider's **Base DN** value as `ldap.baseDN`. 4. Open the LDAP application's **Policy / Group / User Bindings** tab and bind `qnap.serviceAccount` and any users or groups that should be able to authenticate to QNAP NAS. 5. Ensure that the LDAP application is selected on the outpost and deploy the outpost where the QNAP NAS can reach it as `ldap.domain`. ## QNAP NAS configuration ### Configure LDAP in the web interface 1. Log in to the QNAP web interface as an administrator. 2. Navigate to **Control Panel** > **Privilege** > **Domain Security**. 3. Select **LDAP authentication**. 4. Configure the LDAP settings for your environment, using `ldap.domain`, `ldap.baseDN`, `qnap.serviceAccount`, and `qnap.serviceAccountPassword`. 5. Click **Apply**. ![QNAP domain security LDAP configuration](./qnap-ldap-configuration.png) Each time you click **Apply** in the QNAP LDAP web interface, QNAP overwrites `/etc/config/nss_ldap.conf` with generated values. Repeat the SSH changes below after saving LDAP settings in the web interface. The web interface step is required because QNAP stores the encrypted bind password in `/etc/config/nss_ldap.ensecret`. ### Update the LDAP configuration over SSH QNAP searches users and groups with fixed filters for the `posixAccount` and `posixGroup` object classes. It also uses a single-level search scope unless the generated configuration is changed. The configuration below maps those object classes to authentik objects and keeps the search bases explicit. Connect to the QNAP NAS over SSH and stop the LDAP service: ```bash /sbin/setcfg LDAP Enable FALSE /etc/init.d/ldap.sh stop ``` Edit `/etc/config/nss_ldap.conf`: ```ini title="/etc/config/nss_ldap.conf" host ${ldap.domain} base ${ldap.baseDN} uri ldaps://${ldap.domain}/ ssl on rootbinddn cn=${qnap.serviceAccount},ou=users,${ldap.baseDN} nss_schema rfc2307bis nss_map_objectclass posixAccount user nss_map_objectclass shadowAccount user nss_map_objectclass posixGroup group nss_map_attribute uid cn nss_map_attribute gecos displayName nss_map_attribute uniqueMember member nss_base_passwd ou=users,${ldap.baseDN}?one nss_base_shadow ou=users,${ldap.baseDN}?one nss_base_group ou=groups,${ldap.baseDN}?one tls_checkpeer no referrals no bind_policy soft timelimit 120 tls_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5 nss_initgroups_ignoreusers admin,akadmin ``` The configuration remaps QNAP's expected `posixAccount` and `posixGroup` object classes to authentik's `user` and `group` object classes. It also maps `uid` to `cn` so QNAP displays authentik usernames instead of internal IDs. Start the LDAP service: ```bash /sbin/setcfg LDAP Enable TRUE /etc/init.d/ldap.sh start ``` ## Configuration verification To confirm that authentik is properly configured with QNAP NAS, connect to the NAS over SSH and list users and groups: ```bash getent passwd getent group ``` The output should include local QNAP entries and entries from authentik. ## Resources - [QNAP tutorial: connecting a QNAP NAS to an LDAP directory](https://www.qnap.com/en/how-to/tutorial/article/connecting-a-qnap-nas-to-an-ldap-directory) --- ## Integrate with RabbitMQ ## What is RabbitMQ? > RabbitMQ is an open-source message broker that lets applications send, receive, and route messages between each other reliably and asynchronously. > > \-- [https://www.rabbitmq.com/](https://www.rabbitmq.com/) ## Preparation The following placeholders are used in this guide: - `rabbitmq.company` is the FQDN of the RabbitMQ installation. - `authentik.company` is the FQDN of the authentik installation. This guide covers RabbitMQ 4.x with the `rabbitmq_auth_backend_oauth2` plugin. The same configuration supports both Management UI login via OpenID Connect and AMQP / HTTP API authentication with an access token used as the password. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of RabbitMQ with authentik, you need to create a property mapping, two user groups, and an application/provider pair. ### Create a property mapping The following mapping adds the `aud` claim required by RabbitMQ. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property mappings** and click **Create**. 3. Select **Scope Mapping** as the property mapping type. 4. Set the following values: - **Name**: `RabbitMQ claims` - **Scope name**: `rabbitmq` - **Expression**: ```python return { "aud": ["rabbitmq"], } ``` 5. Click **Finish**. ### Create user groups Using the authentik Admin interface, navigate to **Directory** > **Groups** and click **Create** to create two groups: `rabbitmq-administrator` for full administrator access in RabbitMQ and `rabbitmq-monitoring` for read-only monitoring access. After creating the groups, select a group, navigate to the **Users** tab, and manage its members by using the **Add existing user** and **Create user** buttons as needed. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **Client Type** to **Public**. - Note the **Client ID** value because it will be required later. - Under **Grant Types**, select **Authorization Code** and **Client credentials**. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://rabbitmq.company:15672/js/oidc-oauth/login-callback.html`. - Select any available signing key. - Under **Advanced protocol settings**: - Add the `RabbitMQ claims` scope that you created in the previous section to **Selected Scopes**. - **Configure Bindings**: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. - It's recommended to create the following bindings: - Order `10` — group `rabbitmq-administrator`. - Order `20` — group `rabbitmq-monitoring`. 3. Click **Submit** to save the new application and provider. ## RabbitMQ configuration Enable the OAuth 2 backend plugin: ```shell rabbitmq-plugins enable rabbitmq_auth_backend_oauth2 ``` Add the following configuration, replacing `` with the value from the provider you just created: ```ini title="/etc/rabbitmq/rabbitmq.conf" auth_backends.1 = rabbit_auth_backend_oauth2 auth_backends.2 = rabbit_auth_backend_internal auth_oauth2.resource_server_id = rabbitmq auth_oauth2.issuer = https://authentik.company/application/o// auth_oauth2.preferred_username_claims.1 = preferred_username auth_oauth2.preferred_username_claims.2 = email auth_oauth2.additional_scopes_key = groups auth_oauth2.scope_aliases.1.alias = rabbitmq-administrator auth_oauth2.scope_aliases.1.scope = rabbitmq.tag:administrator rabbitmq.read:* rabbitmq.write:* rabbitmq.configure:* auth_oauth2.scope_aliases.2.alias = rabbitmq-monitoring auth_oauth2.scope_aliases.2.scope = rabbitmq.tag:monitoring rabbitmq.read:* management.oauth_enabled = true management.oauth_client_id = management.oauth_scopes = openid profile email rabbitmq ``` Restart RabbitMQ for the changes to take effect. ### Authenticate AMQP and HTTP API clients For non-interactive clients, create or select an authentik user or service account, add it to the appropriate RabbitMQ group, and create an app password for it. To create a dedicated service account: 1. In the authentik Admin interface, navigate to **Directory** > **Users** and click **Create a service account**. 2. Enter a username for the service account and click **Create**. 3. Copy the generated app password. If you need to create another app password later, navigate to **Directory** > **Tokens and App passwords** and click **Create**. 4. Add the service account to `rabbitmq-administrator` or `rabbitmq-monitoring`. Request an access token from authentik: ```bash curl --request POST https://authentik.company/application/o/token/ \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "grant_type=client_credentials" \ --data-urlencode "client_id=" \ --data-urlencode "username=" \ --data-urlencode "password=" \ --data-urlencode "scope=openid profile email rabbitmq" ``` ```powershell $body = @{ grant_type = "client_credentials" client_id = "" username = "" password = "" scope = "openid profile email rabbitmq" } Invoke-RestMethod ` -Method Post ` -Uri "https://authentik.company/application/o/token/" ` -ContentType "application/x-www-form-urlencoded" ` -Body $body ``` Use the returned `access_token` as the RabbitMQ password. RabbitMQ ignores the submitted username when OAuth 2 authentication is used; permissions come from the claims in the access token. ## Configuration verification To confirm that authentik is properly configured with RabbitMQ, log out of the RabbitMQ Management UI, click **Click here to log in**, and authenticate through authentik. ## Resources - [RabbitMQ docs — OAuth 2.0 authentication](https://www.rabbitmq.com/docs/oauth2) - [RabbitMQ docs — Management plugin](https://www.rabbitmq.com/docs/management) --- ## Integrate with RustDesk Server Pro ## What is RustDesk Server Pro? > RustDesk Server Pro is a premium self-hosted solution for managing remote desktop connections securely and efficiently. > It offers enhanced performance, advanced security features, and customization options like branding to meet professional needs. > Ideal for businesses, it provides full control over data while ensuring scalable and reliable remote access. > > \-- [https://rustdesk.com/](https://rustdesk.com/) ## Preparation This guide uses the following placeholders: - `rustdesk.company` is the FQDN of the RustDesk Server Pro installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of RustDesk Server Pro with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://rustdesk.company/api/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## RustDesk Server Pro configuration 1. Sign in to RustDesk Server Pro using a browser. 2. In the left menu, select **Settings** and then **OIDC**. 3. Click **+ New Auth Provider**. 4. In the popup window, select **custom** as the **Auth Type** and click **OK**. 5. Configure the following values using information from the authentik provider: - Set **Name** to `authentik` - Set **Client ID** to the Client ID copied from authentik. - Set **Client secret** to the Client Secret copied from authentik. - Set **Issuer** to `https://authentik.company/application/o//` - Set **Authorization Endpoint** to `https://authentik.company/application/o/authorize/` - Set **Token Endpoint** to `https://authentik.company/application/o/token/` - Set **Userinfo Endpoint** to `https://authentik.company/application/o/userinfo/` - Set **JWKS Endpoint** to `https://authentik.company/application/o//jwks/` 6. Click **Submit**. Users are created automatically on login. Permissions must be assigned by an administrator after user creation. ## Configuration verification To confirm that authentik is properly configured with RustDesk Server Pro, log out, open RustDesk Server Pro, and click **Continue with authentik**. After authenticating through authentik, you should return to RustDesk Server Pro and see the username in the top-right corner. ## Resources - [RustDesk Server Pro OIDC documentation](https://rustdesk.com/docs/en/self-host/rustdesk-server-pro/oidc/) --- ## Integrate with Semaphore UI ## What is Semaphore UI? > Semaphore UI is a modern web interface for managing popular DevOps tools. > > \-- [https://semaphoreui.com/](https://semaphoreui.com/) ## Preparation The following placeholders are used in this guide: - `semaphore.company` is the FQDN of the Semaphore installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Semaphore UI with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://semaphore.company/api/auth/oidc/authentik/redirect/`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Semaphore UI configuration Log in to your Semaphore UI host via SSH. Edit the `/etc/semaphore/config.json` file with the text editor of your choice. Add the `oidc_providers` configuration: ```json title="/etc/semaphore/config.json" { "oidc_providers": { "authentik": { "display_name": "Sign in with authentik", "provider_url": "https://authentik.company/application/o//", "client_id": "", "client_secret": "", "redirect_url": "https://semaphore.company/api/auth/oidc/authentik/redirect/", "username_claim": "preferred_username", "name_claim": "preferred_username", "email_claim": "email", "scopes": ["openid", "profile", "email"] } } } ``` The `oidc_providers` key, such as `authentik`, must match the provider name in the redirect URL. If a `Not Found` error is displayed after login, you might need to set `web_root` to `/` (see [https://github.com/semaphoreui/semaphore/issues/2681](https://github.com/semaphoreui/semaphore/issues/2681)): ```env title=".env" SEMAPHORE_WEB_ROOT=/ ``` Users are created when they log in with authentik. They do not have permissions to create resources initially. These permissions must be assigned by the local administrator that was created during the first Semaphore UI login. ## Configuration verification To confirm that authentik is properly configured with Semaphore UI, log out, open Semaphore UI, and click the SSO login button. You should be redirected to authentik and then back to Semaphore UI. ## Resources - [Semaphore UI docs: Authentik config](https://semaphoreui.com/docs/admin-guide/openid/authentik) - [Semaphore UI docs: OpenID Connect](https://semaphoreui.com/docs/admin-guide/openid) --- ## Integrate with sssd ## What is sssd? > **SSSD** is an acronym for System Security Services Daemon. It is the client component of centralized identity management solutions such as FreeIPA, 389 Directory Server, Microsoft Active Directory, OpenLDAP and other directory servers. The client serves and caches the information stored in the remote directory server and provides identity, authentication and authorization services to the host machine. > > \-- [https://sssd.io/](https://sssd.io/) Note that authentik supports *only* user and group objects. As a consequence, it cannot be used to provide automount or sudo configuration, nor can it provide netgroups or services to `nss`. Kerberos is also not supported. ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik LDAP outpost installation. - `ldap.baseDN` is the Base DN you configure in the LDAP provider. - `ldap.domain` is typically a fully qualified domain name (FQDN) representing your domain. It is often derived from the components of your base DN. For example, if `ldap.baseDN` is `dc=ldap,dc=goauthentik,dc=io`, then the domain is `ldap.goauthentik.io`. - `ldap.searchGroup` refers to the "Search Group" that has permission to view all users and groups within authentik. - `sssd.serviceAccount` is a service account created in authentik. - `sssd.serviceAccountToken` is the service account token generated by authentik. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. The provider configuration assumes that connections to the outpost use LDAPS, with properly configured certificates on both authentik and the host running sssd. LDAPS is the recommended protocol for secure communication. For details on setting up SSL and StartTLS on the outpost, refer to [authentik’s LDAP provider documentation](/docs/add-secure-apps/providers/ldap#ssl--starttls). ## authentik configuration Follow [official documentation](/docs/add-secure-apps/outposts/#create-and-configure-an-outpost) to create an **LDAP outpost**. If you already have an LDAP outpost configured, you can use it without additional setup. No further configuration in authentik is needed. ## sssd configuration First, install the necessary sssd packages on your host. The package is commonly named `sssd`. This guide helps you configure `sssd.conf` for LDAP only. You likely need to perform other tasks for a usable setup, such as setting up auto-mounted or auto-created home directories. Those tasks are outside the scope of this guide. Create a file at `/etc/sssd/sssd.conf` with contents similar to the following: ```ini title="/etc/sssd/sssd.conf" [nss] filter_groups = root filter_users = root reconnection_retries = 3 [sssd] config_file_version = 2 reconnection_retries = 3 domains = ${ldap.domain} services = nss, pam, ssh [pam] reconnection_retries = 3 [domain/${ldap.domain}] cache_credentials = True id_provider = ldap chpass_provider = ldap auth_provider = ldap access_provider = ldap ldap_uri = ldaps://${authentik.company}:636 ldap_schema = rfc2307bis ldap_search_base = ${ldap.baseDN} ldap_user_search_base = ou=users,${ldap.baseDN} ldap_group_search_base = ${ldap.baseDN} ldap_user_object_class = user ldap_user_name = cn ldap_group_object_class = group ldap_group_name = cn # Optionally, filter logins to only a specific group #ldap_access_order = filter #ldap_access_filter = memberOf=cn=authentik Admins,ou=groups,${ldap.baseDN} ldap_default_bind_dn = cn=${sssd.serviceAccount},ou=users,${ldap.baseDN} ldap_default_authtok = ${sssd.serviceAccountToken} # authentik does not define a loginShell attribute by default. # Users without an explicit shell setting will be assigned the following default shell: default_shell = /bin/sh ``` You should now be able to start sssd; however, the system might not yet be set up to use it. Depending on your platform, you might need to use `authconfig` or `pam-auth-update` to configure your system. You can store SSH authorized keys in LDAP by adding the `sshPublicKey` attribute to any user with their public key as the value. Please note that by default, sssd returns all user accounts; active and disabled. This means that disabled user accounts can still authenticate via `sshPublicKey`. To prevent this, you can filter out disabled user accounts by adding the following lines to the LDAP section of your `sssd.conf` file: ```ini #ldap_access_order = filter #ldap_access_filter = ak-active=true ``` ## Configuration verification To confirm that authentik is properly configured with sssd, restart sssd and query an authentik user and group: ```bash systemctl restart sssd getent passwd getent group ``` The commands should return entries from authentik. If your host is configured to use sssd for PAM or SSH, log in with an allowed authentik user to verify authentication. ## Resources The setup of sssd can vary based on Linux distribution and version; here are some resources that can help you get this set up: authentik is providing a simple LDAP server, not an Active Directory domain. Be sure you're looking at the correct sections in these guides. - [SSSD Docs - Quick Start LDAP](https://sssd.io/docs/quick-start.html#quick-start-ldap) - [RedHat Docs - Configuring System Services for SSSD](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/configuring_services) - [Ubuntu Docs - Introduction to network user authentication with SSSD](https://ubuntu.com/server/docs/service-sssd) - [Debian Manpages - SSSD LDAP provider](https://manpages.debian.org/unstable/sssd-ldap/sssd-ldap.5.en.html) - [Arch Linux Wiki - LDAP authentication](https://wiki.archlinux.org/title/LDAP_authentication) --- ## Integrate with Synology DSM (DiskStation Manager) ## What is Synology DSM? > Synology Inc. is a Taiwanese corporation that specializes in network-attached storage (NAS) appliances. Synology's line of NAS is known as the DiskStation for desktop models, FlashStation for all-flash models, and RackStation for rack-mount models. Synology's products are distributed worldwide and localized in several languages. > > \-- [https://www.synology.com/en-global/dsm](https://www.synology.com/en-global/dsm) ## Preparation The following placeholders are used in this guide: - `synology.company` is the FQDN of the Synology DSM server. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Synology DSM with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://synology.company`. - Select any available signing key. - Under **Advanced protocol settings**, set the **Subject mode** to be based on the user's email. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Synology DSM configuration To configure Synology DSM to utilize authentik as an OpenID Connect 1.0 Provider: 1. In the DSM Control Panel, navigate to **Domain/LDAP** > **SSO Client**. 2. Check the **Enable OpenID Connect SSO service** checkbox in the **OpenID Connect SSO Service** section. 3. Configure the following values: - **Profile**: `OIDC` - **Account type**: `Domain/LDAP/local` - **Name**: `authentik` - **Well Known URL**: copy the **OpenID Configuration URL** from the authentik provider. - **Application ID**: enter the **Client ID** from the authentik provider. - **Application Key**: enter the **Client Secret** from the authentik provider. - **Redirect URL**: `https://synology.company` - **Authorization Scope**: `openid profile email` - **Username Claim**: `preferred_username` 4. Save the settings. Ensure that users exist in the selected DSM account type before they use SSO. ### Troubleshoot `not privilege` errors **Error `not privilege`** The login process can fail with a `not privilege` error when the SSO pop-up is blocked. Allow pop-ups for the DSM site in the browser configuration. This error can also happen when you have multiple redirect URI entries but DSM uses only the last one during login. DSM matches the redirect URI based on the `Host` and `HTTPS` headers, so do not add `#/signin` to the redirect URI. ## Configuration verification To confirm that authentik is properly configured with Synology DSM, log out, open Synology DSM, and log in through authentik. ## Resources - [Synology DSM SSO Client documentation](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_directory_service_sso?version=7) --- ## Integrate with Termix ## What is Termix? > Termix is a clientless web-based server management platform with SSH terminal, tunneling, and file editing capabilities. > > \-- [https://termix.site/](https://termix.site/) ## Preparation The following placeholders are used in this guide: - `termix.company` is the FQDN of the Termix installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Termix with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://termix.company/users/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Termix configuration 1. Log in to Termix as an administrator. 2. Click your admin username in the bottom-left corner and open the **Admin Settings** interface. 3. Navigate to the **OIDC** tab. 4. Set the following required settings: - **Client ID**: Client ID from authentik - **Client Secret**: Client secret from authentik - **Authorization URL**: `https://authentik.company/application/o/authorize/` - **Issuer URL**: `https://authentik.company/application/o//` - **Token URL**: `https://authentik.company/application/o/token/` 5. Click **Save Configuration**. ## Configuration verification To verify that authentik is correctly integrated with Termix, first log out of your Termix account. From the login screen, select **External** and then choose **Login with External Provider**. You should be redirected to your authentik instance, and after successfully authenticating, the system will return you to Termix where you will be logged in automatically. ## Resources - [Termix Docs - OIDC (OpenID Connect) Setup Guide](https://docs.termix.site/features/authentication/oidc) --- ## Integrate with Terraform Cloud ## What is Terraform Cloud? > Terraform Cloud is a managed SaaS platform by HashiCorp that enables teams to collaborate on infrastructure-as-code by running, storing state, enforcing policies, and automating workflows for Terraform configurations. > > \-- [https://terraform.io/cloud](https://terraform.io/cloud) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Terraform with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations: - Set the **ACS URL** to `https://temp.temp`. - Set the **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**, select an available **Signing Certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Copy the metadata URL 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the provider that you created in the previous step. 3. Under **Related objects**, click **Copy download URL** and take note of the URL as it will be used in the next step. ## Terraform Cloud configuration 1. Log in to [Terraform Cloud](https://app.terraform.io) as an administrator. 2. Select your organization from the drop-down menu in the top-left corner, then click **Settings** > **SSO**. 3. Click **Setup SSO**, click **SAML**, then **Next**, and set the **Metadata URL** to the URL copied in the previous step. 4. Click **Save Settings**. 5. Under **HCP Terraform**, take note of the **Entity ID (Audience)** and **Assertion Consumer URL** values. Do not close this window. ### Update the authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and provider that you created in the previous step. 3. Click **Edit**. 4. Under **Protocol settings**, set the value of the **ACS URL** to the **Assertion Consumer URL** value from the previous step. Then, set the value of the **Audience** to the **Entity ID (Audience)** value from the previous step. 5. Click **Update**. ### Enable SSO 1. In Terraform Cloud, under **Settings** > **SSO**, click **Test**. Successfully authenticating will result in a green checkmark and **Successful** appearing. Then, to enable SSO, click **Enable**. 2. Read the warning message that appears and click **Enable SAML**. ## Configuration verification To verify that authentik is correctly integrated with Terraform Cloud, first log out of Terraform Cloud. Open the [Terraform Cloud login page](https://app.terraform.io/) and click **Sign in with Terraform SSO**. Enter the name of your organization, click **Next**, and you'll be redirected to authentik. Once authenticated, you will be signed into Terraform Cloud. ## Resources - [Terraform Cloud Docs - Use single sign-on with SAML](https://developer.hashicorp.com/terraform/cloud-docs/users-teams-organizations/single-sign-on/saml) --- ## Integrate with Terrakube ## What is Terrakube? > Terrakube is an open-source collaboration platform designed for managing remote Infrastructure-as-Code (IaC) operations with Terraform. It serves as an alternative to proprietary tools like Terraform Enterprise. > > \-- [https://terrakube.io/](https://terrakube.io/) ## Preparation The following placeholders are used in this guide: - `terrakube-dex.company` is the FQDN of the [Dex](https://dexidp.io/) container of the Terrakube installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Terrakube with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://terrakube-dex.company/dex/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Terrakube configuration This guide assumes that you have environment variables `$TERRAKUBE_OIDC_CLIENT_ID` and `$TERRAKUBE_OIDC_CLIENT_SECRET` set up. You can hard-code values if your setup doesn’t support environment variables, but be aware that doing so is not recommended for security reasons. 1. **Locate the Dex Configuration File** Find the Dex configuration file, typically named `config.yaml` or `config.docker.yaml`. It’s usually located in the `/etc/dex` directory or the corresponding directory for a containerized setup. 2. **Update the Dex Configuration** To define the Terrakube OIDC connector, open the configuration file and add the following block: ```yaml connectors: - type: oidc id: TerrakubeClient name: TerrakubeClient config: issuer: "https://authentik.company/application/o//" clientID: $TERRAKUBE_OIDC_CLIENT_ID clientSecret: $TERRAKUBE_OIDC_CLIENT_SECRET redirectURI: "https://terrakube-dex.company/dex/callback" insecureEnableGroups: true ``` 3. **Set Environment Variables** Add the following variables to your `.env` file, replacing them with the appropriate values for your Client ID and Client Secret: ```env title=".env" TERRAKUBE_OIDC_CLIENT_ID=*your Client ID* TERRAKUBE_OIDC_CLIENT_SECRET=*your Client Secret* ``` ## Configuration verification To ensure that authentik is correctly configured with Terrakube, log out and log back in through authentik. Depending on the number of connectors you have set up, you should either be redirected to authentik or see a new button appear on the Dex login page. ## Resources - [Terrakube Docs - User Authentication (DEX)](https://docs.terrakube.io/getting-started/deployment/user-authentication-dex) - [Dex Docs - Authentication through an OpenID Connect provider](https://dexidp.io/docs/connectors/oidc/) --- ## Integrate with TrueNAS TrueCommand ## What is TrueNAS TrueCommand? > TrueCommand is a ZFS-aware solution allowing you to set custom alerts on statistics like ARC usage or pool capacity and ensuring storage uptime and future planning. TrueCommand also identifies and pinpoints errors on drives or vdevs (RAID groups), saving you valuable time when resolving issues. > > \-- [https://www.truenas.com/truecommand/](https://www.truenas.com/truecommand/) This setup assumes you will be using HTTPS as TrueCommand generates ACS and Redirect URLs based on the complete URL. ## Preparation The following placeholders are used in this guide: - `truecommand.company` is the FQDN of the TrueCommand installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of TrueCommand with authentik, you need to create an application/provider pair in authentik. ### Create property mappings 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create three or five **SAML Provider Property Mapping**s, depending on your setup, with the following settings: - **Username Mapping:** - **Name**: Choose a descriptive name - **SAML Attribute Name**: `unique_name` - **Friendly Name**: Leave blank - **Expression**: `return request.user.username` - **Email Mapping:** - **Name**: Choose a descriptive name - **SAML Attribute Name**: `email` - **Friendly Name**: Leave blank - **Expression**: `return request.user.email` - **Name Mapping:** - **Name**: Choose a descriptive name - **SAML Attribute Name**: `given_name` or `display_name` - **Friendly Name**: Leave blank - **Expression**: `return request.user.name` - **Title Mapping:** - **Name**: Choose a descriptive name - **SAML Attribute Name**: `title` - **Friendly Name**: Leave blank - **Expression**: `return [custom_attribute]` - **Telephone Number Mapping:** - **Name**: Choose a descriptive name - **SAML Attribute Name**: `telephone_number` - **Friendly Name**: Leave blank - **Expression**: `return [custom_attribute]` ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://truecommand.company/saml/acs`. - Set the **SLS URL** to `https://truecommand.company/saml/slo`. - Set the **SLS Binding** to `Post`. - Set the **Logout Method** to `Front-channel (Iframe)`. - Under **Advanced protocol settings**, add the three or five **Property mappings** you created in the previous section, set the **NameID Property Mapping** to a property mapping based on the user's email, and select an available **Signing certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Navigate to **Applications** > **Providers** > ***Provider***, then click **Copy download URL** to save the **metadata URL** to your clipboard. ## TrueCommand configuration 1. Click the gear icon in the upper-right corner. 2. Select **Administration**. 3. Click **Configure**. 4. Set **SAML Identity Provider URL** to the metadata URL from your clipboard. 5. Click **Save**. 6. Click **Configure** again, select **Start the SAML service**, and then click **Save** to start the service. ## Configuration verification To verify that authentik is correctly integrated with TrueCommand, log out of TrueCommand and sign back in with SAML. After authenticating with authentik, you should be redirected back to TrueCommand. ## Resources - [TrueNAS Docs - SAML](https://www.truenas.com/docs/truecommand/administration/settings/samlad/) --- ## Integrate with Veeam Backup & Replication ## What is Veeam Backup & Replication? > Veeam Backup & Replication is a comprehensive data protection and disaster recovery solution. It enables image-level backups of virtual, physical, and cloud workloads and supports flexible restore options across the entire environment. > > \-- [https://www.veeam.com/products/veeam-data-platform/backup-recovery.html](https://www.veeam.com/products/veeam-data-platform/backup-recovery.html) ## Preparation The following placeholders are used in this guide: - `vbr.company` is the FQDN of the Veeam Backup & Replication server. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. You need one or more existing groups in authentik to assign roles in Veeam Backup & Replication. ## authentik configuration To support the integration of Veeam Backup & Replication with authentik, you need to download the Veeam Backup & Replication service provider metadata and then create an application/provider pair in authentik. ### Download the service provider metadata 1. Log in to the Veeam Backup & Replication console as an administrator. 2. From the main menu, select **Users & Roles**. 3. Open the **Identity Provider** tab. 4. Select **Enable SAML authentication**. 5. Under **Service Provider (SP) information**, click **Install** to select a valid Veeam Backup & Replication server certificate. 6. Under **Service Provider (SP) information**, click **Download** to save the service provider metadata XML file. You will upload this file to authentik in the next section. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider from Metadata** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configuration: - **Metadata**: select the SP metadata XML you downloaded from Veeam Backup & Replication during the pre-configuration step. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Navigate to **Applications** > **Providers** and click the provider you created. 5. Open the **Metadata** tab and click **Download** to save the identity provider metadata XML file. ## Veeam Backup & Replication configuration 1. Switch back to the Veeam Backup & Replication console and reopen **Users & Roles** > **Identity Provider**. 2. Under **Identity provider (IdP) information**, click **Browse** and select the metadata XML you downloaded from authentik in the previous step. 3. Click **OK** to save the SAML configuration. ### Map authentik groups to Veeam roles To grant access to a user, the authentik group the user belongs to must be mapped to a Veeam role. 1. In the Veeam Backup & Replication console, open **Users & Roles** and switch to the **Security** tab. 2. Click **Add** > **External user or group**. 3. From the **Type** menu, select **Group**. 4. In the **Name** field, enter the name of the authentik group whose members should be granted the role. 5. From the **Role** menu, select the role that you want to assign to members of this group. 6. Click **OK** to save the role mapping. The group name that you enter in Veeam Backup & Replication must match the authentik group name. ## Configuration verification To confirm that authentik is properly configured with Veeam Backup & Replication, log out of the Veeam Backup & Replication console and click **Sign in with SSO** on the sign-in screen. You should be redirected to authentik to log in, then redirected back to the Veeam Backup & Replication console. ## Resources - [Veeam Help Center - SAML Authentication](https://helpcenter.veeam.com/docs/vbr/userguide/identity_provider.html?ver=13) - [Veeam Help Center - Logging in to Veeam Backup & Replication](https://helpcenter.veeam.com/docs/vbr/userguide/logon_to_console.html) --- ## Integrate with Veeam Enterprise Manager ## What is Veeam Enterprise Manager? > Veeam Backup Enterprise Manager (Enterprise Manager) is a management and reporting component that allows you to manage multiple Veeam Backup & Replication installations from a single web console. Veeam Backup Enterprise Manager helps you optimize performance in remote office/branch office (ROBO) and large-scale deployments and maintain a view of your entire virtual environment. > > \-- [https://helpcenter.veeam.com/docs/backup/em/introduction.html](https://helpcenter.veeam.com/docs/backup/em/introduction.html) ## Preparation The following placeholders are used in this guide: - `veeam.company` is the FQDN of the Veeam Enterprise Manager installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. You will need one or more existing groups in authentik to assign roles in Veeam Enterprise Manager. ## Veeam Enterprise Manager pre-configuration Log in to your Veeam Enterprise Manager. Navigate to **Configuration** in the top-right corner. In the left sidebar, select **Settings**, then select the **SAML Authentication** tab. Select the **Enable SAML 2.0** checkbox. Further down the page, click **Download** to download the metadata. ## authentik configuration To support the integration of Veeam Enterprise Manager with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **Create** to create a provider. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Click **Import** and upload the metadata XML downloaded from Veeam Enterprise Manager during pre-configuration. - Confirm the imported **ACS URL** and **Issuer** values match your Veeam Enterprise Manager deployment. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. Go back to the Provider sidebar and locate the Veeam Enterprise Manager. Click the **Download Metadata** button. ## Veeam Enterprise Manager configuration Back on Veeam Enterprise Manager, click **Import from File**, and select the XML file that you downloaded from authentik. Make sure that the **Enable SAML 2.0** checkbox is still enabled, and click **Save**. To map Veeam Enterprise Manager permissions to an authentik user, create an external group. In Veeam Enterprise Manager, navigate to **Configuration** > **Roles**, click **Add...**, and select **External Group**. Enter the name of an authentik group that the user is a member of. --- ## Integrate with Zammad ## What is Zammad? > Zammad is a web-based, open source user support and ticketing system. > > \-- [https://zammad.org/](https://zammad.org/) ## Preparation The following placeholders are used in this guide: - `zammad.company` is the FQDN of the Zammad installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration SAML To support the integration of Zammad with authentik using SAML, you need to create SAML property mappings and an application/provider pair in authentik. ### Create property mappings Zammad requests SAML attributes named `email`, `name`, `first_name`, and `last_name`. Create custom property mappings so authentik sends those attribute names in the SAML assertion. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `Zammad email` - **SAML Attribute Name**: `email` - **Expression**: ```python return request.user.email ``` 5. Click **Finish** to save the property mapping. 6. Repeat steps 2-5 to create the following additional SAML provider property mappings: - **Name**: `Zammad name` - **SAML Attribute Name**: `name` - **Expression**: ```python return request.user.name or request.user.get_full_name() or request.user.username ``` - **Name**: `Zammad first_name` - **SAML Attribute Name**: `first_name` - **Expression**: ```python return request.user.first_name or (request.user.name.split(" ", 1)[0] if request.user.name else request.user.username) ``` - **Name**: `Zammad last_name` - **SAML Attribute Name**: `last_name` - **Expression**: ```python return request.user.last_name or (request.user.name.rsplit(" ", 1)[-1] if " " in request.user.name else "") ``` ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://zammad.company/auth/saml/callback`. - Set the **Audience** to `https://zammad.company/auth/saml/metadata`. - Set the **SLS URL** to `https://zammad.company/auth/saml/slo`. - Set the **SLS Binding** to `Redirect`. - Set the **Logout Method** to `Front-channel (Iframe)`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `Zammad email`. - Set **Default NameID Policy** to `Email`. - Add the Zammad property mappings that you created earlier to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the certificate file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section (e.g. `Provider for zammad`). 3. Under **Related objects** > **Download signing certificate**, click on **Download**. This downloaded file is your certificate file and it will be required in the next section. ## Zammad configuration SAML To configure Zammad's SAML integration with authentik, log in to Zammad as an administrator. Go to **Settings** (the gear icon) and select **Security** > **Third-party Applications**. At the top of the **Third-party Applications** page, enable **Automatic account link on initial logon** if existing Zammad users should be linked to matching authentik users during their first SSO login. 1. Activate the **Authentication via SAML** toggle. 2. Set the following fields: - **Display name**: authentik - **IDP SSO target URL**: `https://authentik.company/application/saml//` - **IDP single logout target URL**: `https://authentik.company/application/saml//` - **IDP Certificate**: paste the contents of your certificate file. - **Name Identifier Format**: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` 3. Click **Submit** to save the authentication settings. If Zammad cannot validate the connection to authentik when saving the SAML configuration, review the certificate trust path before temporarily disabling **SSL verification**. Disabling SSL verification accepts any presented certificate and should only be used for testing or short-term troubleshooting. ## Configuration verification To verify that authentik is correctly integrated with Zammad, log out of Zammad, open Zammad, and log in by clicking the SAML button on the login screen. The button shows the **Display name** that you configured in Zammad. ## authentik configuration OIDC In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Zammad with authentik using OIDC, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **Client type** to `Public`. - Note the **Client ID** value because it will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://zammad.company/auth/openid_connect/callback`. - Set the **Logout URI** to `https://zammad.company/auth/openid_connect/backchannel_logout`. - Select a **Signing Key**. - Under **Advanced protocol settings**, set **Subject Mode** to **Based on the User's Email**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Zammad configuration OIDC To configure Zammad's OIDC integration with authentik, log in to Zammad as an administrator. Go to **Settings** (the gear icon) and select **Security** > **Third-party Applications**. At the top of the **Third-party Applications** page, enable **Automatic account link on initial logon** if existing Zammad users should be linked to matching authentik users during their first SSO login. 1. Activate the **Authentication via OpenID Connect** toggle. 2. Set the following fields: - **Display name**: authentik - **Identifier**: enter the Client ID from authentik. - **Issuer**: `https://authentik.company/application/o//` - **PKCE**: `yes` 3. Click **Submit** to save the authentication settings. ## Configuration verification To verify that authentik is correctly integrated with Zammad, log out of Zammad, open Zammad, and log in by clicking the OIDC button on the login screen. The button shows the **Display name** that you configured in Zammad. ## Resources - [Zammad Admin Documentation - SAML](https://admin-docs.zammad.org/en/latest/settings/security/third-party/saml.html) - [Zammad Admin Documentation - OpenID Connect](https://admin-docs.zammad.org/en/latest/settings/security/third-party/openid-connect.html) - [Zammad Admin Documentation - Third-Party Applications](https://admin-docs.zammad.org/en/latest/settings/security/third-party.html) --- ## Integrate with Zendesk ## What is Zendesk? > Zendesk is a customer service platform for support, sales, and customer engagement workflows. > > \-- [https://www.zendesk.com/](https://www.zendesk.com/) ## Preparation The following placeholders are used in this guide: - `company.zendesk.com` is the FQDN of your Zendesk company portal. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Zendesk can use OpenID Connect (OIDC) or SAML for SSO. Zendesk identifies SSO users by email address, so make sure that users who sign in with authentik have an email address that matches their Zendesk user. ## authentik configuration OIDC In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Zendesk with authentik over OIDC, create an application/provider pair in authentik and then create an OIDC SSO configuration in Zendesk. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://company.zendesk.com/access/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Zendesk configuration OIDC ### Create an OIDC SSO configuration 1. Log in to Zendesk as an administrator. 2. In the Admin Center, click **Account** in the sidebar, then navigate to **Security** > **Single sign-on**. 3. Click **Create SSO configuration**, then select **OpenID Connect**. 4. Configure the OIDC SSO configuration: - **Configuration name**: `authentik` - **Client ID**: `` - **Client secret**: `` - **Scopes**: `openid profile email` - Enable **Turn on auto discovery**. - **Issuer URL**: `https://authentik.company/application/o//` - **Authentication Mode**: `PKCE` - Enable **Show button when users sign in**. - **Button name**: `authentik` 5. Click **Save**. ### Assign the SSO configuration Zendesk SSO configurations are inactive until they are assigned to team members, end users, or both. 1. Open the security settings for the users who should authenticate with authentik: - For team members, click **Account** in the sidebar, then navigate to **Security** > **Team member authentication**. - For end users, click **Account** in the sidebar, then navigate to **Security** > **End user authentication**. 2. Select **External authentication** to show the SSO configuration options. 3. Select the `authentik` SSO configuration. 4. Select how users sign in: - Select **Let them choose** to show the **Continue with authentik** button on the Zendesk sign-in page. - Select **Redirect to SSO** to require users to use SSO. If **Primary SSO** is shown, select `authentik`. 5. Click **Save**. ## authentik configuration SAML authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. To support the integration of Zendesk with authentik over SAML, create an application/provider pair in authentik and then create a SAML SSO configuration in Zendesk. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://company.zendesk.com/access/saml`. - Set the **Audience** to `company.zendesk.com`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Copy the certificate fingerprint 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **System** > **Certificates** and expand the certificate that you selected for the Zendesk SAML provider. 3. Copy the **Certificate Fingerprint (SHA256)** value. ## Zendesk configuration SAML ### Create a SAML SSO configuration 1. Log in to Zendesk as an administrator. 2. In the Admin Center, click **Account** in the sidebar, then navigate to **Security** > **Single sign-on**. 3. Click **Create SSO configuration**, then select **SAML**. 4. Configure the SAML SSO configuration: - **Configuration name**: `authentik` - **SAML SSO URL**: `https://authentik.company/application/saml//` - **Certificate fingerprint**: paste the **Certificate Fingerprint (SHA256)** value from authentik. - Enable **Show button when users sign in**. - **Button name**: `authentik` 5. Click **Save**. ### Assign the SSO configuration Zendesk SSO configurations are inactive until they are assigned to team members, end users, or both. 1. Open the security settings for the users who should authenticate with authentik: - For team members, click **Account** in the sidebar, then navigate to **Security** > **Team member authentication**. - For end users, click **Account** in the sidebar, then navigate to **Security** > **End user authentication**. 2. Select **External authentication** to show the SSO configuration options. 3. Select the `authentik` SSO configuration. 4. Select how users sign in: - Select **Let them choose** to show the **Continue with authentik** button on the Zendesk sign-in page. - Select **Redirect to SSO** to require users to use SSO. If **Primary SSO** is shown, select `authentik`. 5. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with Zendesk, log out and open Zendesk. If you configured Zendesk to let users choose how they sign in, click **Continue with authentik**. You should be redirected to authentik to log in, and then redirected back to Zendesk. ## Resources - [Zendesk Help - Setting up single sign-on with OpenID Connect (OIDC)](https://support.zendesk.com/hc/en-us/articles/7957465432474-Setting-up-single-sign-on-with-OpenID-Connect-OIDC) - [Zendesk Help - Enabling SAML single sign-on](https://support.zendesk.com/hc/en-us/articles/4408887505690-Enabling-SAML-single-sign-on) - [Zendesk Help - Managing single sign-on (SSO) configurations](https://support.zendesk.com/hc/en-us/articles/4408882188570-Managing-single-sign-on-SSO-configurations) - [Zendesk Help - Giving users different ways to sign into Zendesk](https://support.zendesk.com/hc/en-us/articles/5380943678106-Giving-users-different-ways-to-sign-into-Zendesk) --- ## Integrate with zot ## What is zot? > zot is an OCI-native container registry for distributing container images and OCI artifacts. > > \-- [https://zotregistry.dev](https://zotregistry.dev) ## Preparation The following placeholders are used in this guide: - `zot.company` is the FQDN of the zot installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of zot with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **Protocol Settings**: - **Redirect URI**: - `Strict` `Authorization`: `https://zot.company/zot/auth/callback/oidc`. - **Signing Key**: select any available signing key. - Note the **Client ID** and **Client Secret** values because they are required later. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## zot configuration To support the integration of zot with authentik, configure zot to use authentik as its OpenID Connect provider. 1. Create the OIDC credentials file with the **Client ID** and **Client Secret** values from the authentik provider created earlier: ```json title="/etc/zot/oidc-credentials.json" { "clientid": "", "clientsecret": "" } ``` 2. Edit the zot configuration file to enable OpenID Connect authentication. Set `externalUrl` to the public URL that users use to access zot. ```json title="/etc/zot/config.json" { "http": { "externalUrl": "https://zot.company", "port": "8080", "auth": { "openid": { "providers": { "oidc": { "credentialsFile": "/etc/zot/oidc-credentials.json", "issuer": "https://authentik.company/application/o//", "keypath": "", "scopes": ["openid", "profile", "email"] } } } } } } ``` OpenID Connect social login is for the zot web interface. To push or pull images with command-line clients, log in to zot through authentik and generate an API key in zot. 3. Restart zot to apply the configuration changes: ```bash systemctl restart zot ``` ## Configuration verification To confirm that authentik is properly configured with zot, log out of zot and open the zot integration from authentik. On the zot login page, click **SIGN IN WITH OIDC**. After you authenticate with authentik, zot signs you in. ## Resources - [zot Documentation - User Authentication and Authorization](https://zotregistry.dev/v2.1.18/articles/authn-authz/#social-login-using-openidoauth2) --- ## Integrate with Absorb LMS ## What is Absorb LMS? > Absorb LMS is a cloud-based learning management system used by organizations to deliver, track, and manage employee, partner, and customer training. It lets you create or import courses, assign them to different audiences, and report on learner progress and compliance from a centralized portal. > > \-- [https://www.absorblms.com/](https://www.absorblms.com/) ## Preparation The following placeholders are used in this guide: - `company.myabsorb.com` is the FQDN of the Absorb LMS deployment. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Absorb LMS can use either OIDC or SAML for SSO. Choose one protocol for authentication. You can also configure SCIM provisioning after you create the authentik application. To configure SSO in Absorb LMS, you need an Absorb LMS system administrator account. Absorb LMS account provisioning and SCIM availability depend on your Absorb LMS plan and enabled features. ## authentik configuration To support the integration of Absorb LMS with authentik, create one application/provider pair in authentik using either OIDC or SAML. In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it is used later as ``. - **Choose a Provider type**: select **OAuth2/OIDC Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values. - Add a **Redirect URI** with the type `Strict` and `Authorization`, using the value `https://company.myabsorb.com/api/rest/v2/authentication/openIdConnect`. - Select an available **Signing Key**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. If you add a SCIM provider as a backchannel provider later, only users who can view this application are synchronized. 3. Click **Create Application** to save the new application and provider. ### Configure Absorb LMS SSO 1. Log in to the Absorb LMS Admin Experience as a system administrator. 2. Click the account icon in the top right, navigate to **Client Settings**, and open the **SSO configuration** card. 3. Click **Add SSO Configuration** and set the following values: - **Name**: `authentik` - **Method**: `OpenID Connect` 4. Continue to the configuration step and set the following values: - **OpenID Connect authentication protocol method**: `Client Secret Basic` - **JWT signature type used for the authentication**: `RS256` - **Use Dynamic Keys**: enabled - **Discovery URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Client Identifier from the Authorization Server**: the **Client ID** from authentik. - **Client Secret from the Authorization Server**: the **Client Secret** from authentik. - **Issuer URL**: `https://authentik.company/application/o//` - **Authorization Endpoint URL**: `https://authentik.company/application/o/authorize/` - **Token Endpoint URL**: `https://authentik.company/application/o/token/` - **ID Property**: `Email Address` - **Logout URL** *(optional)*: `https://authentik.company/application/o//end-session/` 5. Continue to the access step and select the **Assigned Routes** that should use this SSO configuration. 6. Enable **Automatically Redirect** if users should be sent directly to authentik when they open an assigned route. 7. Click **Save**. authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it is used later as ``. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **ACS URL**: `https://company.myabsorb.com/api/rest/v2/authentication/saml` - **Audience**: `https://company.myabsorb.com` - **SLS URL**: `https://company.myabsorb.com/api/rest/v2/authentication/samlLogout` - **SLS Binding**: `Post` - **Logout Method**: `Front-channel (Iframe)` - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Username`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. If you add a SCIM provider as a backchannel provider later, only users who can view this application are synchronized. 3. Click **Create Application** to save the new application and provider. ### Configure Absorb LMS SSO 1. Log in to the Absorb LMS Admin Experience as a system administrator. 2. Click the account icon in the top right, navigate to **Client Settings**, and open the **SSO configuration** card. 3. Click **Add SSO Configuration** and set the following values: - **Name**: `authentik` - **Method**: `SAML` - **Mode**: select one of the following options: - `Identity Provider Initiated`: users log in to Absorb LMS from authentik. - `Service Provider Initiated`: users attempting to log in to Absorb LMS are directed to authentik for authentication. 4. Continue to the configuration step and set the following values: - **Key**: paste the authentik SAML signing certificate without the `BEGIN CERTIFICATE` and `END CERTIFICATE` lines. - **ID Property**: `Username` - **Signature Type**: `SHA256` - **Login URL**: `https://authentik.company/application/saml//` 5. Continue to the access step and select the **Assigned Routes** that should use this SSO configuration. 6. Enable **Automatically Redirect** if users should be sent directly to authentik when they open an assigned route. 7. Enable the **Single Logout** toggle, and then set the following values: - **External Single Logout Url**: `https://authentik.company/application/saml//` - **Wait for IdP Response** *(optional)*: enable this setting so that Absorb LMS waits for authentik to confirm the logout before ending the session. 8. Click **Save**. ## Absorb LMS configuration ### Configure SCIM provisioning *(optional)* Configure SCIM provisioning after you configure OIDC or SAML. If you add the SCIM provider as a backchannel provider, only users who can view the Absorb LMS application are synchronized. The **OAuth (Interactive)** authentication mode for SCIM providers requires an authentik Enterprise license. #### Enable SCIM in Absorb LMS 1. Log in to the Absorb LMS Admin Experience as a system administrator. 2. Click the account icon in the top right, navigate to **Client Settings**, and open the **SSO configuration** card. 3. Under **SCIM Settings**, click **Manage**. 4. Note the **SCIM OAuth Client ID** and **SCIM OAuth Client Secret** values. 5. Select a **Default Department** for provisioned users. 6. Click **Save**. #### Create an OAuth source 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Federation and Social login** and click **New Source**. 3. Select **OpenID OAuth Source** as the source type and click **Next**. 4. Set the following values: - **Source Name**: provide a descriptive name. - **Slug**: provide a slug or use the automatically generated slug. - **Consumer key**: the **SCIM OAuth Client ID** from Absorb LMS. - **Consumer secret**: the **SCIM OAuth Client Secret** from Absorb LMS. - **Scopes**: `offline_access` - Under **URL settings**: - **Authorization URL**: `https://company.myabsorb.com/scim/v2/oauth/authorize` - **Access Token URL**: `https://company.myabsorb.com/scim/v2/oauth/token` - **Authorization code authentication method**: `Include the client ID and secret as request parameters` 5. Click **Create**. #### Create a SCIM property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**. 3. Select **SCIM Provider Mapping** as the property mapping type and click **Next**. 4. Set the following values: - **Mapping Name**: `Absorb LMS SCIM user` - **Expression**: ```python given_name, family_name = request.user.name, " " formatted = request.user.name + " " if " " in request.user.name: given_name, _, family_name = request.user.name.partition(" ") formatted = request.user.name emails = [] if request.user.email: emails = [{ "value": request.user.email, "type": "work", "primary": True, }] phone_number = request.user.attributes.get("phone") phone_numbers = [] if phone_number: phone_numbers = [{ "value": phone_number, "type": "work", "primary": True, }] return { "userName": request.user.username, "name": { "formatted": formatted, "givenName": given_name, "familyName": family_name, }, "active": request.user.is_active, "emails": emails, "phoneNumbers": phone_numbers, } ``` 5. Click **Create**. #### Create a SCIM provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **New Provider** to open the provider wizard. - **Choose a Provider type**: select **SCIM Provider** as the provider type. - **Configure the Provider**: provide a name for the provider and configure the following settings. - **URL**: `https://company.myabsorb.com/scim/v2` - **Authentication Mode**: `OAuth (Interactive)` - **OAuth Source**: select the OAuth source that you created. - **Group Filter**: select the group that contains users that should be provisioned to Absorb LMS. - Under **Attribute mapping**, remove `authentik default SCIM Mapping: User` from **Selected User Property Mappings** and add `Absorb LMS SCIM user`. 3. Click **Create**. 4. Open the SCIM provider. 5. On the **Overview** tab, click **(Re-)authenticate**. 6. You should be redirected to Absorb LMS for authentication. Log in as an Absorb LMS administrator and approve the connection. 7. Return to the SCIM provider and confirm that **OAuth Status** shows `Authenticated`. #### Add the SCIM provider to the application 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click the Absorb LMS application that you created. 3. Click the plus (+) icon next to **Backchannel Providers** and select the SCIM provider that you created. 4. Click **Save Changes**. ## Configuration verification To confirm that authentik is properly configured with Absorb LMS, log out and open Absorb LMS. If you configured automatic redirect, Absorb LMS redirects you to authentik. Otherwise, start the SSO login flow from Absorb LMS, sign in with authentik, and confirm that you return to Absorb LMS. If you configured SCIM, open the Absorb LMS SCIM provider in authentik and click the run button on the **Full sync for SCIM provider** task. After the sync completes, verify that users with access to the Absorb LMS application are provisioned in Absorb LMS. ## Resources - [Absorb Help Center - OpenID Connect Single Sign-On](https://support.absorblms.com/hc/en-us/articles/360001205288-OpenId-Connect-Single-Sign-On) - [Absorb Help Center - SSO Considerations](https://support.absorblms.com/hc/en-us/articles/28722028348691-SSO-Considerations) - [Absorb Help Center - SCIM Change Log](https://support.absorblms.com/hc/en-us/articles/35426064562835-SCIM-Change-Log) --- ## Forward events to Splunk Enterprise authentik can forward selected events to Splunk Enterprise through a generic webhook notification transport and Splunk HTTP Event Collector (HEC). This forwards events that match a notification rule; it does not replace container, system, or reverse-proxy log collection. ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `splunk.company` is the FQDN of the Splunk Enterprise instance or load balancer that receives HEC traffic. - `` is a Splunk HTTP Event Collector token used to ingest authentik events. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## Splunk Enterprise configuration ### Create a Splunk HEC token 1. Log in to Splunk Enterprise with an administrator account. 2. Navigate to **Settings** > **Data inputs**. 3. Click **HTTP Event Collector**. 4. Click **New Token** and create a token for authentik events. 5. Enable the token and allow it to write to the target index. The HEC URL for JSON events is: ```text https://splunk.company/services/collector/event ``` If you publish HEC through a load balancer or reverse proxy, use the externally reachable HEC URL instead. ## authentik configuration To forward authentik events to Splunk Enterprise, you need to create webhook mappings, a notification transport, and a notification rule. ### Create webhook mappings Create a webhook body mapping that formats authentik notifications for the Splunk HEC JSON event endpoint. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **Webhook Mapping** and create the body mapping: - **Name**: choose a descriptive name, for example `Splunk HEC body`. - **Expression**: ```python event = notification.event return { "time": event.created.timestamp(), "host": "authentik.company", "sourcetype": "authentik:event", "event": { "action": event.action, "app": event.app, "body": notification.body, "severity": notification.severity, "client_ip": event.client_ip, "user": event.user, "context": event.context, }, } ``` 4. Create another **Webhook Mapping** for the HEC authorization header: - **Name**: choose a descriptive name, for example `Splunk HEC headers`. - **Expression**: ```python return { "Authorization": "Splunk ", } ``` ### Create a webhook notification transport 1. Navigate to **Events** > **Notification Transports** and click **New Notification Transport**. 2. Configure the transport: - **Transport Name**: choose a descriptive name, for example `Splunk HEC`. - **Send once**: enable this option. - **Mode**: select **Webhook (generic)**. - **Webhook URL**: set to the Splunk HEC event endpoint, for example `https://splunk.company/services/collector/event`. - **Webhook Body Mapping**: select the Splunk HEC body mapping. - **Webhook Header Mapping**: select the Splunk HEC headers mapping. 3. Click **Create Notification Transport**. ### Create a notification rule 1. Navigate to **Customization** > **Policies** and create an **Event Matcher Policy** for the events that should be sent to Splunk Enterprise. - Leave the matcher fields empty to match all authentik events. - Use the **Query** field to forward only a subset of events, such as failed logins or application authorization events. 2. Navigate to **Events** > **Notification Rules** and click **New Notification Rule**. 3. Configure the rule: - Select a destination group. The rule must have a destination group or **Send notification to event user** enabled before authentik creates notifications. - Select the Splunk HEC notification transport. 4. Click **Create Notification Rule**. 5. Expand the new rule, click **Create or bind...**, and bind the Event Matcher Policy that you created for Splunk Enterprise. ## Configuration verification To verify log forwarding, click **Test** on the Splunk HEC notification transport in authentik. Then search Splunk Enterprise for the configured sourcetype: ```text sourcetype="authentik:event" ``` If Splunk Enterprise does not receive the test event, verify the HEC token, the `Authorization` header mapping, the HEC URL, and network access from authentik to the Splunk HEC endpoint. ## Resources - [Splunk Enterprise Documentation - Format events for HTTP Event Collector](https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.2/get-data-with-http-event-collector/format-events-for-http-event-collector) - [Splunk Enterprise Documentation - HTTP Event Collector REST API endpoints](https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.0/get-data-with-http-event-collector/http-event-collector-rest-api-endpoints) --- ## Integrate with Audiobookshelf ## What is Audiobookshelf? > Audiobookshelf is a self-hosted audiobook and podcast server. > > \-- [https://audiobookshelf.org/](https://audiobookshelf.org/) ## Preparation The following placeholders are used in this guide: - `audiobookshelf.company` is the FQDN of the Audiobookshelf installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Audiobookshelf with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add three **Redirect URIs**: - `Strict` `Authorization` `https://audiobookshelf.company/auth/openid/callback` - `Strict` `Authorization` `https://audiobookshelf.company/auth/openid/mobile-redirect` - `Strict` `Post Logout` `https://audiobookshelf.company/login` - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Audiobookshelf configuration 1. Log in to Audiobookshelf as an administrator. 2. Navigate to **Settings** > **Authentication** and enable **OpenID Connect Authentication**. 3. Configure the following settings: - **Issuer URL**: `https://authentik.company/application/o//` - Click **Auto-populate**. Audiobookshelf fills the required **Authorize URL**, **Token URL**, **Userinfo URL**, **JWKS URL**, and **Signing Algorithm** fields from authentik's OIDC discovery document. It also fills the optional **Logout URL** field. - **Client ID**: enter the **Client ID** from authentik. - **Client Secret**: enter the **Client Secret** from authentik. 4. Click **Save** and restart Audiobookshelf. ### User matching and registration *(optional)* If your Audiobookshelf usernames match the `preferred_username` value from authentik, set **Match existing users by** to `username`. This links the existing Audiobookshelf user to the authentik user after the first successful OIDC login. Enable **Auto Register** to create Audiobookshelf users automatically when an OIDC login does not match an existing user. ### Single sign-on behavior *(optional)* Enable **Auto Launch** to automatically redirect users from the Audiobookshelf login page to authentik. To bypass SSO for troubleshooting, open `https://audiobookshelf.company/login?autoLaunch=0`. Verify that OIDC login works before disabling **Password Authentication**. If OIDC is misconfigured and local login is disabled, you must restore local authentication directly in the Audiobookshelf database. ### Role and permission claims *(optional)* Leave **Group Claim** and **Advanced Permission Claim** empty unless you have configured compatible custom claims in authentik. If you set **Group Claim**, Audiobookshelf expects the claim to contain a list with one of `admin`, `user`, or `guest`. If no group matches, Audiobookshelf denies access. If you set **Advanced Permission Claim**, Audiobookshelf expects the claim to contain Audiobookshelf permissions for non-admin users. ### Mobile and subfolder redirects *(optional)* If Audiobookshelf is served from a subfolder, select the matching **Subfolder for Redirect URLs** value in Audiobookshelf. Add the displayed callback and mobile redirect URLs to the authentik provider as `Strict` `Authorization` redirect URIs. For third-party mobile apps that use a custom redirect URI, add that URI to **Allowed Mobile Redirect URIs** in Audiobookshelf. You do not need to add third-party mobile app redirect URIs to the authentik provider. ## Configuration verification To confirm that authentik is properly configured with Audiobookshelf, log out of Audiobookshelf. Then, open Audiobookshelf and log in using OpenID Connect. You should be redirected to authentik for authentication and then redirected back to Audiobookshelf. ## Resources - [Audiobookshelf OpenID Connect authentication documentation](https://www.audiobookshelf.org/docs/documentation/server-management/oidc-authentication/) --- ## Integrate with Calibre-Web ## What is Calibre-Web? > Calibre-Web is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. > > \-- [https://github.com/janeczku/calibre-web](https://github.com/janeczku/calibre-web) ## Preparation The following placeholders are used in this guide: - `calibreweb.company` is the FQDN of the Calibre-Web installation. - `authentik.company` is the FQDN of the authentik installation. - `ldap.company` is the FQDN of the authentik LDAP outpost. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Calibre-Web must be installed with its optional LDAP dependencies. If **Use LDAP Authentication** is not available as a login type, install the Calibre-Web LDAP dependencies and restart Calibre-Web before continuing. ## authentik configuration To support the integration of Calibre-Web with authentik, you need to create an LDAP application/provider pair, an LDAP outpost, a service account with LDAP search permissions, and a group containing the users to import into Calibre-Web. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **LDAP Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the bind flow to use for this provider, and note the **Base DN** because it will be required later. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create an LDAP outpost Calibre-Web connects to authentik through an LDAP outpost. 1. Navigate to **Applications** > **Outposts** and click **New Outpost**. 2. Configure the outpost: - **Name**: provide a descriptive name. - **Type**: select **LDAP**. - **Integration**: select the integration that matches your deployment method. - **Applications**: select the Calibre-Web LDAP application. 3. Click **Create**. Expose the LDAP outpost as `ldap.company` so Calibre-Web can reach it. ### Create a service account in authentik Create a dedicated service account for Calibre-Web LDAP searches. 1. Navigate to **Directory** > **Users** and click **New User**. 2. Set **Username** to a descriptive value, such as `ldapservice`, then click **Create**. 3. Click the newly created service account. 4. Under **Recovery**, click **Set password**, provide a secure password, and click **Update password**. Copy this password because it will be required later. For the default authentik LDAP Base DN, this service account's DN is `cn=,ou=users,dc=ldap,dc=goauthentik,dc=io`. ### Grant LDAP search permissions Calibre-Web needs the service account to search the LDAP directory when importing users. 1. Navigate to **Directory** > **Roles** and click **Create**. 2. Provide a name, such as `LDAP search`, and click **Create**. 3. Click the new role and open the **Users** tab. 4. Click **Add existing user**, select the service account, and click **Assign**. 5. Navigate to **Applications** > **Providers** and click the Calibre-Web LDAP provider. 6. Open the **Permissions** tab and click **Assign Object Permissions**. 7. Select the role, enable **Search full LDAP directory**, and click **Assign**. ### Create an LDAP import group Create a group that contains the users to import into Calibre-Web. 1. Navigate to **Directory** > **Groups** and click **Create**. 2. Provide a name, such as `Calibre-Web`, and click **Create**. 3. Click the newly created group and open the **Users** tab. 4. Click **Add existing user**. 5. Select the users that should be imported into Calibre-Web and click **Add**. Note the group name because it will be required later. ## Calibre-Web configuration 1. Log in to Calibre-Web as an administrator. 2. Navigate to **Admin** > **Edit Basic Configuration**, open **Feature Configuration**, and configure the following settings: - **Login Type**: `Use LDAP Authentication` - **LDAP Server Host Name or IP Address**: `ldap.company` - **LDAP Administrator Username**: `cn=,ou=users,dc=ldap,dc=goauthentik,dc=io` - **LDAP Administrator Password**: enter the service account password from authentik. - **LDAP Distinguished Name (DN)**: `dc=ldap,dc=goauthentik,dc=io` - **LDAP User Object Filter**: `(&(objectclass=user)(cn=%s))` - **LDAP Group Object Filter**: `(&(objectclass=group)(cn=%s))` - **LDAP Group Name**: enter the authentik LDAP import group name, for example `Calibre-Web`. - **LDAP Group Members Field**: `member` 3. Click **Save**. If you changed the LDAP provider **Base DN** in authentik, replace `dc=ldap,dc=goauthentik,dc=io` in the Calibre-Web settings with your configured Base DN. After saving the LDAP settings, import users from authentik: 1. Navigate to **Admin** and click **Import LDAP Users**. 2. After the users are imported, click **Edit Users** and give each imported user the appropriate Calibre-Web permissions. ## Configuration verification To confirm that authentik is properly configured with Calibre-Web, open Calibre-Web and log in as an imported user using their authentik credentials. ## Resources - [Calibre-Web LDAP Login documentation](https://github.com/janeczku/calibre-web/wiki/LDAP-Login) --- ## Integrate with Emby ## What is Emby? > Emby is a media management and streaming platform for movies, TV shows, and music that allows you to organize and stream your personal media collection. > > \-- [https://emby.media/](https://emby.media/) ## Preparation The following placeholders are used in this guide: - `emby.company` is the FQDN of the Emby installation. - `authentik.company` is the FQDN of the authentik installation. - `ldap.company` is the FQDN of the LDAP outpost. - `dc=company,dc=com` is the Base DN of the LDAP provider. An [Emby Premiere](https://emby.media/premiere.html) subscription is required to use the official LDAP Authentication plugin. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Emby with authentik, you need to create an LDAP application/provider pair in authentik, create a service account, and expose the provider through an LDAP outpost. ### Create an LDAP application, provider, and outpost in authentik Follow the [LDAP provider setup](/docs/add-secure-apps/providers/ldap/create-ldap-provider/) to create the LDAP application, provider, service account, and outpost. Complete the [service account creation](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#create-a-service-account) and [LDAP search permission](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#assign-the-ldap-search-permission-to-the-service-account) steps for the account Emby uses to connect to LDAP. When configuring the LDAP provider, set the following required settings: - **Base DN**: `dc=company,dc=com` - **Certificate**: select the certificate that Emby should trust for LDAPS. - **TLS Server Name**: `ldap.company` If access to the authentik LDAP application is restricted, allow the LDAP service account access via the application's [policy, group, or user bindings](/docs/add-secure-apps/applications/manage_apps/#use-bindings-to-control-access). ### Create an Emby access group 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups**. 3. Click **Create**, set **Name** to `emby_users`, and click **Create**. 4. Open the new group, click the **Users** tab, and click **Add existing user** to add the users who should have access to Emby. ## Emby configuration 1. Log in to Emby as an administrator. 2. Click the **cog icon** in the upper-right corner to access the dashboard settings. 3. Navigate to the **Plugins** section and click **Catalog** at the top of the page. 4. Find and install the **LDAP Authentication** plugin. Restart Emby if prompted to complete the installation. 5. After installation, return to the plugins section and click the **LDAP Authentication** plugin to open its settings. 6. Configure the LDAP settings as follows: - **LDAP server address**: `ldap.company` - **LDAP server Port number**: `636` - **Enable SSL**: checked - **SSL certificate thumbprint (SHA1)**: paste the SHA1 fingerprint of the certificate selected on the LDAP provider. This value is shown in authentik under **System** > **Certificates**. - **Bind DN**: `cn=ldap_service_account,ou=users,dc=company,dc=com` - **Bind credentials**: enter the password for the LDAP service account. - **User search base**: `dc=company,dc=com` - **User Search Filter**: `(&(sAMAccountName={0})(memberOf=cn=emby_users,ou=groups,dc=company,dc=com))` - To allow all users that the LDAP provider exposes, use `(&(objectClass=user)(sAMAccountName={0}))`. 7. Click **Save** to apply your configuration. Emby administrators sign in with Emby authentication instead of LDAP. Keep a local Emby administrator account available so you can access the server if LDAP is unavailable. ## Configuration verification To confirm that authentik is properly configured with Emby, open Emby, log out, and log back in using an authentik username and password. Logging in with an email address isn't supported, so use the username value from authentik. If login fails, verify the LDAP search filter and check the Emby server logs for LDAP authentication errors. ## Resources - [Emby Blog - Introducing LDAP support for Emby](https://emby.media/introducing-ldap-support-for-emby.html) - [Emby Community - LDAP Configuration](https://emby.media/community/topic/75295-ldap-configuration/) --- ## Integrate with FreshRSS ## What is FreshRSS? > FreshRSS is a self-hosted RSS feed aggregator. > > \-- [https://freshrss.org/](https://freshrss.org/) ## Preparation The following placeholders are used in this guide: - `freshrss.company` is the FQDN of the FreshRSS installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of FreshRSS with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://freshrss.company/i/oidc/` and `https://freshrss.company:443/i/oidc/`. If FreshRSS is exposed on a port other than `443`, update the second redirect URI accordingly. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## FreshRSS configuration FreshRSS OIDC support is available in the Debian-based FreshRSS Docker image on `x86_64`, or when FreshRSS runs behind an Apache server with `mod_auth_openidc`. The Alpine image does not include OIDC support. Before restarting FreshRSS with OIDC enabled, make sure at least one FreshRSS admin username matches the `preferred_username` value of an authentik user. To enable OIDC login with FreshRSS, update your `.env` file to include the following variables: ```env title=".env" OIDC_ENABLED=1 OIDC_PROVIDER_METADATA_URL=https://authentik.company/application/o//.well-known/openid-configuration OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= OIDC_CLIENT_CRYPTO_KEY= OIDC_X_FORWARDED_HEADERS=X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host OIDC_SCOPES=openid email profile ``` Restart FreshRSS after changing these settings. Log in as a user that exists in both FreshRSS and authentik, then go to **Settings** > **Authentication** and set **Authentication method** to **HTTP (for advanced users with HTTPS)**. If you are configuring a new FreshRSS installation, enable OIDC before completing the setup wizard. When the setup wizard asks for the default user, use the exact username from authentik. In the authentication setup step, select **HTTP Authentication Method**. ## Configuration verification To confirm that authentik is properly configured with FreshRSS, log out of FreshRSS and open the integration. FreshRSS should redirect you to authentik and then return you to FreshRSS as the matching user. ## Resources - [FreshRSS documentation for OpenID Connect](https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect.html) - [FreshRSS documentation for OIDC with authentik](https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect-Authentik.html) --- ## Integrate with Immich ## What is Immich? > Immich is a self-hosted photo and video management solution. > > \-- [https://immich.app/](https://immich.app/) ## Preparation The following placeholders are used in this guide: - `immich.company` is the FQDN of the Immich installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Immich with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add three **Redirect URIs**: - `Strict` `Authorization` `app.immich:///oauth-callback` - `Strict` `Authorization` `https://immich.company/auth/login` - `Strict` `Authorization` `https://immich.company/user-settings` - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. - **Configure Launch URL** *(optional)*: set the [Launch URL](/docs/add-secure-apps/applications/#appearance) to `https://immich.company/auth/login?autoLaunch=1` to allow automatic login to Immich when clicking the application from within authentik. 3. Click **Submit** to save the new application and provider. ## Immich configuration 1. Log in to Immich as an administrator. 2. Navigate to **Administration** > **Settings** > **OAuth Authentication**. 3. Enable OAuth and configure the following settings: - **issuer\_url**: `https://authentik.company/application/o//` - **client\_id**: enter the Client ID from authentik. - **client\_secret**: enter the Client Secret from authentik. 4. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with Immich, open Immich and log in using OAuth. You should be redirected to authentik for authentication and then redirected back to Immich. ## Resources - [Immich OAuth Authentication documentation](https://docs.immich.app/administration/oauth) --- ## Integrate with Ironclad ## What is Ironclad? > Ironclad is a contract lifecycle management (CLM) platform that gives business and legal teams an easy-to-use platform with AI-powered tools to handle every aspect of the contract lifecycle. > > \-- [https://ironcladapp.com/](https://ironcladapp.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Ironclad with authentik, you need to create three property mappings and an application/provider pair in authentik. ### Create property mappings Ironclad requires SAML attributes named `email`, `firstName`, and `lastName`. Because authentik stores a user's full name as a single string, create SAML provider property mappings that send the user's email address and split the full name into first and last names. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings**, click **Create**, select **SAML Provider Property Mappings**, and then click **Next**. 3. Configure the first mapping for the user's first name: - **Name**: `Ironclad firstName` - **SAML Attribute Name**: `firstName` - **Expression**: ```python return request.user.name.split(" ", 1)[0] if request.user.name else request.user.username ``` 4. Click **Finish** to save. Then, repeat the process to create a mapping for the user's last name: - **Name**: `Ironclad lastName` - **SAML Attribute Name**: `lastName` - **Expression**: ```python return request.user.name.rsplit(" ", 1)[-1] if " " in request.user.name else " " ``` 5. Click **Finish** to save. Finally, repeat the process to create a mapping for the user's email address: - **Name**: `Ironclad email` - **SAML Attribute Name**: `email` - **Expression**: ```python return request.user.email ``` 6. Click **Finish**. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** to `https://temp.temp`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Toggle off **Sign assertions**. - Toggle on **Sign responses**. - **Property mappings**: - Click the **x** button to remove all selected property mappings. - Under **Selected User Property Mappings**, add the `Ironclad firstName`, `Ironclad lastName`, and `Ironclad email` property mappings that were created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Ironclad configuration 1. Log in to the [Ironclad dashboard](https://ironcladapp.com/signin) as an administrator. 2. Click your profile icon at the top-right corner, then select **Company Settings**. 3. In the sidebar, select **Integrations**, and under **Other Integrations**, click **SAML**. 4. Click **Add SAML Configuration**, then select **Show Additional IdP Settings**. 5. Note the **Callback** URL and **Service Provider Identifier** values because you need them in the next section. 6. Leave this page open, because you return to it after updating the authentik provider. ### Update the authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon of the newly created Ironclad provider. 3. Under **Protocol settings**, set the following values: - **ACS URL**: the **Callback** URL provided by Ironclad (for example, `https://ironcladapp.com/saml//callback`). - **Audience**: the **Service Provider Identifier** provided by Ironclad (for example, `na1.ironcladapp.com`). 4. Click **Update**. ### Download the metadata file 1. Navigate to **Applications** > **Providers** and click the name of the newly created Ironclad provider. 2. Under **Metadata**, click **Download**. This metadata file is required to finish the Ironclad SAML configuration. ### Complete the Ironclad SAML configuration 1. Return to the Ironclad SAML configuration page and under **IdP Configuration XML**, click **Choose file**. Select the metadata file that you downloaded from authentik. 2. Set **Entry Point** to `https://authentik.company/application/saml//` if Ironclad does not automatically populate it from the metadata file. 3. Click **Save**. SSO login must be specifically enabled on Ironclad user accounts. SSO login on the original Ironclad administrator account can only be enabled by Ironclad support. To request this, contact them at `support@ironcladapp.com`. For new user accounts, SSO login can be selected when creating the account. ## Configuration verification To confirm that authentik is properly configured with Ironclad, log out and log back in via the [Ironclad Sign In page](https://ironcladapp.com/signin). Enter the email address of an Ironclad SSO-enabled account, click **Continue**, and then **Sign in**. You should be redirected to authentik to log in, and if successful, you should then be redirected to the Ironclad dashboard. ## Resources - [Ironclad Support - Set Up Generic SSO/SAML Integration](https://support.ironcladapp.com/hc/en-us/articles/12286012625559-Set-Up-Generic-SSO-SAML-Integration) - [Ironclad Support - Enable or Disable Just-In-Time (JIT) Provisioning](https://support.ironcladapp.com/hc/en-us/articles/40161623671063-Enable-or-Disable-Just-In-Time-JIT-Provisioning) - [Ironclad Support - Troubleshoot SSO/SAML Integrations](https://support.ironcladapp.com/hc/en-us/articles/12286057171479-Troubleshoot-SSO-SAML-Integrations) --- ## Integrate with Jellyfin ## What is Jellyfin? > Jellyfin is a free and open source media management and streaming platform for movies, TV shows, and music. > > \-- [https://jellyfin.org](https://jellyfin.org) Jellyfin does not include native external authentication support. This guide uses the Jellyfin LDAP Authentication plugin with an authentik LDAP provider and outpost. ## Preparation The following placeholders are used in this guide: - `jellyfin.company` is the FQDN of the Jellyfin installation. - `authentik.company` is the FQDN of the authentik installation. - `ldap.company` is the FQDN of the LDAP outpost. - `dc=company,dc=com` is the Base DN of the LDAP provider. - `ldap_service_account` is the username of the LDAP service account. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Jellyfin with authentik, you need to create an LDAP application/provider pair, deploy an LDAP outpost, and create a service account for Jellyfin. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **LDAP Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and set the following required configuration. - **Base DN**: `dc=company,dc=com` - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure the LDAP outpost Jellyfin requires an LDAP outpost to authenticate users against authentik. Follow the [LDAP provider setup](/docs/add-secure-apps/providers/ldap/create-ldap-provider/) to create or update the LDAP outpost for your environment. After the outpost is created, add the Jellyfin LDAP application to it: 1. From the authentik Admin interface, navigate to **Applications** > **Outposts** and click the **Edit** icon next to your LDAP outpost. 2. From the **Available Applications** list, select the Jellyfin LDAP application and move it to the selected applications list. 3. Click **Update**. ### Create the LDAP service account Create a dedicated service account for Jellyfin by following the [service account creation](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#create-a-service-account) and [LDAP search permission](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#assign-the-ldap-search-permission-to-the-service-account) steps in the LDAP provider documentation. Use the service account's DN and token in the Jellyfin LDAP plugin configuration. With the placeholders from this guide, the service account DN is: ```text cn=ldap_service_account,ou=users,dc=company,dc=com ``` If access to the authentik LDAP application is restricted, allow the LDAP service account access via the application's [policy, group, or user bindings](/docs/add-secure-apps/applications/manage_apps/#use-bindings-to-control-access). ### Create an access group Create groups that grant user and administrator access to Jellyfin. 1. Navigate to **Directory** > **Groups** and click **Create**. 2. Set **Name** to a group name such as `jellyfin_users`. 3. Click **Create**. 4. Open the group, select the **Users** tab, and add the users who should have access to Jellyfin. 5. Repeat these steps with a group name such as `jellyfin_admins` if you want to grant Jellyfin administrator access via LDAP group membership. ## Jellyfin configuration 1. Log in to Jellyfin as an administrator. 2. Open the **Administrator Dashboard** by clicking your profile icon in the top-right corner and selecting **Dashboard**. 3. Navigate to **Plugins** > **Catalog** and install the **LDAP Authentication** plugin. 4. Restart Jellyfin if prompted. 5. Return to **Plugins**, click the three dots on the **LDAP-Auth Plugin** card, and click **Settings**. 6. Under **LDAP Server Settings**, configure the following settings: - **LDAP Server**: `ldap.company` - **LDAP Port**: `636` - **Secure LDAP**: enabled - **LDAP Bind User**: `cn=ldap_service_account,ou=users,dc=company,dc=com` - **LDAP Bind User Password**: enter the token for the LDAP service account. - **LDAP Base DN for searches**: `dc=company,dc=com` 7. If the LDAP outpost uses a certificate that Jellyfin does not trust, either configure **LDAP Root CA Path** with the certificate authority bundle or enable **Skip SSL/TLS Verification**. 8. Click **Save and Test LDAP Server Settings**. If the settings are correct, Jellyfin shows successful connect, bind, and base search results. 9. Under **LDAP User Settings**, configure the following settings: - **LDAP Search Filter**: `(memberOf=cn=jellyfin_users,ou=groups,dc=company,dc=com)` - **LDAP Search Attributes**: `uid, cn, mail, displayName` - **LDAP Uid Attribute**: `uid` - **LDAP Username Attribute**: `cn` 10. *(Optional)* Set **LDAP Admin Filter** to `(memberOf=cn=jellyfin_admins,ou=groups,dc=company,dc=com)` to grant Jellyfin administrator access based on LDAP group membership. Otherwise, leave this unset and assign Jellyfin administrator access manually. 11. Click **Save and Test LDAP Filter Settings**. If the settings are correct, Jellyfin shows the number of matching users and administrators. 12. Enter a username in **Test Login Name**, then click **Save Search Attribute Settings and Query User** to confirm that Jellyfin can find the user. 13. Under **Jellyfin User Settings**, configure the following settings: - **Enable User Creation**: enabled - **Library Access**: select the libraries that new LDAP users can access. 14. Click **Save**. 15. Restart Jellyfin. ## Configuration verification To confirm that authentik is properly configured with Jellyfin, log out of Jellyfin and log back in with an LDAP user from authentik. Use the user's username; logging in with an email address is not supported by this configuration. If the login does not succeed, open **Administration** > **Dashboard** > **Logs** in Jellyfin and review the LDAP plugin log entries near the bottom of the newest log file. ## Resources - [Jellyfin LDAP Authentication plugin](https://github.com/jellyfin/jellyfin-plugin-ldapauth) - [Jellyfin plugin installation](https://jellyfin.org/docs/general/server/plugins/#installing) --- ## Integrate with Kavita ## What is Kavita? > Kavita is a self-hosted digital library and reading server for manga, comics, books, and other digital media, with support for organizing collections and reading in the browser. > > \-- [https://www.kavitareader.com/](https://www.kavitareader.com/) ## Preparation The following placeholders are used in this guide: - `kavita.company` is the FQDN of the Kavita installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Kavita with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://kavita.company/signin-oidc` - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://kavita.company/signout-callback-oidc` - **Logout URI**: `https://kavita.company/signout-oidc` - **Logout Method**: `Front-channel` - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Kavita configuration 1. Log in to Kavita as an administrator. 2. Navigate to **Settings** > **OpenID Connect**. 3. Configure the following settings: - **Authority**: `https://authentik.company/application/o//` - **Client Id**: enter the Client ID from authentik. - **Secret**: enter the Client Secret from authentik. - **Provision Accounts**: enable this setting to automatically create Kavita accounts for users who log in through authentik. - **Require Verified Emails**: disable this setting. 4. Click **Save**. Restart your Kavita instance for these changes to take effect. ## Configuration verification To confirm that authentik is properly configured with Kavita, log out of Kavita and then log back in using the **Login with SSO** option. You should be redirected to authentik for authentication and then redirected back to Kavita as a logged-in user. ## Resources - [Kavita OpenID Connect documentation](https://wiki.kavitareader.com/guides/admin-settings/open-id-connect/) --- ## Integrate with Komga ## What is Komga? > Komga is an open-source comic and manga server that lets users organize, read, and stream their digital comic collections with ease. > > \-- [https://komga.org/](https://komga.org/) ## Preparation The following placeholders are used in this guide: - `komga.company` is the FQDN of the Komga installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Komga with authentik, you need to create an application/provider pair in authentik. ### Create an email verification scope mapping Komga requires the email scope to return a value of `email_verified: True`. As of [authentik 2025.10](/docs/releases/2025/v2025.10.md#default-oauth-scope-mappings) the default behavior is to return `email_verified: False`, so a custom scope mapping is required for Komga to allow authentication. Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification) for instructions on how to create the required custom scope mapping. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://komga.company/login/oauth2/code/authentik`. - Select any available signing key. - **Advanced protocol settings** > **Scopes**: - Add the custom email scope mapping to the **Selected Scopes**. - Remove the `authentik default OAuth Mapping: OpenID 'email'` scope. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Komga configuration To configure Komga, update its `application.yml` file to include the following options. Existing Komga users must have email addresses that match their authentik users. You can configure Komga to use either the `sub` or `preferred_username` as the UID field under `user-name-attribute`. When using `preferred_username` as the user identifier, ensure that the [**Allow users to change username** setting](/docs/sys-mgmt/settings#allow-users-to-change-username) is disabled to prevent authentication issues. The `sub` option uses a unique, stable identifier for the user, while `preferred_username` uses the username configured in authentik. ```yaml title="application.yml" spring: security: oauth2: client: registration: authentik: provider: authentik client-id: client-secret: client-name: authentik scope: openid,email,profile authorization-grant-type: authorization_code redirect-uri: "{baseUrl}/{action}/oauth2/code/{registrationId}" provider: authentik: user-name-attribute: preferred_username issuer-uri: https://authentik.company/application/o// ``` To have Komga create users during first login, also include the following option: ```yaml title="application.yml" komga: oauth2-account-creation: true ``` Restart Komga to apply the configuration. ## Configuration verification To confirm that authentik is properly configured with Komga, open Komga and log in using authentik. You should be redirected to authentik for authentication and then redirected back to Komga as a logged-in user. ## Resources - [Komga Social login documentation](https://komga.org/docs/installation/oauth2/) - [Komga Configuration options documentation](https://komga.org/docs/installation/configuration/) --- ## Integrate with Maintainerr ## What is Maintainerr? > Maintainerr is a free, self-hosted tool that finds and removes unwatched or unwanted movies and shows from Plex, Jellyfin, and Emby using powerful, customizable rules. > > \-- [https://maintainerr.info/](https://maintainerr.info/) ## Preparation The following placeholders are used in this guide: - `maintainerr.company` is the FQDN of the Maintainerr installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Maintainerr with authentik, you need to create an application/provider pair in authentik and assign it to a proxy outpost. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **Proxy Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **External host** to `https://maintainerr.company`. - Set **Internal host** to `http://:6246`, where `:6246` is the hostname and port of your Maintainerr instance as reached by the authentik proxy outpost. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure proxy outpost The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. Add the Maintainerr application to a proxy outpost that will serve it: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Outposts**. 3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. 4. Under **Available Applications**, select the Maintainerr application and move it to **Selected Applications**. 5. Click **Update** to save your changes. ## Maintainerr configuration Maintainerr has no authentication settings, so no SSO configuration is required in Maintainerr. The authentik proxy outpost authenticates the user before forwarding allowed requests to Maintainerr. ## Configuration verification To confirm that authentik is properly configured with Maintainerr, open Maintainerr. You should be redirected to authentik before the Maintainerr web interface is shown. ## Resources - [Maintainerr documentation - Security & Authentication](https://docs.maintainerr.info/security) - [Maintainerr documentation - Reverse Proxy](https://docs.maintainerr.info/reverseproxy) --- ## Integrate with Miniflux ## What is Miniflux? > Miniflux is a minimalist and opinionated feed reader. > > \-- [https://miniflux.app/](https://miniflux.app/) ## Preparation The following placeholders are used in this guide: - `miniflux.company` is the FQDN of the Miniflux installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Miniflux with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name (e.g., `Miniflux`), an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://miniflux.company/oauth2/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Miniflux configuration Add the following environment variables to your Miniflux configuration. Replace the placeholders with values from your authentik instance. ```env title=".env" OAUTH2_PROVIDER=oidc OAUTH2_CLIENT_ID= OAUTH2_CLIENT_SECRET= OAUTH2_REDIRECT_URL=https://miniflux.company/oauth2/oidc/callback OAUTH2_OIDC_DISCOVERY_ENDPOINT=https://authentik.company/application/o// OAUTH2_USER_CREATION=1 ``` Replace `` with the authentik application slug created earlier. Restart the Miniflux service for the changes to take effect. Existing Miniflux accounts must first be linked to a matching authentik account. To do this, log in using your existing Miniflux credentials, go to **Settings** and click on **Link my OpenID Connect account**. ## Configuration verification To confirm that authentik is properly configured with Miniflux, log out of Miniflux, then use the "Sign in with OpenID Connect" button on the login page and verify that Single Sign-On succeeds. ## Resources - [Miniflux OAuth2 and OpenID Connect authentication](https://miniflux.app/docs/howto.html#oauth2-and-openid-connect-authentication) - [Miniflux configuration parameters](https://miniflux.app/docs/configuration.html) --- ## Integrate with PhotoPrism ## What is PhotoPrism? > PhotoPrism is an AI-powered photos app that lets you browse, organize, and find photos and videos on a home server, private server, or in the cloud. > > \-- [https://www.photoprism.app/](https://www.photoprism.app/) ## Preparation The following placeholders are used in this guide: - `photoprism.company` is the FQDN of the PhotoPrism installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. PhotoPrism requires HTTPS for OpenID Connect (OIDC). Make sure that the `PHOTOPRISM_SITE_URL` value, the PhotoPrism redirect URI in authentik, and the public URL users use to access PhotoPrism all use the same HTTPS hostname. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of PhotoPrism with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, a slug, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value as it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://photoprism.company/api/v1/oidc/redirect`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## PhotoPrism configuration Configure PhotoPrism with the OIDC settings from authentik. Add the following settings to your PhotoPrism environment file: ```env title=".env" PHOTOPRISM_SITE_URL=https://photoprism.company/ PHOTOPRISM_OIDC_URI=https://authentik.company/application/o// PHOTOPRISM_OIDC_CLIENT= PHOTOPRISM_OIDC_SECRET= PHOTOPRISM_OIDC_SCOPES=openid email profile PHOTOPRISM_OIDC_PROVIDER=authentik ``` To allow PhotoPrism to create accounts for new OIDC users, also add the following setting: ```env title=".env" PHOTOPRISM_OIDC_REGISTER=true ``` Restart PhotoPrism after changing these settings. ## Configuration verification To confirm that authentik is properly configured with PhotoPrism, log out of PhotoPrism and log back in using the **authentik** OIDC login option. You should be redirected to authentik for authentication and then redirected back to PhotoPrism. ## Resources - [PhotoPrism OpenID Connect documentation](https://docs.photoprism.app/getting-started/advanced/openid-connect/) - [PhotoPrism Config Options documentation](https://docs.photoprism.app/getting-started/config-options/) --- ## Integrate with Seafile ## What is Seafile? > Seafile is an open-source, cross-platform file-hosting software system. Files are stored on a central server and can be synchronized with personal computers and mobile devices through apps. Files on the Seafile server can also be accessed directly via the server's web interface. > > \-- [https://seafile.com/](https://seafile.com/) ## Preparation The following placeholders are used in this guide: - `seafile.company` is the FQDN of the Seafile installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Seafile with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://seafile.company/oauth/callback/`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Seafile configuration To support the integration of Seafile with authentik, update the `seahub_settings.py` file of your Seafile deployment. The location of this file can vary depending on your installation method. ```py showLineNumbers title="seahub_settings.py" CSRF_TRUSTED_ORIGINS = ["https://seafile.company"] ENABLE_OAUTH = True OAUTH_CLIENT_ID = "" OAUTH_CLIENT_SECRET = "" OAUTH_REDIRECT_URL = "https://seafile.company/oauth/callback/" OAUTH_PROVIDER = "authentik" OAUTH_PROVIDER_DOMAIN = "authentik" OAUTH_AUTHORIZATION_URL = "https://authentik.company/application/o/authorize/" OAUTH_TOKEN_URL = "https://authentik.company/application/o/token/" OAUTH_USER_INFO_URL = "https://authentik.company/application/o/userinfo/" OAUTH_SCOPE = ["openid", "profile", "email"] OAUTH_ATTRIBUTE_MAP = { "sub": (True, "uid"), "name": (False, "name"), "email": (False, "contact_email"), } ``` Restart Seahub after updating `seahub_settings.py`. ### Single sign-on behavior *(optional)* To automatically redirect users to the Seafile OAuth login flow, add the following setting: ```py showLineNumbers title="seahub_settings.py" LOGIN_URL = "https://seafile.company/oauth/login/" ``` If users sign in from Seafile desktop clients, enable single sign-on in the system browser: ```py showLineNumbers title="seahub_settings.py" CLIENT_SSO_VIA_LOCAL_BROWSER = True ``` ## Configuration verification To confirm that authentik is properly configured with Seafile, log out of Seafile. Then, open Seafile and click **Single Sign-On**. You should be redirected to authentik to log in, and if the process is successful, you'll be taken to the Seafile dashboard. ## Resources - [Seafile OAuth authentication documentation](https://manual.seafile.com/13.0/config/oauth/) - [Seafile `seahub_settings.py` documentation](https://manual.seafile.com/13.0/config/seahub_settings_py/) --- ## Integrate with Seerr ## What is Seerr? > Seerr is a free, open-source request management and media discovery tool for Jellyfin, Plex, and Emby. > > \-- [https://seerr.dev/](https://seerr.dev/) ## Preparation The following placeholders are used in this guide: - `seerr.company` is the FQDN of the Seerr installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Seerr with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value as it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add two **Redirect URIs**: - `Strict` `Authorization` `https://seerr.company/login` - `Strict` `Authorization` `https://seerr.company/profile/settings/linked-accounts` - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Seerr configuration Seerr OpenID Connect support is currently experimental. Use the `preview-new-oidc` Docker tag and back up your Seerr configuration before changing it. 1. Stop Seerr. 2. Open your Seerr `settings.json` file. For Docker installations, this file is usually in the mounted `/app/config` directory. 3. Enable OpenID Connect sign-in and add authentik to the `oidc.providers` list. If you already have providers configured, add this object to the existing list. ```json title="settings.json (excerpt)" { "main": { "oidcLogin": true }, "oidc": { "providers": [ { "slug": "authentik", "name": "authentik", "issuerUrl": "https://authentik.company/application/o//", "clientId": "", "clientSecret": "", "logo": "https://authentik.company/static/dist/assets/icons/icon.svg", "newUserLogin": true } ] } } ``` 4. Save the file and start Seerr. Existing Seerr users can link their authentik account from **Profile** > **Settings** > **Linked Accounts** by clicking **Link Account** and selecting **authentik**. ## Configuration verification To confirm that authentik is properly configured with Seerr, open Seerr and log in using the authentik button. You should be redirected to authentik and then redirected back to Seerr. ## Resources - [Seerr OpenID Connect documentation](https://github.com/seerr-team/seerr/blob/preview-new-oidc/docs/using-seerr/settings/users/oidc.md) - [Seerr OpenID Connect support discussion](https://github.com/seerr-team/seerr/discussions/2721) --- ## Integrate with SnapOtter ## What is SnapOtter? > SnapOtter is an open-source, self-hosted file-processing platform for images, video, audio, PDFs, and documents. It provides a web interface, REST API, and pipelines for tasks such as conversion, compression, optical character recognition, transcription, and local AI processing. > > \-- [https://snapotter.com/](https://snapotter.com/) ## Preparation The following placeholders are used in this guide: - `snapotter.company` is the FQDN of the SnapOtter installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of SnapOtter with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://snapotter.company/api/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## SnapOtter configuration Add the following required variables to the environment file for your SnapOtter installation: ```env title=".env" EXTERNAL_URL=https://snapotter.company OIDC_ENABLED=true OIDC_ISSUER_URL=https://authentik.company/application/o// OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= ``` Keep the trailing slash in `OIDC_ISSUER_URL`, then restart SnapOtter to apply the configuration. ## Configuration verification To confirm that authentik is properly configured with SnapOtter, log out of SnapOtter and open the integration. Click **Sign in with SSO** and complete the authentik flow. SnapOtter creates a local user account during the first OIDC login. ## Resources - [SnapOtter documentation - OIDC / Single Sign-On](https://docs.snapotter.com/guide/oidc) --- ## Integrate with Sonarr ## What is Sonarr? > Sonarr is an internet PVR for Usenet and Torrents. > > \-- [https://sonarr.tv/](https://sonarr.tv/) Sonarr does not provide native SSO. This guide uses the authentik Proxy Provider to authenticate requests before they reach Sonarr. ## Preparation The following placeholders are used in this guide: - `sonarr.company` is the FQDN of the Sonarr installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. When Sonarr is configured for external authentication, Sonarr trusts the authentication layer in front of it. Make sure users can access Sonarr only through authentik, and do not expose the Sonarr backend directly to the internet. ## authentik configuration To support the integration of Sonarr with authentik, you need to create an application/provider pair in authentik and assign it to a proxy outpost. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **Proxy Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **Mode** to **Proxy**. - Set **External host** to `https://sonarr.company`. - Set **Internal host** to the URL that the authentik proxy outpost uses to reach Sonarr. - If Sonarr and the authentik proxy outpost are both running in the same Docker deployment, set the value to `http://:8989`. - If Sonarr runs on a different server than the authentik proxy outpost, set the value to `http://sonarr.company:8989`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure proxy outpost The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. Add the Sonarr application to a proxy outpost that will serve it: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Outposts**. 3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. 4. Under **Available Applications**, select the Sonarr application and move it to **Selected Applications**. 5. Click **Update** to save your changes. ## Sonarr configuration Configure Sonarr to trust the external authentication layer provided by authentik. 1. In Sonarr, navigate to **System** > **Status** and note the **AppData directory** value. The `config.xml` file is stored in this directory. 2. Stop Sonarr. 3. Open `config.xml` and replace any existing `AuthenticationMethod` value with `External`. Make sure that the file contains only one `AuthenticationMethod` entry. ```xml title="config.xml" External ``` 4. Start Sonarr. Configure DNS or your reverse proxy so that requests for `https://sonarr.company` are routed to the authentik proxy outpost. The authentik proxy outpost then forwards authenticated requests to Sonarr through the **Internal host** configured on the proxy provider. ```mermaid architecture-beta service client(server)[Client] service revprox(server)[Reverse Proxy] service outpost(server)[Outpost] service sonarr(server)[Sonarr] service auth(server)[authentik] client:R -- L:revprox revprox:R -- L:outpost outpost:R -- L:sonarr outpost:T -- B:auth ``` ## Configuration verification To verify the login flow, open Sonarr. You should be redirected to authentik before the Sonarr web interface is shown. ## Resources - [Servarr Wiki - Sonarr v4 FAQ: Forced Authentication](https://wiki.servarr.com/sonarr/faq-v4#forced-authentication) --- ## Integrate with Tautulli ## What is Tautulli? > Tautulli is an application that you can run alongside your Plex Media Server to monitor activity and track various statistics. These statistics include what has been watched, who watched it, when and where they watched it, and how it was watched. > > \-- [https://tautulli.com/](https://tautulli.com/) ## Preparation The following placeholders are used in this guide: - `tautulli.company` is the FQDN of the Tautulli installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Tautulli with authentik, you need to create a group, a proxy outpost, and an application/provider pair in authentik. ### Create a group for Tautulli credentials Because Tautulli uses a single set of HTTP Basic credentials, save those credentials in authentik as group attributes. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups** and click **Create**. 3. Set the following fields for the group: - **Name**: `Tautulli users` - **Attributes**: ```yaml tautulli_user: tautulli_password: ``` 4. Click **Create**. 5. Click the name of the newly created group and navigate to the **Users** tab. 6. Click **Add existing user**, select each user that needs Tautulli access, and then click **Add**. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **Proxy Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **External host**: set this to the external URL you will use to access Tautulli. - **Internal host**: - If Tautulli and the authentik proxy outpost are both running in the same Docker deployment, set the value to `http://:`. - If Tautulli and the authentik proxy outpost are both running in the same Kubernetes deployment, set the value to `http://..svc.cluster.local:`. - If Tautulli is running on a different server than the authentik proxy outpost, set the value to `http://tautulli.company` or `http://tautulli.company:`. - Under **Authentication settings**: - **Send HTTP-Basic Authentication**: enabled. - **HTTP-Basic Username Key**: `tautulli_user`. - **HTTP-Basic Password Key**: `tautulli_password`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure proxy outpost The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Outposts**. 3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. 4. Under **Available Applications**, select the Tautulli application and move it to **Selected Applications**. 5. Click **Update** to save your changes. ## Tautulli configuration Stop Tautulli, then set the following values in the `config.ini` file of your Tautulli deployment. Use the same username and password values that you configured in the authentik group attributes. ```ini title="config.ini" [General] http_basic_auth = 1 http_hash_password = 0 http_hashed_password = 1 http_username = http_password = ``` Start Tautulli after updating your `config.ini` file. ## Configuration verification To confirm that authentik is properly configured with Tautulli, open Tautulli. You should be redirected to authentik, then automatically logged in to Tautulli. ## Resources - [Tautulli - Frequently Asked Questions](https://docs.tautulli.com/support/frequently-asked-questions) - [Tautulli source - Web server authentication](https://github.com/Tautulli/Tautulli/blob/master/plexpy/webstart.py) --- ## Integrate with Actual Budget ## What is Actual Budget? > Actual Budget is a fast, privacy-focused app for managing personal finances. It helps users track and manage their income, expenses, and budgets in real time. > > \-- [https://actualbudget.org/](https://actualbudget.org/) ## Preparation The following placeholders are used in this guide: - `actual.company` is the FQDN of the Actual Budget installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Actual Budget with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://actual.company/openid/callback`. - Select any available **Signing Key**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Actual Budget configuration You can configure OpenID Connect with Actual Budget by adding the following variables to your `.env` file. ```env title=".env" ACTUAL_OPENID_DISCOVERY_URL=https://authentik.company/application/o// ACTUAL_OPENID_CLIENT_ID= ACTUAL_OPENID_CLIENT_SECRET= ACTUAL_OPENID_SERVER_HOSTNAME=https://actual.company ``` You can configure Actual Budget to authenticate users with OpenID Connect by modifying the `/data/config.json` file or its equivalent specified by the `ACTUAL_DATA_DIR` environment variable. ```json showLineNumbers title="/data/config.json" { "openId": { "discoveryURL": "https://authentik.company/application/o//", "client_id": "", "client_secret": "", "server_hostname": "https://actual.company" } } ``` Alternatively, it is possible to configure OpenID Connect via the UI. 1. Sign in to Actual Budget and select your budget by clicking its name. 2. In the top-left corner, click your budget name to open the dropdown and choose **Settings**. 3. Scroll down and select **Show advanced settings**, then enable **I understand the risks, show experimental features**. 4. Enable **OpenID authentication method**. 5. Scroll up and click **Start using OpenID** under the **Authentication method** section. 6. Fill in the following values: - **OpenID Provider**: authentik - **OpenID provider URL**: `https://authentik.company/application/o//` - **Client ID**: enter the **Client ID** from authentik. - **Client Secret**: enter the **Client Secret** from authentik. 7. Click **OK**. Actual Budget redirects you to the login page after saving the OpenID configuration. ### User provisioning The first user to log in with OpenID is granted admin permissions and becomes the server owner. The server owner cannot be changed from the Actual Budget UI. Actual Budget does not create additional OpenID users automatically unless `ACTUAL_USER_CREATION_MODE=login` is configured on the server. If you do not enable automatic user creation, create each user before they sign in with authentik: 1. Log in as a local (non-OIDC) admin. 2. Navigate to **Server online** > **User Directory**. 3. Create users with usernames matching the corresponding authentik users. 4. Open the budget and grant access from the **User Access** tab. To let Actual Budget create users when they first sign in with authentik, add this variable to your server configuration: ```env title=".env" ACTUAL_USER_CREATION_MODE=login ``` ## Configuration verification To confirm that authentik is properly configured with Actual Budget, open Actual Budget, select the OpenID login method from the dropdown menu, and click **Sign in with OpenID**. ## Resources - [Actual Budget docs - Authenticating With an OpenID Provider](https://actualbudget.org/docs/config/oauth-auth/) - [Actual Budget docs - Managing Multi-User Support](https://actualbudget.org/docs/config/multi-user/) --- ## Integrate with AdventureLog ## What is AdventureLog? > AdventureLog is a self-hosted travel tracker and trip planner. > > \-- [https://adventurelog.app/](https://adventurelog.app/) ## Preparation The following placeholders are used in this guide: - `https://adventurelog.company` is the FQDN of the AdventureLog server installation. - `https://authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of AdventureLog with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Regex` `Authorization` as `^https://adventurelog.company/accounts/oidc/.*$`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## AdventureLog configuration To support the integration of authentik with AdventureLog, you need to configure OpenID Connect in the AdventureLog Admin Panel. If authentik users should be able to create AdventureLog accounts during their first login, set the following environment variable for the AdventureLog backend and restart AdventureLog: ```env title=".env" SOCIALACCOUNT_ALLOW_SIGNUP=True ``` AdventureLog must reach authentik The `server_url` value is used by the AdventureLog backend. Use an authentik URL that the AdventureLog server or container can reach, not a browser-only hostname such as `localhost`. 1. Log in to your AdventureLog installation as an administrator and launch the Admin Panel. To do so, click your **user avatar** in the navigation bar, select **Settings**, then click **Launch Admin Panel**. Alternatively, visit `https://adventurelog.company/admin`. 2. Scroll down to **Social Accounts**, then under **Social applications**, click **Add**. 3. Configure the following settings: - **Provider**: `OpenID Connect` - **Provider ID**: Enter the Client ID from authentik - **Name**: `authentik` - **Client ID**: Enter the Client ID from authentik - **Secret key**: Enter the Client Secret from authentik - **Key**: Leave this field blank. - **Settings**: ```json title="Settings" { "server_url": "https://authentik.company/application/o//" } ``` - **Sites**: move over the sites you want to enable authentik on. This is usually `example.com` and `www.example.com` unless you renamed your sites. 4. Click **Save**. If login returns a 404 error after authentik redirects back to AdventureLog, ensure that the `https://adventurelog.company/accounts/*` path is routed to the AdventureLog backend. ### Link an existing AdventureLog account Users with an existing AdventureLog account can link it to their authentik account. Log in to AdventureLog with the existing account, click your **user avatar** in the navigation bar, select **Settings**, then click **Launch Account Connections** in the **Social Authentication** section. Select **authentik** to link the accounts. If authentik returns a permission error, open the AdventureLog application in authentik, use **Check Access** to test the affected user, and adjust the application's bindings as needed. ## Configuration verification To confirm that authentik is properly configured with AdventureLog, log out, open AdventureLog, and sign in with authentik. ## Resources - [AdventureLog docs - Authentik OIDC Authentication](https://adventurelog.app/docs/configuration/social_auth/authentik.html) - [AdventureLog docs - Social Authentication](https://adventurelog.app/docs/configuration/social_auth.html) - [AdventureLog docs - Advanced Configuration](https://adventurelog.app/docs/configuration/advanced_configuration.html) --- ## Integrate with Amazon Business ## What is Amazon Business? > Amazon Business is Amazon's procurement platform for organizations, providing managed purchasing, approval workflows, and analytics across Amazon's marketplace. > > \-- [https://business.amazon.com/](https://business.amazon.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ### Download the Amazon Business metadata file Download the SAML metadata file from Amazon Business before creating the authentik provider. 1. Log in to the Amazon Business admin console as an administrator and click **Business Settings** under **Hello, "Your Name"**. 2. Under **System integrations**, select **Single Sign-On (SSO)**. 3. In the Amazon Business SSO setup workflow, select **Other** as the identity provider and provide a descriptive name for the identity provider, such as `authentik`. 4. Select the default group and default buying role for users that Amazon Business creates through Just-In-Time (JIT) provisioning. 5. Download the `Amazon_SP_Metadata.xml` file from the Amazon connection data page. You will upload this file to authentik in the next section. ## authentik configuration To support the integration of Amazon Business with authentik, you need to create an application/provider pair in authentik. authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it is used in authentik's SAML issuer URL. - **Choose a Provider type**: select **SAML Provider from Metadata** as the provider type. - **Configure the Provider**: provide a name, select the authorization and invalidation flows to use for this provider, and upload the `Amazon_SP_Metadata.xml` file as **Metadata**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Navigate to **Applications** > **Providers** and click the **Edit** icon of the newly created Amazon Business provider. 5. Under **Advanced protocol settings**, configure the following settings: - Set an available **Signing Certificate**. - Toggle on **Sign responses**. - Under **Property mappings**, remove every entry from **Selected User Property Mappings** except `authentik default SAML Mapping: Name` and `authentik default SAML Mapping: Email`. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. 6. Click **Update**. ### Download the authentik metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the newly created Amazon Business provider. 3. Under **Related objects** > **Metadata**, click **Download**. This metadata file will be required in the next section. ## Amazon Business configuration Return to the Amazon Business SSO setup workflow to complete the configuration. 1. Set **Encrypted SAML assertions** to **Off**. 2. In **Connection data**, upload the authentik metadata file that you downloaded. 3. If Amazon Business prompts for an attribute statement file, skip the upload and configure the attributes manually. 4. In **Attribute mapping**, map the following Amazon Business fields to authentik's SAML attribute names: - **Email address**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` - **Full Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` - **Unique identifier**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` 5. Confirm that Amazon Business metadata has been configured in authentik. 6. Click **Start testing**. A new window opens where you can test SSO with a user that has access to the Amazon Business application in authentik. 7. After a successful test, click **Activate**, confirm that testing is complete, and switch SSO to active. ## Configuration verification To confirm that authentik is properly configured with Amazon Business, open Amazon Business and sign in with an email address that belongs to the SSO-enabled account. You should be redirected to authentik to log in, and then redirected back to Amazon Business. ## Resources - [Amazon Business - Single Sign-on (SSO) Integration guide](https://static-assets.business.amazon.com/assets/global/documents/guides/Amazon-Business-SSO-Integration-Guide_2026.pdf) --- ## Integrate with ezBookkeeping ## What is ezBookkeeping? > ezBookkeeping is a lightweight, self-hosted personal finance app with a user-friendly interface and powerful bookkeeping features. > > \-- [https://ezbookkeeping.mayswind.net/](https://ezbookkeeping.mayswind.net/) ## Preparation The following placeholders are used in this guide: - `ezbookkeeping.company` is the FQDN of the ezBookkeeping installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of ezBookkeeping with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://ezbookkeeping.company/oauth2/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## ezBookkeeping configuration You can configure ezBookkeeping through environment variables or by editing its INI file: Set the following environment variables to enable OpenID Connect authentication: ```yaml showLineNumbers EBK_SERVER_DOMAIN=ezbookkeeping.company EBK_SERVER_ROOT_URL=https://ezbookkeeping.company/ EBK_AUTH_ENABLE_OAUTH2_AUTH=true EBK_AUTH_OAUTH2_PROVIDER=oidc EBK_AUTH_OAUTH2_CLIENT_ID= EBK_AUTH_OAUTH2_CLIENT_SECRET= EBK_AUTH_OIDC_PROVIDER_BASE_URL=https://authentik.company/application/o// EBK_AUTH_ENABLE_OIDC_DISPLAY_NAME=true EBK_AUTH_OIDC_CUSTOM_DISPLAY_NAME=authentik ``` Restart ezBookkeeping for the changes to take effect. Set the following variables in the ezBookkeeping configuration file to enable OpenID Connect authentication: ```ini showLineNumbers title="/conf/ezbookkeeping.ini" [server] domain = ezbookkeeping.company root_url = https://ezbookkeeping.company/ [auth] enable_oauth2_auth = true oauth2_provider = oidc oauth2_client_id = oauth2_client_secret = oidc_provider_base_url = https://authentik.company/application/o// enable_oidc_display_name = true oidc_custom_display_name = authentik ``` Restart ezBookkeeping for the changes to take effect. If you're already signed in, go to **User Settings** > **Security** and click **Link** under **Third-Party Logins** to connect your authentik account. ## Configuration verification To confirm that authentik is properly configured with ezBookkeeping, log out of ezBookkeeping, click **Log in with authentik**, and complete the authentik sign-in flow. A successful authentication should return you to ezBookkeeping with access to your account. ## Resources - [ezBookkeeping Documentation - Configuration](https://ezbookkeeping.mayswind.net/configuration#authentication) --- ## Integrate with FileRise ## What is FileRise? > Lightweight, self-hosted web-based file manager with multi-file upload, editing, and batch operations. > > \-- [https://filerise.net/](https://filerise.net/) ## Preparation The following placeholders are used in this guide: - `filerise.company` is the FQDN of the FileRise installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of FileRise with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://filerise.company/api/auth/auth.php?oidc=callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## FileRise configuration 1. Log in to FileRise as an administrator. 2. Click on your profile icon in the upper-right corner, then select **Admin Panel**. 3. Open the **OIDC Configuration** section. 4. Enable **OIDC login** and configure the following settings: - **OIDC Provider URL**: `https://authentik.company/application/o//` - **OIDC Client ID**: `` - **OIDC Client Secret**: `` - **OIDC Redirect URI**: `https://filerise.company/api/auth/auth.php?oidc=callback` 5. Click **Save Settings**. 6. Click **Test OIDC discovery** to verify that FileRise can reach the authentik provider. ## Configuration verification To confirm that authentik is properly configured with FileRise, log out and open the FileRise integration from authentik. On the FileRise login page, click **Login with OIDC** and authenticate with authentik. ## Resources - [FileRise OIDC & SSO documentation](https://github.com/error311/FileRise/wiki/OIDC-and-SSO) - [FileRise Admin Panel documentation](https://github.com/error311/FileRise/wiki/Admin-Panel) --- ## Integrate with Home Assistant ## What is Home Assistant? > Open source home automation that puts local control and privacy first. Powered by a worldwide community of tinkerers and DIY enthusiasts. Perfect to run on a Raspberry Pi or a local server. > > -- https://www.home-assistant.io/ ## Preparation The following placeholders are used in this guide: - `hass.company` is the FQDN of the Home Assistant installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Home Assistant does not include built-in support for SSO protocols. This guide covers two community-maintained OpenID Connect integrations: - [christiaangoossens/hass-oidc-auth](https://github.com/christiaangoossens/hass-oidc-auth) - [cavefire/hass-openid](https://github.com/cavefire/hass-openid) Choose one integration before continuing, then use the matching tab in the authentik and Home Assistant configuration sections. ## authentik configuration To support the integration of Home Assistant with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because you will use it later as ``. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://hass.company/auth/oidc/callback`. - Set **Signing Key** to any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because you will use it later as ``. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://hass.company/auth/openid/callback`. - Set **Signing Key** to any available signing key. - **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Home Assistant configuration ### UI configuration 1. Install [OpenID Connect/SSO Authentication](https://my.home-assistant.io/redirect/hacs_repository/?owner=christiaangoossens&repository=hass-oidc-auth&category=Integration) from HACS. 2. Restart Home Assistant if HACS asks you to do so. 3. Log in to Home Assistant as an administrator and go to **Settings** > **Devices & Services**. 4. Click **Add Integration** and select **OpenID Connect/SSO Authentication**. 5. Select the authentik provider from the pre-configured providers. 6. Set **Discovery URL** to `https://authentik.company/application/o//.well-known/openid-configuration`. 7. Continue after Home Assistant successfully validates the discovery URL. 8. Enter the **Client ID** and **Client Secret** from authentik. 9. Configure the group and user-linking options for your Home Assistant deployment, then finish the setup. Only enable automatic user linking while migrating existing Home Assistant users to OIDC. Disable it again after the users are linked. ### YAML configuration To configure the integration with YAML instead of the Home Assistant UI, add the following to your Home Assistant configuration: ```yaml showLineNumbers title="/config/configuration.yaml" auth_oidc: client_id: client_secret: !secret authentik_client_secret discovery_url: "https://authentik.company/application/o//.well-known/openid-configuration" ``` Restart Home Assistant after changing `configuration.yaml`. For advanced options, such as role mapping, user linking, TLS settings, and public-client configuration, refer to the hass-oidc-auth YAML configuration guide linked in the resources section. ### UI configuration 1. Install [OpenID / OAuth2 authentication](https://my.home-assistant.io/redirect/hacs_repository/?category=integration&repository=hass-openid&owner=cavefire) from HACS. 2. Restart Home Assistant if HACS asks you to do so. 3. Log in to Home Assistant as an administrator and go to **Settings** > **Devices & Services**. 4. Click **Add Integration** and select **OpenID / OAuth2 authentication**. 5. Select **Use configure URL**. 6. Set **Configure URL** to `https://authentik.company/application/o//.well-known/openid-configuration`. 7. Review the discovered provider endpoints and continue. 8. Enter the **Client ID** and **Client secret** from authentik. 9. Configure the identity mapping and advanced options for your Home Assistant deployment, then finish the setup. Only enable **Block other login methods** after you have confirmed that OpenID login works, otherwise you can lock yourself out of Home Assistant. ### Legacy YAML configuration The Home Assistant UI config flow is the recommended setup method for hass-openid. If you still use the legacy YAML configuration, add the following to your Home Assistant configuration: ```yaml showLineNumbers title="/config/configuration.yaml" openid: client_id: client_secret: configure_url: "https://authentik.company/application/o//.well-known/openid-configuration" ``` Restart Home Assistant after changing `configuration.yaml`. ## Configuration verification To confirm that authentik is properly configured with Home Assistant, open Home Assistant and start an SSO login with the integration you configured. You should be redirected to authentik and then back to Home Assistant after successful authentication. ## Resources - [hass-oidc-auth authentik configuration guide](https://github.com/christiaangoossens/hass-oidc-auth/blob/main/docs/provider-configurations/authentik.md) - [hass-oidc-auth YAML configuration guide](https://github.com/christiaangoossens/hass-oidc-auth/blob/main/docs/configuration.md) - [hass-openid setup guide](https://github.com/cavefire/hass-openid/blob/main/README.md) - [hass-openid legacy YAML configuration guide](https://github.com/cavefire/hass-openid/blob/main/LEGACY_CONFIGURATION.md) --- ## Integrate with Open WebUI ## What is Open WebUI? > Open WebUI is a simple, self-hosted AI platform that works entirely offline. It supports tools like Ollama and OpenAI-style APIs and has a built-in engine for RAG tasks. > > \-- [https://openwebui.com/](https://openwebui.com/) ## Preparation The following placeholders are used in this guide: - `openwebui.company` is the FQDN of the Open WebUI installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Open WebUI with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://openwebui.company/oauth/oidc/callback`. - Select any available signing key. - Make sure to leave the **Encryption Key** field empty. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure application roles *(optional)* Open WebUI can assign the `user` and `admin` roles from OAuth claims. To manage these roles in authentik, create application entitlements and send them in a `roles` claim. 1. In authentik, navigate to **Applications** > **Applications** and open the Open WebUI application. 2. Click the **Application entitlements** tab. 3. Click **New Entitlement**, set the name to `Open WebUI Users`, and then click **Create**. 4. Repeat the previous step to create another entitlement named `Open WebUI Admins`. 5. Open each entitlement and bind the users or groups that should receive it. 6. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **Scope Mapping** with the following values: - **Name**: `Open WebUI roles` - **Scope name**: `roles` - **Expression**: ```python showLineNumbers entitlement_names = { entitlement.name for entitlement in request.user.app_entitlements(provider.application) } roles = [] if "Open WebUI Users" in entitlement_names: roles.append("user") if "Open WebUI Admins" in entitlement_names: roles.append("admin") return { "roles": roles, } ``` 7. Click **Finish**. 8. Navigate to **Applications** > **Providers**, edit the Open WebUI provider, and add `Open WebUI roles` to **Advanced protocol settings** > **Selected Scopes**. 9. Click **Update** to save the provider. ## Open WebUI configuration To configure Open WebUI to use authentik, add the following environment variables to your Open WebUI deployment: Open WebUI persists several configuration values, including `WEBUI_URL` and the OAuth settings. Set these values before enabling SSO, or update them later in the Open WebUI Admin Panel. ```env title=".env" OAUTH_CLIENT_ID="" OAUTH_CLIENT_SECRET="" OAUTH_PROVIDER_NAME="authentik" OPENID_PROVIDER_URL="https://authentik.company/application/o//.well-known/openid-configuration" OPENID_REDIRECT_URI="https://openwebui.company/oauth/oidc/callback" WEBUI_URL="https://openwebui.company" ENABLE_OAUTH_SIGNUP="true" ENABLE_LOGIN_FORM="false" ENABLE_PASSWORD_AUTH="false" OAUTH_MERGE_ACCOUNTS_BY_EMAIL="true" ``` Replace `` with the authentik application **Slug** noted earlier. Then restart Open WebUI to apply the changes. To manage Open WebUI roles with the optional authentik application entitlements created earlier, add the following variables: ```env title=".env" OAUTH_SCOPES="openid email profile roles" ENABLE_OAUTH_ROLE_MANAGEMENT="true" ``` ## Configuration verification To confirm that authentik is properly configured with Open WebUI, open Open WebUI, make sure you are logged out of any previous session, and click **Continue with authentik**. After successful authentication, authentik redirects you back to Open WebUI. If you enabled role management, assign a test user to one of the Open WebUI application entitlements in authentik, then log in as that user. To verify the assigned role, log in as an Open WebUI administrator, click your profile picture, select **Admin Panel**, and open the **Users** page. ## Resources - [Open WebUI Documentation - SSO (OAuth, OIDC, Trusted Header)](https://docs.openwebui.com/features/authentication-access/auth/sso/) - [Open WebUI Documentation - Environment Variable Configuration](https://docs.openwebui.com/reference/env-configuration/) --- ## Integrate with Wallos ## What is Wallos? > Wallos is a self-hosted subscription and budget planning application. > > \-- [https://wallosapp.com/](https://wallosapp.com/) ## Preparation The following placeholders are used in this guide: - `wallos.company` is the FQDN of the Wallos installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Wallos with authentik, you need to create an application/provider pair in authentik. If existing Wallos users should be linked by email address, Wallos requires the `email_verified` claim to be `True`. Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification) for instructions on how to create a custom email scope mapping that returns the required claim. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair in authentik. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://wallos.company/index.php`. - Select any available signing key. - If you created a custom email scope mapping, add it under **Advanced protocol settings** > **Selected Scopes** and remove `authentik default OAuth Mapping: OpenID 'email'`. - **Configure Bindings** (optional): you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Wallos configuration To support the integration of authentik with Wallos, you need to enable and configure OIDC authentication in Wallos. 1. Log in to your Wallos installation as an administrator and open the Admin Panel. 2. Scroll to the **OIDC settings** section and enable OIDC/OAuth. 3. Configure the following settings: - **Provider Name**: `authentik` - **Client ID**: enter the Client ID from authentik. - **Client Secret**: enter the Client Secret from authentik. - **Auth URL**: `https://authentik.company/application/o/authorize/` - **Token URL**: `https://authentik.company/application/o/token/` - **User Info URL**: `https://authentik.company/application/o/userinfo/` - **Redirect URL**: `https://wallos.company/index.php` - **User Identifier Field**: `sub` - **Scopes**: `openid email profile` Wallos can create users automatically when they sign in with OIDC. If you want Wallos to create accounts for users who do not already exist, enable **Create User Automatically**. 4. Click **Save**. ## Configuration verification To verify that authentik is integrated correctly with Wallos, log out and then click **Log in with authentik** on the Wallos sign-in page. You should be redirected to authentik, and after successful authentication, returned to Wallos. ## Resources - [Wallos README - OIDC](https://github.com/ellite/Wallos#oidc) - [Wallos source - OIDC settings](https://github.com/ellite/Wallos/blob/main/admin.php) --- ## Integrate with Zipline ## What is Zipline? > Zipline is a self-hostable file upload server designed for easy file sharing, supporting tools like ShareX and Flameshot, with features such as simplified setup and extensive customization options. > > \-- [https://zipline.diced.sh/](https://zipline.diced.sh/) ## Preparation The following placeholders are used in this guide: - `zipline.company` is the FQDN of the Zipline installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Zipline with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: Provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: Select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: Provide a name (or accept the auto-provided name), choose the authorization flow for this provider, and configure the following required settings: - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://zipline.company/api/auth/oauth/oidc`. - Select any available signing key. - Under **Advanced protocol settings** > **Scopes**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to the **Selected Scopes** list. - **Configure Bindings** *(optional)*: Create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Zipline configuration 1. From the Zipline dashboard, navigate to **Administrator** > **Settings** > **Features**. 2. Enable **OAuth Registration**, then click **Save**. 3. Navigate to **Administrator** > **Settings** > **OAuth**. 4. In the **OpenID Connect** subsection, configure the following values: - **OIDC Client ID**: `` - **OIDC Client Secret**: `` - **OIDC Authorize URL**: `https://authentik.company/application/o/authorize/` - **OIDC Token URL**: `https://authentik.company/application/o/token/` - **OIDC Userinfo URL**: `https://authentik.company/application/o/userinfo/` 5. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with Zipline, log out of Zipline by clicking your user icon in the top-right corner and selecting **Logout**. A new **Login with OIDC** button should appear on the login page, allowing you to sign in with authentik. ## Resources - [Zipline documentation - OpenID Connect (OIDC)](https://zipline.diced.sh/docs/guides/oauth/oidc) - [Zipline documentation - OAuth](https://zipline.diced.sh/docs/guides/oauth) --- ## Integrate with Beszel ## What is Beszel? > Beszel is a lightweight server monitoring platform with Docker and Podman statistics, historical data, alerts, multi-user support, OAuth authentication, automatic backups, and a REST API. > > \-- [https://beszel.dev/](https://beszel.dev/) ## Preparation The following placeholders are used in this guide: - `beszel.company` is the FQDN of the Beszel installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Beszel with authentik, you need to create an email verification scope mapping and an application/provider pair in authentik. ### Create an email verification scope mapping in authentik Beszel requires the email scope to return a value of `email_verified: True`. As of [authentik 2025.10](/docs/releases/2025/v2025.10.md#default-oauth-scope-mappings), the default behavior is to return `email_verified: False`, so a custom scope mapping is required for Beszel to allow authentication. Refer to [Email scope verification](/docs/add-secure-apps/providers/oauth2/#email-scope-verification) for instructions on how to create the required custom scope mapping. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://beszel.company/api/oauth2-redirect`. - Select any available signing key. - **Advanced protocol settings** > **Scopes**: - Add `OAuth Mapping: OpenID 'email' with "email_verified"` to the **Selected Scopes**. - Remove the `authentik default OAuth Mapping: OpenID 'email'` scope. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. Beszel uses PocketBase as its server backend. When you install Beszel, PocketBase is included as part of Beszel, so you do not need to separately [integrate PocketBase](../../platforms/pocketbase/index.md). ## Beszel configuration 1. Sign in to Beszel and open the PocketBase superuser dashboard at `https://beszel.company/_/#/settings`. 2. Toggle off **Hide collection create and edit controls**, then click **Save changes**. 3. Open the **users** collection by clicking the **Collections** icon in the sidebar or by navigating to `https://beszel.company/_/#/collections?collection=pb_users_auth`. 4. Click the gear icon next to the collection name, then select the **Options** tab. 5. Open the **OAuth2** section and toggle **Enable**. 6. Click **+ Add provider**, then select **OpenID Connect**. 7. Enter the following details from the authentik provider: - **Client ID**: enter the **Client ID** from authentik. - **Client secret**: enter the **Client Secret** from authentik. - **Display name**: `authentik` - **Auth URL**: `https://authentik.company/application/o/authorize/` - **Token URL**: `https://authentik.company/application/o/token/` - **Fetch user info from**: `User info URL` - **User info URL**: `https://authentik.company/application/o/userinfo/` 8. Click **Set provider config**. 9. Click **Save changes**. 10. Return to `https://beszel.company/_/#/settings`, toggle **Hide collection create and edit controls** back on, then click **Save changes**. ### User creation and password login Beszel does not create users automatically by default. Before a user can sign in with authentik, either create the user manually in the **users** collection with an email address that matches their authentik email address, or enable automatic user creation by setting the `USER_CREATION=true` environment variable on the Beszel hub. To disable password-based login and require OAuth/OIDC authentication instead, set the `DISABLE_PASSWORD_AUTH=true` environment variable on the Beszel hub. Avoid changing this setting directly in PocketBase, because Beszel will overwrite it with the environment variable value on restart. ## Configuration verification To confirm that authentik is properly configured with Beszel, open Beszel and click **authentik** to sign in. You should be redirected to authentik and returned to the Beszel web interface after a successful login. ## Resources - [Beszel OAuth / OIDC documentation](https://beszel.dev/guide/oauth) - [Beszel Environment Variables documentation](https://beszel.dev/guide/environment-variables) - [Beszel User Accounts documentation](https://beszel.dev/guide/user-accounts) --- ## Integrate with Chronograf ## What is Chronograf? > Chronograf is the user interface and administrative component of the InfluxDB 1.x platform. Use templates and libraries to rapidly build dashboards with real-time visualizations. > > \-- [https://www.influxdata.com/time-series-platform/chronograf/](https://www.influxdata.com/time-series-platform/chronograf/) ## Preparation The following placeholders are used in this guide: - `chronograf.company` is the FQDN of your Chronograf installation. - `authentik.company` is the FQDN of your authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Chronograf with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://chronograf.company/oauth/authentik/callback`. - Select any available **Signing Key**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Chronograf configuration Add the following environment variables to your Chronograf setup. If you are using a configuration file for Chronograf, these settings can also be included there. ```ini title="/etc/default/chronograf" PUBLIC_URL=https://chronograf.company TOKEN_SECRET=generate-a-random-secret JWKS_URL=https://authentik.company/application/o//jwks/ GENERIC_NAME=authentik GENERIC_CLIENT_ID= GENERIC_CLIENT_SECRET= GENERIC_SCOPES=openid,email,profile GENERIC_AUTH_URL=https://authentik.company/application/o/authorize/ GENERIC_TOKEN_URL=https://authentik.company/application/o/token/ GENERIC_API_URL=https://authentik.company/application/o/userinfo/ USE_ID_TOKEN=true ``` Set `TOKEN_SECRET` to a high-entropy random string. You can generate one with the following command: ```shell openssl rand -base64 256 | tr -d '\n' ``` The `GENERIC_NAME` value is included in the Chronograf callback URL. If you change it from `authentik`, update the redirect URI in the authentik provider to match. ## Configuration verification To confirm that authentik is properly configured with Chronograf, open Chronograf and click **Log in with authentik**. You should be redirected to authentik, and after successfully signing in you should be redirected back to Chronograf. ## Resources - [InfluxData documentation - Manage Chronograf security](https://docs.influxdata.com/chronograf/v1/administration/managing-security/#configure-chronograf-to-use-any-oauth-20-provider) - [InfluxData documentation - Chronograf configuration options](https://docs.influxdata.com/chronograf/v1/administration/config-options/#generic-oauth-20-authentication-options) --- ## Integrate with Datadog ## What is Datadog? > Datadog is a monitoring and analytics platform for cloud-scale applications. It provides monitoring of servers, databases, tools, and services through a SaaS-based data analytics platform. > > \-- [https://www.datadoghq.com/](https://www.datadoghq.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. If SAML is not available for your Datadog account, contact Datadog support to enable it. Datadog has multiple regional sites. This guide uses the default US1 site (`app.datadoghq.com`). If your Datadog organization uses a different site, replace `app.datadoghq.com` with the appropriate hostname: | Site | Hostname | | ------- | ----------------- | | US1 | app.datadoghq.com | | US3 | us3.datadoghq.com | | US5 | us5.datadoghq.com | | EU1 | app.datadoghq.eu | | AP1 | ap1.datadoghq.com | | AP2 | ap2.datadoghq.com | | US1-FED | app.ddog-gov.com | This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Datadog with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it can be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://app.datadoghq.com/account/saml/assertion`. - Set the **Audience** to `https://app.datadoghq.com/account/saml/metadata.xml`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the provider metadata 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created. 2. Under **Related objects** > **Metadata**, click **Download**. This metadata file is required in the next section. ## Datadog configuration 1. Log in to Datadog as an administrator. 2. Hover over your email address in the bottom-left corner of the sidebar and click **Organization Settings**. 3. Navigate to **Login Methods**. Under **SAML**, click **Configure**, then click **Add SAML**. - **Name**: enter a descriptive name (e.g. `authentik`). - **IdP Metadata**: upload the authentik metadata file that you downloaded in the previous section. - **Identity Provider (IdP) Initiated Login**: enable this if users should launch Datadog from the authentik Application Dashboard. 4. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with Datadog, log out, open Datadog, and click **Using Single Sign-On?**. Enter your email address and click **Next**. You should be redirected to authentik, and after you authenticate, you will be redirected back to Datadog. When logging in via SP-initiated login, Datadog may send a one-time email verification code. This is normal security behavior. ## Resources - [Datadog Docs - Configuring Single Sign-On With SAML](https://docs.datadoghq.com/account_management/saml/configuration/) - [Datadog Docs - Single Sign On With SAML](https://docs.datadoghq.com/account_management/saml/) - [Datadog Docs - Datadog Site](https://docs.datadoghq.com/getting_started/site/) --- ## Integrate with Dozzle ## What is Dozzle? > Dozzle is a lightweight, web-based log viewer designed to simplify monitoring and debugging containerized applications across Docker, Docker Swarm, and Kubernetes environments. > > \-- [https://dozzle.dev/guide/what-is-dozzle](https://dozzle.dev/guide/what-is-dozzle) Dozzle supports forward-proxy authentication. Use authentik as a forward auth proxy in front of Dozzle, and configure Dozzle to read the authenticated user details from the proxy headers set by authentik. ## Preparation The following placeholders are used in this guide: - `dozzle.company` is the FQDN of the Dozzle installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Dozzle can access the Docker API through the mounted Docker socket. Only expose Dozzle behind authentication, and keep Dozzle actions and shell access disabled unless you need them. ## authentik configuration To support the integration of Dozzle with authentik, you need to create an application/provider pair in authentik. This guide assumes that Dozzle is already deployed behind a reverse proxy that supports authentik forward auth. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **Proxy Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **Mode** to **Forward auth (single application)**. - Set **External host** to `https://dozzle.company`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure proxy outpost The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. Add the Dozzle application to a proxy outpost that will serve it: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Outposts**. 3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. 4. Under **Available Applications**, select the Dozzle application and move it to **Selected Applications**. 5. Click **Update** to save your changes. ## Dozzle configuration Configure Dozzle to use the `forward-proxy` authentication provider. Add the following environment variables to your Dozzle configuration: ```env title=".env" DOZZLE_AUTH_PROVIDER=forward-proxy DOZZLE_AUTH_HEADER_USER=X-Authentik-Username DOZZLE_AUTH_HEADER_EMAIL=X-Authentik-Email DOZZLE_AUTH_HEADER_NAME=X-Authentik-Name DOZZLE_AUTH_LOGOUT_URL=https://dozzle.company/outpost.goauthentik.io/sign_out ``` Configure your reverse proxy to use the authentik outpost as the forward auth endpoint for `https://dozzle.company`. Requests to `/outpost.goauthentik.io` must be routed to the authentik outpost, and all other requests must be routed to Dozzle. After making these changes, restart Dozzle and reload your reverse proxy. ## Configuration verification To verify the login flow, open Dozzle. You should be redirected to authentik before the Dozzle web interface is shown. ## Resources - [Dozzle - What is Dozzle?](https://dozzle.dev/guide/what-is-dozzle) --- ## Integrate with FortiAnalyzer ## What is FortiAnalyzer? > FortiAnalyzer is a centralized log management, analytics, and reporting platform for Fortinet devices and the Fortinet Security Fabric. > > \-- [https://www.fortinet.com/products/management/fortianalyzer](https://www.fortinet.com/products/management/fortianalyzer) This guide was tested with FortiAnalyzer 8.0. ## Preparation The following placeholders are used in this guide: - `faz.company` is the FQDN of the FortiAnalyzer installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of FortiAnalyzer with authentik, you need to create a SAML property mapping and an application/provider pair in authentik. ### Create a property mapping in authentik FortiAnalyzer expects the SAML NameID and a SAML attribute named `username` to identify the administrator account. This example uses the authentik username for both values, but you can return any user attribute that matches the FortiAnalyzer administrator identifier. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `FortiAnalyzer username` - **SAML Attribute Name**: `username` - **Expression**: ```python return request.user.username ``` 5. Click **Finish** to save the property mapping. FortiAnalyzer also accepts `profilename` and `adoms` attributes for wildcard SSO administrators that allow external profile or ADOM overrides. The `profilename` attribute can assign a matching admin profile that already exists on FortiAnalyzer. The `adoms` attribute can grant access to one or more ADOMs. To use either attribute, create additional SAML provider property mappings with the corresponding **SAML Attribute Name**, return the desired values from the **Expression**, and add the mappings to **Selected User Property Mappings** when configuring the provider. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring FortiAnalyzer. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://faz.company/saml/?acs`. - Set the **SLS URL** to `https://faz.company/saml/?sls`. - Under **Advanced protocol settings**: - Set the **Signing Certificate** to any available certificate. - Add `FortiAnalyzer username` to **Selected User Property Mappings**. - Set the **NameID Property Mapping** to `authentik default SAML Mapping: Username`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## FortiAnalyzer configuration 1. Log in to the FortiAnalyzer web interface as an administrator. 2. Navigate to **System Settings** > **SAML SSO**. 3. Configure the **Single Sign-On Settings**: - **Server Address**: `faz.company` - **Single Sign-On Mode**: `Service Provider (SP)` - **SP Certificate**: select an available certificate. - **Default Login Page**: select whether FortiAnalyzer should show the normal login page with an SSO option, or redirect directly to authentik. - **Auto Create Admin**: enable this setting if FortiAnalyzer should create SSO administrators on first login. If you leave it disabled, create matching SSO administrators in FortiAnalyzer before testing the integration. 4. Configure the **IdP Settings**: - **IdP Type**: `Custom` - **IdP Entity ID**: `https://authentik.company/application/saml//metadata/` - **IdP Login URL**: `https://authentik.company/application/saml//` - **IdP Logout URL**: `https://authentik.company/application/saml//` - **IdP Certificate**: import the signing certificate that you selected in the authentik SAML provider. You can download it from the authentik SAML provider page, under **Related objects** > **Download signing certificate**. 5. If you enabled any options under **Signing Options** in FortiAnalyzer, align them with the corresponding options under **Advanced protocol settings** in the authentik SAML provider. 6. Click **Apply** to save the configuration. With **Auto Create Admin** enabled, newly-created SSO administrators receive the configured default admin profile. If users should receive permissions through SAML attributes instead, create matching FortiAnalyzer admin profiles and ADOMs, configure wildcard SSO administrator overrides in FortiAnalyzer, and send the optional `profilename` and `adoms` attributes from authentik. ## Configuration verification To confirm that authentik is properly configured with FortiAnalyzer, open FortiAnalyzer and sign in via authentik. ## Resources - [FortiAnalyzer Administration Guide - SAML admin authentication](https://docs.fortinet.com/document/fortianalyzer/8.0.0/administration-guide/981386/saml-admin-authentication) - [Fortinet Community - SAML attributes for ADOM and admin profile override with wildcard SSO administrators](https://community.fortinet.com/fortimanager-27/technical-tip-saml-attributes-for-adom-and-admin-profile-override-with-wildcard-sso-administrators-127057) --- ## Integrate with Gatus ## What is Gatus? > Gatus is an automated, developer-oriented status page for monitoring services with HTTP, ICMP, TCP, and DNS checks. > > \-- [https://gatus.io/](https://gatus.io/) ## Preparation The following placeholders are used in this guide: - `gatus.company` is the FQDN of the Gatus installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Gatus with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application **Slug** because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://gatus.company/authorization-code/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Gatus configuration To enable OIDC in Gatus, update your `config.yaml` file, typically found at `/config/config.yaml` or the location specified by the `GATUS_CONFIG_PATH` environment variable. Additionally, set the following variables in your `.env` file. If your setup does not support environment variables, you can use hard-coded values, but this is not recommended for security reasons. Gatus automatically updates its configuration approximately every 30 seconds. If the changes are not reflected, restart the instance to ensure the changes are applied. ```ini showLineNumbers title=".env" OIDC_CLIENT_ID= OIDC_CLIENT_SECRET= ``` ```yaml showLineNumbers title="config.yaml" security: oidc: issuer-url: "https://authentik.company/application/o//" client-id: "$OIDC_CLIENT_ID" client-secret: "$OIDC_CLIENT_SECRET" redirect-url: "https://gatus.company/authorization-code/callback" scopes: ["openid"] ``` ## Configuration verification To confirm that authentik is properly configured with Gatus, open Gatus and click **Login with OIDC**. A successful login should redirect you to your status page. ## Resources - [Gatus Security documentation for OpenID Connect](https://github.com/TwiN/gatus?tab=readme-ov-file#oidc) --- ## Integrate with GlitchTip ## What is GlitchTip? > GlitchTip makes monitoring software easy. Track errors, monitor performance, and check site uptime all in one place. > > \-- [https://glitchtip.com/](https://glitchtip.com/) ## Preparation The following placeholders are used in this guide: - `glitchtip.company` is the FQDN of the GlitchTip installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of GlitchTip with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring GlitchTip. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://glitchtip.company/accounts/oidc/authentik/login/callback/`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## GlitchTip configuration Configuration of OpenID Connect providers in GlitchTip is done using Django Admin. 1. If you do not already have a GlitchTip administrator account, create a superuser using the `manage.py` script: ```shell sudo docker exec -it glitchtip-web-1 ./manage.py createsuperuser ``` 2. Go to `https://glitchtip.company/admin/socialaccount/socialapp/` and log in with the superuser. 3. Click **Add Social Application** and enter the following details: - **Provider**: `OpenID Connect` - **Provider ID**: `authentik` - **Provider Name**: `authentik` - **Client ID**: `` - **Secret key**: `` - **Settings**: ```json { "server_url": "https://authentik.company/application/o//" } ``` 4. Click **Save**. The **Provider ID** value determines the callback path. If you use a provider ID other than `authentik`, update the redirect URI in the authentik provider to `https://glitchtip.company/accounts/oidc//login/callback/`. To add an authentik account to an existing GlitchTip account, log in with the existing username and password, click **Profile**, and then click **Add Account** in the **Social Auth Accounts** section. ## Configuration verification To confirm that authentik is properly configured with GlitchTip, log out of GlitchTip and open the GlitchTip login page. Click the authentik login option. You should be redirected to authentik for authentication and then returned to GlitchTip. ## Resources - [GlitchTip - Django Admin and Social Authentication](https://glitchtip.com/documentation/install/#django-admin) - [django-allauth OpenID Connect provider documentation](https://docs.allauth.org/en/dev/socialaccount/providers/openid_connect.html) --- ## Integrate with Gotify ## What is Gotify? > Gotify is a self-hosted server for sending and receiving messages in real time over WebSockets. It includes a web UI and REST API, with an Android app and command-line client. > > \-- [https://gotify.net/](https://gotify.net/) ## Preparation The following placeholders are used in this guide: - `gotify.company` is the FQDN of the Gotify installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Gotify with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring Gotify. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://gotify.company/auth/oidc/callback`. - If users will log in from the Gotify Android app, add another **Redirect URI** of type `Strict` `Authorization` as `gotify://oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Gotify configuration Choose the configuration method that matches your Gotify deployment. Add the following settings to the Gotify environment file: ```env title="gotify-server.env" GOTIFY_OIDC_ENABLED=true GOTIFY_OIDC_ISSUER=https://authentik.company/application/o// GOTIFY_OIDC_CLIENTID= GOTIFY_OIDC_CLIENTSECRET= GOTIFY_OIDC_REDIRECTURL=https://gotify.company/auth/oidc/callback ``` Restart Gotify to apply the changes. Set the following environment variables for the Gotify container or service: ```env title=".env" GOTIFY_OIDC_ENABLED=true GOTIFY_OIDC_ISSUER=https://authentik.company/application/o// GOTIFY_OIDC_CLIENTID= GOTIFY_OIDC_CLIENTSECRET= GOTIFY_OIDC_REDIRECTURL=https://gotify.company/auth/oidc/callback ``` Restart the Gotify container or service to apply the changes. Use the same callback URL for the authentik **Redirect URI** and `GOTIFY_OIDC_REDIRECTURL`. If Gotify is served from a subpath, include the subpath before `/auth/oidc/callback` in both values. ### Link existing users *(optional)* Gotify creates a local user when a new user logs in with OIDC. If a Gotify user with the same username already exists, Gotify rejects the login until you enable existing-user linking: ```env title="gotify-server.env" GOTIFY_OIDC_LINK_BY_USERNAME=true ``` Enable existing-user linking only if usernames in authentik correspond to the same people as the matching Gotify usernames. To permit only existing Gotify users to log in, also set `GOTIFY_OIDC_AUTOREGISTER=false`. ## Configuration verification To confirm that authentik is properly configured with Gotify, log out of Gotify and click the **Login with OIDC** button on the login page. You should be redirected to authentik to log in, then redirected back to the Gotify web UI. ## Resources - [Gotify documentation - OpenID Connect](https://gotify.net/docs/oidc) - [Gotify documentation - Configuration](https://gotify.net/docs/config) --- ## Integrate with Grafana ## What is Grafana? > Grafana is an open source observability platform for visualizing, monitoring, and alerting on data from many different sources. > > \-- [https://grafana.com/](https://grafana.com/) ## Preparation The following placeholders are used in this guide: - `grafana.company` is the FQDN of the Grafana installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Grafana with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://grafana.company/login/generic_oauth`. - Set the **Logout URI** to `https://grafana.company/logout`. - Set the **Logout Method** to `Front-channel`. - Select any available **Signing Key**. - Under **Advanced protocol settings** > **Selected Scopes**, add `authentik default OAuth Mapping: Application Entitlements`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements for Grafana roles Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the Grafana roles that can be assigned to users. 1. Open the Grafana application that you just created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create the entitlements that you want Grafana to evaluate, such as `Grafana Admins`, `Grafana Editors`, and `Grafana Viewers`. 4. Bind the appropriate users or groups to each entitlement. For this integration, the entitlement names should exactly match the values referenced in Grafana's `role_attribute_path`. This keeps Grafana-specific authorization scoped to the Grafana application instead of relying on global authentik group names. ## Grafana configuration If your Grafana instance is running in Docker, set the following environment variables: ```yaml environment: GF_AUTH_GENERIC_OAUTH_ENABLED: "true" GF_AUTH_GENERIC_OAUTH_NAME: "authentik" GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "" GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "" GF_AUTH_GENERIC_OAUTH_SCOPES: "openid profile email entitlements" GF_AUTH_GENERIC_OAUTH_AUTH_URL: "https://authentik.company/application/o/authorize/" GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://authentik.company/application/o/token/" GF_AUTH_GENERIC_OAUTH_API_URL: "https://authentik.company/application/o/userinfo/" GF_AUTH_SIGNOUT_REDIRECT_URL: "https://authentik.company/application/o//end-session/" # Optionally enable auto-login (bypasses Grafana login screen) GF_AUTH_OAUTH_AUTO_LOGIN: "true" # Optionally map user entitlements to Grafana roles GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: "contains(entitlements[*], 'Grafana Admins') && 'Admin' || contains(entitlements[*], 'Grafana Editors') && 'Editor' || 'Viewer'" # Required if Grafana is running behind a reverse proxy GF_SERVER_ROOT_URL: "https://grafana.company" ``` If you are using a config-file instead, you have to set these options: ```ini [auth] signout_redirect_url = https://authentik.company/application/o//end-session/ # Optionally enable auto-login oauth_auto_login = true [auth.generic_oauth] name = authentik enabled = true client_id = client_secret = scopes = openid email profile entitlements auth_url = https://authentik.company/application/o/authorize/ token_url = https://authentik.company/application/o/token/ api_url = https://authentik.company/application/o/userinfo/ # Optionally map user entitlements to Grafana roles role_attribute_path = contains(entitlements[*], 'Grafana Admins') && 'Admin' || contains(entitlements[*], 'Grafana Editors') && 'Editor' || 'Viewer' ``` If you are using a Helm `values.yaml` file instead, you have to set these options: ```yaml grafana.ini: auth: signout_redirect_url: "https://authentik.company/application/o//end-session/" oauth_auto_login: true auth.generic_oauth: name: authentik enabled: true client_id: "" client_secret: "" scopes: "openid profile email entitlements" auth_url: "https://authentik.company/application/o/authorize/" token_url: "https://authentik.company/application/o/token/" api_url: "https://authentik.company/application/o/userinfo/" # Optionally map user entitlements to Grafana roles role_attribute_path: contains(entitlements[*], 'Grafana Admins') && 'Admin' || contains(entitlements[*], 'Grafana Editors') && 'Editor' || 'Viewer' ``` For security reasons, do not inline the client secret in Helm values. Reference the secret from `grafana.ini` instead. For more information, see [How to securely reference secrets in grafana.ini](https://github.com/grafana-community/helm-charts/blob/main/charts/grafana/README.md#how-to-securely-reference-secrets-in-grafanaini) ### Role Mappings In the configuration above you can see an example of a role mapping. Upon login, this configuration looks at the `entitlements` claim returned by authentik. If any of the specified entitlement names are found, the user will be granted the resulting role in Grafana. In the example shown above, one of the specified entitlement names is `Grafana Admins`. If that entitlement is present, the user will be granted the `Admin` role in Grafana. If `Grafana Admins` is not present, Grafana checks for `Grafana Editors`. If that entitlement is present, the user is granted the `Editor` role. Finally, if neither entitlement is present, it falls back to granting the `Viewer` role. For more information on role mappings, see [Grafana's docs](https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/generic-oauth/#configure-role-mapping). ### Grafana configuration considerations To ensure redirects work correctly in Grafana, make sure the `root_url` in your configuration accurately reflects how users access Grafana through your reverse proxy. For example, if your Grafana instance is behind a proxy and accessed at `https://grafana.company`, set `root_url` to `https://grafana.company`. This ensures that OAuth and other redirects use the correct URL, such as `https://grafana.company/login/generic_oauth`, instead of defaulting to something like `localhost:3000`. If you get a `user does not belong to org` error when trying to log in to Grafana for the first time with OAuth, check whether you have an organization with the ID of `1`. If not, add the following to your Grafana configuration: ```ini [users] auto_assign_org = true auto_assign_org_id = ``` If your first OAuth login fails with a `user.sync` error such as `cannot remove last grafana admin`, verify whether the OAuth user's username or email matches that of an existing local Grafana server admin account. In such cases, Grafana attempts to link the local account to the OAuth user. If the OAuth role mapped to that user is not a server admin, the login can fail because Grafana tries to remove the last remaining server admin account. For OSS Grafana, the simplest workaround is to create a separate OAuth-backed user first, grant that new user admin access, and only then remove the old local admin account. If you are configuring Generic OAuth from the Grafana UI instead of a config file, the `Allow assign Grafana admin` toggle is under **Administration** > **Authentication** > **Generic OAuth**. Its config-file equivalent is `allow_assign_grafana_admin`, or `GF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN` in Docker-based deployments. This setting is only required if your `role_attribute_path` can return `GrafanaAdmin`; the example role mapping on this page returns `Admin`, `Editor`, or `Viewer`. ## Configuration verification To confirm that authentik is properly configured with Grafana, open Grafana and click **Sign in with authentik**. You should be redirected to authentik, and after successfully signing in you should be redirected back to Grafana. ## Resources - [Grafana documentation - Generic OAuth authentication](https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/generic-oauth/) - [Grafana documentation - Configure Grafana](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/) - [Grafana Helm chart - Securely reference secrets in grafana.ini](https://github.com/grafana-community/helm-charts/blob/main/charts/grafana/README.md#how-to-securely-reference-secrets-in-grafanaini) --- ## Integrate with Icinga Web 2 ## What is Icinga Web 2? > Icinga Web 2 is the next-generation web interface for the Icinga monitoring stack. It provides a flexible UI to view monitoring states, drill into problems, and integrate with the Icinga 2 backend. > > \-- [https://icinga.com/](https://icinga.com/) ## Preparation The following placeholders are used in this guide: - `icinga.company` is the FQDN of the Icinga Web 2 installation. - `authentik.company` is the FQDN of the authentik installation. This guide assumes the `oidc` module from RISE-GmbH is already installed, enabled, and configured with a database resource. Refer to the [module installation documentation](https://github.com/RISE-GmbH/icingaweb2-module-oidc/blob/main/doc/02-Installation.md) for the installation and database setup. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Icinga Web 2 with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring Icinga Web 2. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://icinga.company/icingaweb2/oidc/authentication/realm?name=authentik`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Icinga Web 2 configuration 1. Log in to Icinga Web 2 as an administrator. 2. In the left navigation, open **Oidc** > **Provider**, and click **New Provider**. 3. Configure the following fields: - **Name**: `authentik` (must match the value of the `name` query parameter in the redirect URI you registered in authentik). - **Url**: `https://authentik.company/application/o//` - **Secret**: the Client Secret from the authentik provider. - **Appname**: the Client ID from the authentik provider. - **Caption**: the label shown on the new login button on the Icinga Web 2 sign-in page, for example `Sign in with authentik`. - **Custom Username**: `preferred_username` - **Groups to sync**: a comma-separated list of the authentik groups that should be imported into the Icinga Web 2 database for role assignments. You can use wildcard patterns, for example `icinga-*`. - **Required Groups** *(optional)*: a comma-separated list of groups the user must be a member of in order to be allowed to log in via authentik. Leave empty to allow any authenticated authentik user. - **Button Color**: choose the background color of the login button. - **Text Color**: choose a text color that contrasts with the button color. - **Enabled**: toggle on. The login button is displayed after the provider is enabled. - **Enforce Https on redirect urls**: toggle on if Icinga Web 2 runs behind an HTTPS-terminating reverse proxy. 4. Click **Create Provider** to save the configuration. The OIDC module imports the groups matched by **Groups to sync** into Icinga Web 2. To avoid creating unrelated group entries in **Access Control**, restrict this field to the groups that are used for Icinga Web 2 role assignments, for example `icinga-admins, icinga-users`. ### Grant permissions to authentik users and groups After a user logs in via authentik for the first time, the user (and any synced groups) is created in the Icinga Web 2 database without any permissions. To grant access, assign **Roles** to the user or group under **Configuration** > **Authentication** > **Roles**. Configuring Icinga Web 2 roles and permissions in detail is out of scope for this guide. Refer to the [Icinga Web 2 access control documentation](https://icinga.com/docs/icinga-web/latest/doc/06-Security/) for the specifics. ## Configuration verification To confirm that authentik is properly configured with Icinga Web 2, log out of Icinga Web 2 and click the new authentik login button on the sign-in screen. You should be redirected to authentik to log in, then redirected back to the Icinga Web 2 dashboard. ## Resources - [RISE-GmbH OIDC module installation documentation](https://github.com/RISE-GmbH/icingaweb2-module-oidc/blob/main/doc/02-Installation.md) - [RISE-GmbH OIDC module configuration documentation](https://github.com/RISE-GmbH/icingaweb2-module-oidc/blob/main/doc/03-Configuration.md) - [Icinga Web 2 access control documentation](https://icinga.com/docs/icinga-web/latest/doc/06-Security/) --- ## Integrate with Observium ## What is Observium? > Observium is a network monitoring and management platform that provides real-time insight into network health and performance. > > \-- [https://observium.org](https://observium.org) ## Preparation The following placeholders are used in this guide: - `observium.company` is the FQDN of the Observium installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Observium does not have a native OpenID Connect integration, so this guide uses mod\_auth\_openidc to authenticate users with authentik and pass them to Observium through Apache `REMOTE_USER` authentication. This guide assumes that you already have a working Observium instance served by Apache HTTP Server with [mod\_auth\_openidc](https://github.com/OpenIDC/mod_auth_openidc) installed and enabled. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Observium with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://observium.company/secure/redirect_uri`. Note that the Redirect URI can be anything, as long as it does not point to existing content. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Observium configuration 1. Edit the Apache virtual host that serves Observium and add the following directives inside the `` block: ```apacheconf title="/etc/apache2/sites-available/000-default.conf" # Existing Observium configuration OIDCProviderMetadataURL https://authentik.company/application/o//.well-known/openid-configuration OIDCClientID OIDCClientSecret OIDCRedirectURI https://observium.company/secure/redirect_uri OIDCCryptoPassphrase OIDCScope "openid email profile" OIDCRemoteUserClaim preferred_username ^(.*)$ $1@authentik AuthType openid-connect Require valid-user ``` If Observium is behind a reverse proxy that sends `X-Forwarded-*` headers, also configure `OIDCXForwardedHeaders` with every forwarded header that reaches Apache, for example: ```apacheconf OIDCXForwardedHeaders X-Forwarded-Host X-Forwarded-Proto X-Forwarded-Port ``` 2. Edit the Observium configuration: ```php title="/opt/observium/config.php" $config['auth_mechanism'] = "remote"; $config['auth_remote_userlevel'] = 10; $config['auth_remote_logout_url'] = "https://authentik.company/application/o//end-session/"; ``` With this method, Observium assigns the same permission level to all remotely authenticated users. The value `10` gives users administrator access. Choose the user level that fits your Observium access policy. 3. Restart the Apache2 service: ```bash service apache2 restart ``` ## Configuration verification To confirm that authentik is properly configured with Observium, open Observium. You should be redirected to authentik and, after a successful login, returned to Observium. ## Resources - [Observium - Authentication](https://docs.observium.org/authentication/) - [Observium - User Levels](https://docs.observium.org/user_levels/) - [mod\_auth\_openidc - How to Use It](https://github.com/OpenIDC/mod_auth_openidc#how-to-use-it) - [mod\_auth\_openidc - Configuration Options](https://github.com/OpenIDC/mod_auth_openidc/blob/master/auth_openidc.conf) --- ## Integrate with OneUptime ## What is OneUptime? > OneUptime is an open-source observability and incident management platform that provides infrastructure monitoring, incident management, status pages, and APM. > > \-- [https://oneuptime.com/](https://oneuptime.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Configuring SSO with OneUptime Cloud requires a Scale plan or higher. If you are self-hosting OneUptime, SSO is available on all instances at no cost. ## authentik configuration To support the integration of OneUptime with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when you configure OneUptime. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://temp.temp`. You will replace this after OneUptime provides the real Reply URL. - Set the **Audience** to `https://temp.temp`. You will replace this after OneUptime provides the real Identifier. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click on the name of the SAML provider that you created for OneUptime. 2. Under **Related objects** > **Download signing certificate**, click **Download**. You need this certificate file in the next section. ## OneUptime configuration ### Create an SSO configuration 1. Log in to OneUptime as an administrator. 2. Navigate to **Project Settings** > **Authentication** > **SSO**. 3. Click **Create SSO** and configure the following settings: - **Name**: enter a descriptive name. - **Description**: enter a description. - **Sign On URL**: `https://authentik.company/application/saml//` - **Issuer**: `https://authentik.company/application/saml//metadata/` - **Public Certificate**: paste the certificate that you downloaded from authentik, including the `BEGIN CERTIFICATE` and `END CERTIFICATE` lines. - **Signature Method**: `RSA-SHA256` - **Digest Method**: `SHA256` - **Enabled**: enable the SSO configuration when you are ready to test it. - **Teams**: select the OneUptime teams that newly signed-in users should be added to. 4. Save the configuration. 5. Click **View SSO Config** on the new SSO entry. 6. Note the following values: - **Identifier (Entity ID)** - **Reply URL (Assertion Consumer Service URL)** OneUptime does not support SAML role mapping. Manage SSO user access with the teams that you select on the OneUptime SSO configuration, and configure any additional user permissions in OneUptime. ### Update the authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the SAML provider that you created for OneUptime. 3. Update the provider with the values from OneUptime: - **ACS URL**: set to the OneUptime **Reply URL (Assertion Consumer Service URL)**. - **Audience**: set to the OneUptime **Identifier (Entity ID)**. 4. Click **Update**. After you verify that SSO works, you can open **Project Settings** > **Authentication** > **SSO** in OneUptime and enable **Force SSO for Login**. ## Configuration verification To confirm that authentik is properly configured with OneUptime, open the OneUptime integration from the authentik Application Dashboard. You should be redirected to authentik for authentication and then signed in to OneUptime. You can also test the SP-initiated flow by opening the OneUptime login page in a private or incognito browser window, starting the SSO sign-in flow, and entering the email address of a user who should have access. You should be redirected to authentik for authentication and then back to OneUptime. ## Resources - [OneUptime Docs - SSO](https://oneuptime.com/docs/en/identity/sso) - [OneUptime pricing](https://oneuptime.com/pricing) --- ## Integrate with OpenObserve ## What is OpenObserve? > OpenObserve is an open source observability platform for logs, metrics, traces, and real user monitoring. It stores data in object storage and provides search, dashboards, and alerting on top of it. > > \-- [https://openobserve.ai/](https://openobserve.ai/) ## Preparation The following placeholders are used in this guide: - `openobserve.company` is the FQDN of the OpenObserve installation. - `dex.company` is the FQDN of the Dex installation. - `authentik.company` is the FQDN of the authentik installation. Single sign-on is only available in OpenObserve Enterprise, and OpenObserve does not connect to an identity provider directly. It delegates authentication to [Dex](https://dexidp.io/), which in turn authenticates with authentik. The login path is browser to OpenObserve to Dex to authentik. This means you need to run a Dex instance alongside OpenObserve, and integrate authentik with Dex rather than with OpenObserve. Dex can integrate with authentik via either: - **OpenID Connect**: Dex acts as an OpenID Connect client of authentik. Users are redirected to authentik to sign in, so the full authentik login flow applies, including multi-factor authentication and any policies bound to the application. - **LDAP**: Dex binds to an authentik [LDAP provider](/docs/add-secure-apps/providers/ldap/) served by an [LDAP outpost](/docs/add-secure-apps/outposts/). Users type their credentials into Dex's own login form and are never redirected to authentik. Prefer OpenID Connect unless something in your environment requires LDAP. Select a connector below and complete both the authentik and OpenObserve configuration in that tab. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of OpenObserve with authentik using OpenID Connect, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://dex.company/dex/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. Dex reads group membership from the `groups` claim that authentik includes in the standard `profile` scope, so no additional scope mapping is required. ## OpenObserve configuration ### Configure Dex Create a Dex configuration file with the following contents, replacing the placeholders: ```yaml title="dex-config.yml" issuer: https://dex.company/dex storage: type: sqlite3 config: file: /var/dex/dex.db web: http: 0.0.0.0:5556 expiry: idTokens: 10m refreshTokens: validIfNotUsedFor: 30m staticClients: - id: openobserve name: OpenObserve secret: redirectURIs: - https://openobserve.company/config/redirect oauth2: responseTypes: - code skipApprovalScreen: true connectors: - type: oidc id: authentik name: authentik config: issuer: https://authentik.company/application/o// clientID: clientSecret: redirectURI: https://dex.company/dex/callback insecureEnableGroups: true insecureSkipEmailVerified: true scopes: - openid - profile - email userNameKey: preferred_username ``` `insecureSkipEmailVerified: true` is required. authentik's default `email` scope mapping always returns `"email_verified": false`, and Dex rejects the login with `email not verified` unless this setting is enabled. Restart Dex after saving the configuration. ### Configure OpenObserve Set the following environment variables on the OpenObserve Enterprise instance and restart it: ```env title=".env" O2_DEX_ENABLED=true O2_DEX_CLIENT_ID=openobserve O2_DEX_CLIENT_SECRET= O2_DEX_BASE_URL=https://dex.company/dex O2_DEX_REDIRECT_URL=https://openobserve.company/config/redirect O2_CALLBACK_URL=https://openobserve.company/web/cb ``` The OpenObserve documentation describes `O2_DEX_CLIENT_SECRET` as a base64-encoded secret, but OpenObserve sends the value to Dex verbatim. Set it to the same string as `secret:` in `dex-config.yml`. After restarting OpenObserve, the login page shows a **Login with SSO** button. ### Map authentik groups to OpenObserve roles *(optional)* OpenObserve stores roles in [OpenFGA](https://openfga.dev/), so role mapping requires a reachable OpenFGA instance. Add the following variables alongside the ones above: ```env title=".env" O2_OPENFGA_ENABLED=true O2_OPENFGA_BASE_URL=http://openfga:8080 O2_MAP_GROUP_TO_ROLE=true O2_MAP_GROUP_TO_ROLE_SKIP_CREATION=false ``` With this configuration, each authentik group that a user belongs to becomes an OpenObserve role in the default organization on their first login. Non-alphanumeric characters in a group name are replaced with underscores, so an authentik group named `OpenObserve Admins` becomes the role `OpenObserve_Admins`. Roles created this way start with no permissions. Grant them in OpenObserve under **IAM** > **Roles** after the first login has created them. Set `O2_MAP_GROUP_TO_ROLE_SKIP_CREATION` to `true` instead if you prefer to create and permission the roles up front and have OpenObserve only assign the ones that already exist. ## authentik configuration To support the integration of OpenObserve with authentik over LDAP, you need an LDAP application/provider pair, a service account for Dex to bind with, and an LDAP outpost to serve the directory. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **LDAP Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the bind flow to use for this provider, and note the **Base DN** because it will be required later. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create a service account and LDAP outpost After creating the application/provider pair, follow the LDAP provider setup to create a [service account](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#create-a-service-account), assign the [LDAP search permission](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#assign-the-ldap-search-permission-to-the-service-account) to the service account, and [create an LDAP outpost](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#create-an-ldap-outpost) for the OpenObserve LDAP provider. Use a descriptive service account name such as `openobserve-ldap-user`, and note the service account's full Bind DN and password. Dex uses this account to search for a matching user DN before binding as that user. If you configure application bindings, ensure that the service account and the users who should authenticate to OpenObserve have access to the application. Deploy the outpost where Dex can reach it. Only Dex talks to the outpost, so it does not need to be published to the internet. The outpost serves plain LDAP on port `3389` and LDAPS on port `6636`. ## OpenObserve configuration ### Configure Dex Create a Dex configuration file with the following contents, replacing the placeholders. The DNs below use authentik's default Base DN of `dc=ldap,dc=goauthentik,dc=io`. Replace them with the **Base DN** that you noted when creating the provider. ```yaml title="dex-config.yml" issuer: https://dex.company/dex storage: type: sqlite3 config: file: /var/dex/dex.db web: http: 0.0.0.0:5556 expiry: idTokens: 10m refreshTokens: validIfNotUsedFor: 30m staticClients: - id: openobserve name: OpenObserve secret: redirectURIs: - https://openobserve.company/config/redirect oauth2: responseTypes: - code skipApprovalScreen: true connectors: - type: ldap id: ldap name: authentik config: host: :3389 insecureNoSSL: true bindDN: cn=openobserve-ldap-user,ou=users,dc=ldap,dc=goauthentik,dc=io bindPW: usernamePrompt: Username userSearch: baseDN: ou=users,dc=ldap,dc=goauthentik,dc=io filter: "(objectClass=user)" username: cn idAttr: uid emailAttr: mail nameAttr: displayName groupSearch: baseDN: ou=groups,dc=ldap,dc=goauthentik,dc=io filter: "(objectClass=group)" userMatchers: - userAttr: DN groupAttr: member nameAttr: cn ``` `insecureNoSSL: true` tells Dex to use the outpost's plain LDAP port. To use LDAPS instead, remove that setting, set the port to `6636`, and make sure Dex trusts the certificate that the outpost presents. `nameAttr: cn` under `groupSearch` returns the bare group name rather than the full DN, which is what the role mapping below expects. Restart Dex after saving the configuration. ### Configure OpenObserve Set the following environment variables on the OpenObserve Enterprise instance and restart it: ```env title=".env" O2_DEX_ENABLED=true O2_DEX_CLIENT_ID=openobserve O2_DEX_CLIENT_SECRET= O2_DEX_BASE_URL=https://dex.company/dex O2_DEX_REDIRECT_URL=https://openobserve.company/config/redirect O2_CALLBACK_URL=https://openobserve.company/web/cb ``` The OpenObserve documentation describes `O2_DEX_CLIENT_SECRET` as a base64-encoded secret, but OpenObserve sends the value to Dex verbatim. Set it to the same string as `secret:` in `dex-config.yml`. After restarting OpenObserve, the login page shows a **Login with SSO** button. ### Map authentik groups to OpenObserve roles *(optional)* OpenObserve stores roles in [OpenFGA](https://openfga.dev/), so role mapping requires a reachable OpenFGA instance. Add the following variables alongside the ones above: ```env title=".env" O2_OPENFGA_ENABLED=true O2_OPENFGA_BASE_URL=http://openfga:8080 O2_MAP_GROUP_TO_ROLE=true O2_MAP_GROUP_TO_ROLE_SKIP_CREATION=false ``` With this configuration, each authentik group that a user belongs to becomes an OpenObserve role in the default organization on their first login. Non-alphanumeric characters in a group name are replaced with underscores, so an authentik group named `OpenObserve Admins` becomes the role `OpenObserve_Admins`. Roles created this way start with no permissions. Grant them in OpenObserve under **IAM** > **Roles** after the first login has created them. Set `O2_MAP_GROUP_TO_ROLE_SKIP_CREATION` to `true` instead if you prefer to create and permission the roles up front and have OpenObserve only assign the ones that already exist. ## Configuration verification To confirm that authentik is properly configured with OpenObserve, open OpenObserve and click **Login with SSO**. - With the OpenID Connect connector, you are redirected to authentik to log in. - With the LDAP connector, Dex shows its own login form. Enter an authentik username and password. Either way you are returned to the OpenObserve home page, and the new account appears under **IAM** > **Users** as an external user. ## Resources - [OpenObserve documentation - Single Sign-On (SSO)](https://openobserve.ai/docs/user-guide/account-administration/identity-and-access-management/sso/) - [OpenObserve documentation - Enable RBAC](https://openobserve.ai/docs/user-guide/account-administration/identity-and-access-management/enable-rbac-in-openobserve-enterprise/) - [OpenObserve documentation - Environment variables reference](https://openobserve.ai/docs/administration/configuration/environment-variables/) - [Dex documentation - Authentication through an OpenID Connect provider](https://dexidp.io/docs/connectors/oidc/) - [Dex documentation - Authentication through LDAP](https://dexidp.io/docs/connectors/ldap/) --- ## Integrate with PostHog ## What is PostHog? > PostHog is an all-in-one developer platform that provides product analytics, web analytics, session replay, error tracking, feature flags, experimentation, surveys, a data warehouse, and a customer data platform. > > \-- [https://posthog.com/](https://posthog.com/) ## Preparation The following placeholders are used in this guide: - `posthog.company` is the FQDN of the PostHog installation. For PostHog Cloud, use `us.posthog.com` or `eu.posthog.com`. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. [PostHog configures SAML per authentication domain](https://posthog.com/docs/settings/sso#authentication-domains). Before configuring SAML, add the email domain for your users in **Organization settings** > **Authentication domains** and complete domain verification if PostHog requires it. Domain verification is outside the scope of this guide. ## authentik configuration To support the integration of PostHog with authentik, you need to create SAML property mappings and an application/provider pair in authentik. ### Create property mappings in authentik PostHog requires a permanent ID attribute named `name_id`. PostHog can use the managed authentik email mapping, but the permanent ID and split-name attributes require custom SAML provider property mappings. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `PostHog name_id` - **SAML Attribute Name**: `name_id` - **Expression**: ```python return request.user.uid ``` 5. Click **Finish** to save the property mapping. 6. Repeat steps 2-5 to create the following additional SAML provider property mappings: - **Name**: `PostHog first_name` - **SAML Attribute Name**: `first_name` - **Expression**: ```python return request.user.name.split(" ", 1)[0] if request.user.name else request.user.username ``` - **Name**: `PostHog last_name` - **SAML Attribute Name**: `last_name` - **Expression**: ```python return request.user.name.rsplit(" ", 1)[-1] if " " in request.user.name else "" ``` ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively, you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring PostHog. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://posthog.company/complete/saml/`. - Set the **Audience** to `https://posthog.company`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `PostHog name_id`. - Add `authentik default SAML Mapping: Email`, `PostHog name_id`, `PostHog first_name`, and `PostHog last_name` to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## PostHog configuration 1. Log in to PostHog as an administrator. 2. Click your profile picture in the bottom-left corner, then navigate to **Organization settings** > **Authentication domains**. 3. If your users' email domain is not already listed, add it and complete PostHog's domain verification process. 4. Open the SAML configuration for the authentication domain. 5. Verify that the PostHog-provided **ACS Consumer URL** and **Audience / Entity ID** values match the **ACS URL** and **Audience** values configured in authentik. 6. Configure the following settings: - **SAML ACS URL**: `https://authentik.company/application/saml//` - **SAML Entity ID**: `https://authentik.company/application/saml//metadata/` - **SAML X.509 Certificate**: paste the public certificate from the signing certificate that you selected for the authentik SAML provider. 7. Save the SAML configuration. ### Configure IdP-initiated login *(optional)* PostHog normally starts SAML login after the user enters their email address on the PostHog login page. If users should also be able to launch PostHog from authentik's **Application Dashboard** page, configure PostHog's RelayState value in authentik. 1. In PostHog, copy the **RelayState** value from the SAML configuration for the authentication domain. 2. In authentik, navigate to **Applications** > **Providers** and open the SAML provider that you created earlier. 3. Click **Edit**. 4. Under **Advanced protocol settings**, set **Default relay state** to the **RelayState** value from PostHog. 5. Click **Update**. ## Configuration verification To confirm that authentik is properly configured with PostHog, log out of PostHog and open the PostHog login page in a private or incognito browser window. Enter an email address that uses the configured authentication domain, click the SSO login option, and confirm that you are redirected to authentik for authentication and then back to PostHog. ## Resources - [PostHog SSO, SAML, and SCIM documentation](https://posthog.com/docs/settings/sso) - [PostHog SAML configuration source](https://github.com/PostHog/posthog/blob/master/frontend/src/scenes/settings/organization/VerifiedDomains/ConfigureSAMLModal.tsx) - [PostHog SAML authentication backend source](https://github.com/PostHog/posthog/blob/master/ee/api/authentication.py) --- ## Integrate with Pulse ## What is Pulse? > Pulse is an open-source monitoring platform that provides real-time insight into Proxmox, Docker, and Kubernetes infrastructure. > > \-- [https://github.com/rcourtman/Pulse](https://github.com/rcourtman/Pulse) ## Preparation The following placeholders are used in this guide: - `pulse.company` is the FQDN of the Pulse installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Pulse with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring Pulse. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://pulse.company/api/oidc/callback`. - Select an RSA signing key so authentik signs ID tokens with RS256. - Under **Advanced protocol settings** > **Scopes**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to the selected scopes if you want long-lived sessions backed by refresh tokens. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Pulse configuration 1. Log in to Pulse as an administrator. 2. Navigate to **Settings** > **Security** > **Single sign-on (OIDC)**. 3. Configure the following settings: - **Issuer URL**: `https://authentik.company/application/o//` - **Client ID**: enter the Client ID from authentik. - **Client Secret**: enter the Client Secret from authentik. - **Redirect URL**: confirm that Pulse shows `https://pulse.company/api/oidc/callback`. If it shows a different URL, enter `https://pulse.company/api/oidc/callback`. - **Logout URL**: `https://authentik.company/application/o//end-session/` 4. Click **Save**. ### Configure optional OIDC settings Pulse can also be configured with access restrictions and longer-lived sessions: - To restrict access, expand **Show advanced OIDC options** and configure **Allowed groups**, **Allowed domains**, or **Allowed email addresses**. authentik includes the user's group names in the `groups` claim of the default `profile` scope. - To assign Pulse roles from authentik group membership, configure **Group role mappings** as `group=roleId` pairs, for example `pulse-admins=admin`. Group role mappings require Pulse Pro. - To enable long-lived sessions, add `offline_access` to **Scopes** in Pulse after configuring the `offline_access` scope mapping in authentik. Pulse then stores the refresh token with the user's session and invalidates the session if the token refresh fails. ### Hide local login *(optional)* To hide the local login form and show only SSO, set `PULSE_AUTH_HIDE_LOCAL_LOGIN=true` in your environment variables, or enable **Hide local login form** in the Pulse admin UI under **Settings** > **Security** > **Authentication**. You can still access the local login by appending `?show_local=true` to the Pulse URL. ## Configuration verification To confirm that authentik is properly configured with Pulse, log out and attempt to log back in using Single Sign-On. You should be redirected to authentik for authentication and then redirected back to Pulse. ## Resources - [Pulse OIDC Single Sign-On documentation](https://github.com/rcourtman/Pulse/blob/main/docs/OIDC.md) - [Pulse configuration documentation](https://github.com/rcourtman/Pulse/blob/main/docs/CONFIGURATION.md) --- ## Integrate with Sentry ## What is Sentry? > Sentry is an application monitoring platform for tracking errors, performance issues, and release health across software projects. > > \-- [https://sentry.io](https://sentry.io) ## Preparation The following placeholders are used in this guide: - `sentry.company` is the FQDN of the Sentry installation. For Sentry SaaS, use your organization's Sentry hostname. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Sentry with authentik, you need to create a SAML application/provider pair in authentik. In Sentry, find your organization slug under **Organization Settings** > **General Settings**. Use this value wherever `` is shown. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it is required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://sentry.company/saml/acs//`. - Set the **Audience** to `https://sentry.company/saml/metadata//`. - Set the **SLS URL** to `https://sentry.company/saml/sls//`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: User ID`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Sentry configuration ### Configure SAML SSO 1. Log in to Sentry as an organization owner. 2. Navigate to **Settings** > **Auth**, and click **Configure** next to **SAML2**. 3. Use the **Metadata URL** method and enter `https://authentik.company/application/saml//metadata/`. 4. Map the identity provider attributes: - **IdP User ID**: `http://schemas.goauthentik.io/2021/02/saml/uid` - **User Email**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` - **First Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` 5. Save the configuration. Sentry should authenticate with authentik and redirect back to a page confirming the SAML settings. ### Configure automated provisioning with SCIM *(optional)* authentik can also provision Sentry users and teams with SCIM. SCIM requires SAML2 to be configured first. For Sentry SaaS, SCIM requires a Sentry Business or Enterprise plan. Sentry expects the SCIM `userName` value to be an email address, so each user who should be provisioned to Sentry must have a valid email address. #### Create a SCIM user property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SCIM Provider Mapping** as the property mapping type and click **Next**. 4. Set the following values: - **Name**: `Sentry SCIM user` - **Expression**: ```python if not request.user.email: raise SkipObject given_name, family_name = request.user.name, " " formatted = request.user.name + " " if " " in request.user.name: given_name, _, family_name = request.user.name.partition(" ") formatted = request.user.name return { "userName": request.user.email, "name": { "formatted": formatted, "givenName": given_name, "familyName": family_name, }, "active": request.user.is_active, "emails": [{ "value": request.user.email, "type": "work", "primary": True, }], } ``` 5. Click **Create**. #### Enable SCIM in Sentry 1. In Sentry, navigate to **Settings** > **Auth**. 2. Under **General Settings**, enable **SCIM** and save the settings. 3. Copy the **Auth Token** and **SCIM Base URL** values from the **SCIM Information** section. #### Create a SCIM provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **Create**. - **Choose a Provider type**: select **SCIM Provider** as the provider type. - **Configure the Provider**: provide a name, and the following required configurations. - Set **URL** to the **SCIM Base URL** from Sentry. - Set **Token** to the **Auth Token** from Sentry. - To only sync specific Sentry teams, select the matching authentik groups in **Group Filter**. If this field is empty, authentik syncs all groups. - Under **Attribute mapping**, remove `authentik default SCIM Mapping: User` from **Selected User Property Mappings** and add `Sentry SCIM user`. 3. Click **Finish** to save the provider. Sentry creates teams from SCIM groups using the group's `displayName` value. Team slugs are normalized by Sentry, including lowercasing and replacing spaces with dashes. #### Add the SCIM provider to the Sentry application 1. Navigate to **Applications** > **Applications** and click the **Edit** icon for the Sentry application. 2. In **Backchannel Providers**, select the SCIM provider that you created. 3. Confirm that the users who should be provisioned to Sentry can access the Sentry application. Add group, user, or policy bindings to the application when you need to allow only a specific set of users. 4. Click **Update**. ## Configuration verification To confirm that authentik is properly configured with Sentry, open Sentry and log in with authentik. To verify SCIM provisioning, open the SCIM provider in authentik. In the **Schedules** section, click the play icon for the SCIM sync schedule. After the sync completes, confirm that the expected users and teams are present in Sentry. ## Resources - [Sentry Docs - Custom SAML Provider](https://docs.sentry.io/organization/authentication/sso/saml2/) - [Sentry Docs - Okta SCIM Provisioning](https://docs.sentry.io/organization/authentication/sso/okta-sso/okta-scim/) - [Sentry Docs - SCIM API](https://docs.sentry.io/api/scim/) - [Sentry Developer Documentation - Self-Hosted Single Sign-On](https://develop.sentry.dev/self-hosted/configuration/sso/) --- ## Integrate with Splunk Enterprise ## What is Splunk Enterprise? > Splunk Enterprise collects, indexes, and analyzes machine data from applications, systems, and devices. > > \-- [https://www.splunk.com/en\_us/products/splunk-enterprise.html](https://www.splunk.com/en_us/products/splunk-enterprise.html) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `splunk.company` is the browser-facing FQDN of the Splunk Enterprise instance. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Errors in the Splunk SAML configuration can lock users out of Splunk Enterprise. Keep a local Splunk administrator account available while configuring SAML. You can reach the local login page at `https://splunk.company/en-US/account/login?loginType=Splunk`. ## authentik configuration To support the integration of Splunk Enterprise with authentik, you need to create and import a self-signed certificate, create SAML property mappings, create an application/provider pair, and create application entitlements for the Splunk roles users should receive. To forward authentik events to Splunk Enterprise, see [Forward events to Splunk Enterprise](/log-forwarding/splunk-enterprise/). ### Create and import a self-signed certificate Splunk verifies the certificate used to sign SAML responses. Certificates generated under **System** > **Certificates** can fail Splunk's certificate validation because they are issued by the authentik internal CA instead of being directly self-signed. To avoid this, create a self-signed certificate and import it into authentik. 1. On your workstation, generate a self-signed certificate with `openssl`: ```bash openssl req -x509 -newkey rsa:4096 \ -keyout key.pem \ -out cert.pem \ -sha256 \ -days 36500 \ -nodes \ -subj "/O=company/OU=authentik/CN=authentik.company" ``` ```powershell openssl.exe req -x509 -newkey rsa:4096 ` -keyout key.pem ` -out cert.pem ` -sha256 ` -days 36500 ` -nodes ` -subj "/O=company/OU=authentik/CN=authentik.company" ``` 2. Log in to authentik as an administrator and open the authentik Admin interface. 3. Navigate to **System** > **Certificates**. 4. Click **Import**. Give the certificate a unique name, paste the contents of `cert.pem` into the **Certificate** field, and paste the contents of `key.pem` into the **Private Key** field. 5. Click **Import**. ### Create property mappings Splunk expects the SAML assertion to include user role, email, and display name attributes. Create custom SAML property mappings so authentik sends the attribute names Splunk expects. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create the following **SAML Provider Property Mapping** entries: - **Splunk roles mapping**: - **Name**: choose a descriptive name, for example `Splunk roles`. - **SAML Attribute Name**: `role`. - **Expression**: ```python return [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ] ``` - **Splunk mail mapping**: - **Name**: choose a descriptive name, for example `Splunk mail`. - **SAML Attribute Name**: `mail`. - **Expression**: ```python return request.user.email ``` - **Splunk real name mapping**: - **Name**: choose a descriptive name, for example `Splunk real name`. - **SAML Attribute Name**: `realName`. - **Expression**: ```python return request.user.name ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://splunk.company/saml/acs`. - Set the **Audience** to `https://splunk.company`. - Set the **SLS URL** to `https://splunk.company/saml/logout`. - Under **Advanced protocol settings**: - Set **Signing Certificate** to the self-signed certificate that you imported earlier. - Enable **Sign assertions** and **Sign responses**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Add the Splunk property mappings that you created earlier. - Remove `authentik default SAML Mapping: Groups`, because Splunk roles are sent from application entitlements instead of authentik groups. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements for Splunk roles Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the Splunk SAML group values that this application should send. 1. Open the Splunk Enterprise application that you just created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each Splunk SAML group value that users should be able to receive, such as `splunk-user`, `splunk-power`, or `splunk-admin`. 4. Bind the appropriate users or groups to each entitlement. For this integration, each entitlement name must exactly match the Splunk SAML group value that you map to a Splunk role. This keeps Splunk-specific authorization scoped to the Splunk Enterprise application instead of relying on global authentik group names. ### Download the provider metadata 1. Navigate to **Applications** > **Providers** and open the SAML provider that you created in the previous section. 2. Under **Related objects** > **Download metadata**, click **Download**. This metadata file is required in the next section. 3. Under **Related objects** > **Download signing certificate**, click **Download**. Keep this certificate available in case Splunk does not import the certificate from the metadata file. ## Splunk Enterprise configuration ### Configure SAML 1. Log in to Splunk Enterprise with a local administrator account. 2. In the Splunk bar, navigate to **Settings** > **Users and authentication** > **Authentication methods**. 3. Select **SAML** as the external authentication method and click **Configure Splunk to use SAML**. 4. Click **SAML Configuration**. 5. Configure the SAML settings: - Upload the metadata file from authentik by dragging it into the drop zone, or paste the metadata contents into the **Metadata contents** text area. - Set **Entity ID** to `https://splunk.company`. This value must match the **Audience** value in authentik. - If Splunk does not populate the certificate from metadata, copy the contents of the authentik signing certificate, starting with `-----BEGIN CERTIFICATE-----`, into **IdP certificate chains**. - Under **Advanced Settings**, set **FQDN - Host Name or IP address of the load balancer** to `splunk.company`. - Under **Advanced Settings**, set **Redirect port - load balancer port** to the browser-facing HTTPS port, usually `443`. 6. Click **Save**. Use the same browser-facing Splunk Enterprise URL in authentik and Splunk Enterprise. Do not use an internal backend URL or IP address for the SAML **ACS URL**, **Audience**, **Entity ID**, or load balancer settings unless users open Splunk Enterprise through that same URL. ### Configure group mappings Splunk maps values from the SAML `role` attribute to Splunk roles. The authentik property mapping sends application entitlement names in that attribute. 1. Log in to Splunk Enterprise with a local administrator account. 2. In the Splunk bar, navigate to **Settings** > **Users and authentication** > **Authentication methods**. 3. Click **Configure Splunk to use SAML**. 4. If the **SAML Configuration** dialog opens, click **Cancel** to return to the SAML groups page. 5. Click **New Group**. 6. Configure the mapping: - **Group name**: enter the authentik application entitlement name, for example `splunk-user`. - **Splunk roles**: select the Splunk role or roles to assign, for example `user`. 7. Click **Save**. 8. Repeat these steps for each Splunk role entitlement. Splunk can auto-map SAML role values to local Splunk roles with the same name. Explicit group mappings are recommended because they make authorization easier to review and avoid accidentally granting roles when an entitlement name matches a Splunk role. ## Configuration verification To verify SAML login, navigate to the authentik User interface and click the Splunk Enterprise application to initiate a Single Sign-On login. Upon successful login, you should be redirected to Splunk Enterprise and have the appropriate permissions set by your application entitlements. ## Resources - [Splunk Enterprise Documentation - Configure single sign-on with SAML](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-saml-as-an-authentication-scheme-for-single-sign-on/configure-single-sign-on-with-saml) - [Splunk Enterprise Documentation - Configure SAML SSO for other IdPs](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-saml-as-an-authentication-scheme-for-single-sign-on/configure-saml-sso-for-other-idps) - [Splunk Enterprise Documentation - Map groups on a SAML identity provider to Splunk roles](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-saml-as-an-authentication-scheme-for-single-sign-on/map-groups-on-a-saml-identity-provider-to-splunk-roles) - [Splunk Enterprise Documentation - Troubleshoot SAML SSO](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-saml-as-an-authentication-scheme-for-single-sign-on/troubleshoot-saml-sso) --- ## Integrate with Ubuntu Landscape ## What is Ubuntu Landscape? > Landscape is Canonical's systems management tool for managing Ubuntu machines through a web interface or API. > > \-- [https://ubuntu.com/landscape](https://ubuntu.com/landscape) ## Preparation The following placeholders are used in this guide: - `landscape.company` is the FQDN of the Landscape server. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Landscape uses the OpenID Connect protocol for single sign-on. Landscape uses OIDC only for authentication. Invite users and assign roles and permissions in Landscape. Existing Landscape users cannot be upgraded to OIDC authentication; Canonical recommends recreating those users. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Landscape with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring Landscape. - **Choose a Provider type**: select **OAuth2/OpenID Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add the **Redirect URI** for your Landscape version: - For Landscape 26.04 LTS, add a **Redirect URI** of type `Strict` `Authorization` as `https://landscape.company/new_dashboard/handle-auth/oidc`. - For Landscape 24.04 LTS and Landscape 23.03 ESM, add a **Redirect URI** of type `Strict` `Authorization` as `https://landscape.company/login/handle-openid`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Landscape configuration On the Landscape server, edit `/etc/landscape/service.conf` and add the OIDC configuration for your Landscape version. Add the following configuration under the `[appserver]` section: ```ini title="/etc/landscape/service.conf" [appserver] oidc_issuer = https://authentik.company/application/o// oidc_client_id = oidc_client_secret = ``` Add the following configuration under the `[landscape]` section: ```ini title="/etc/landscape/service.conf" [landscape] oidc-issuer = https://authentik.company/application/o// oidc-client-id = oidc-client-secret = ``` After making these changes, restart the Landscape services: ```shell sudo lsctl restart ``` ## Configuration verification To confirm that authentik is properly configured with Landscape, open Landscape and sign in with OpenID Connect. After the authentik login flow completes, verify that the invited user can access Landscape with the expected Landscape role. ## Resources - [Canonical Landscape documentation - How to enable OIDC authentication](https://documentation.ubuntu.com/landscape/how-to-guides/external-authentication/openid-connect-oidc/) - [Canonical Landscape documentation - The service.conf file](https://documentation.ubuntu.com/landscape/reference/config/service-conf/) --- ## Integrate with Uptime Kuma ## What is Uptime Kuma? > Uptime Kuma is an easy-to-use self-hosted monitoring tool. > > \-- [https://uptime.kuma.pet/](https://uptime.kuma.pet/) Uptime Kuma does not provide native SSO for its web UI. Use authentik as a reverse proxy in front of Uptime Kuma, and disable Uptime Kuma's built-in authentication so authentik controls access to the dashboard. ## Preparation The following placeholders are used in this guide: - `uptime-kuma.company` is the FQDN of the Uptime Kuma installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Uptime Kuma with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **Proxy Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **External host** to `https://uptime-kuma.company`. - Set **Internal host** to `http://uptime-kuma:3001`, where `uptime-kuma:3001` is the hostname and port of your Uptime Kuma instance as reached by the authentik proxy outpost. - Under **Advanced protocol settings**, set **Unauthenticated Paths** to the following value to allow unauthenticated access to public status pages, badges, push monitor endpoints, and their static assets: ```text ^/status(/.*)?$ ^/status-page$ ^/assets/.* ^/api/push/.* ^/api/badge/.* ^/api/status-page/.* ^/icon.svg$ ^/upload/.* ``` For more granular access, replace the broad status page and upload expressions with expressions that match only the published status page slug and uploaded files that should be public: ```text ^/status/$ ^/assets/.* ^/api/push/.* ^/api/badge/.* ^/api/status-page/$ ^/api/status-page/heartbeat/$ ^/api/status-page//manifest.json$ ^/api/status-page//incident-history$ ^/api/status-page//badge$ ^/icon.svg$ ^/upload/$ ``` - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Configure proxy outpost The proxy provider requires an authentik proxy outpost. If you do not already have a proxy outpost, follow the [outpost documentation](/docs/add-secure-apps/outposts/) to create and deploy one. Add the Uptime Kuma application to a proxy outpost that will serve it: 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Outposts**. 3. Click the edit icon for the proxy outpost. This can be the built-in **authentik Embedded Outpost** or another proxy outpost. 4. Under **Available Applications**, select the Uptime Kuma application and move it to **Selected Applications**. 5. Click **Update** to save your changes. ## Uptime Kuma configuration Disable Uptime Kuma's built-in authentication: 1. Log in to Uptime Kuma with the local administrator account. 2. Navigate to **Settings** > **Security**. 3. Under **Advanced**, click **Disable Auth**. 4. Confirm the change with the current password. If Uptime Kuma is only reachable through the authentik proxy outpost, navigate to **Settings** > **Reverse Proxy** and set **Trust Proxy** to **Yes**. ## Configuration verification To verify the login flow, open Uptime Kuma. You should be redirected to authentik before the Uptime Kuma dashboard is shown. To verify public status pages, open a published Uptime Kuma status page in a private browser window. The status page should load without an authentik login prompt, while the dashboard should still require authentik authentication. ## Resources - [Uptime Kuma - GitHub repository](https://github.com/louislam/uptime-kuma) - [Uptime Kuma Wiki - Reverse Proxy](https://github.com/louislam/uptime-kuma/wiki/Reverse-Proxy) - [Uptime Kuma Wiki - Internal API](https://github.com/louislam/uptime-kuma/wiki/Internal-API) --- ## Integrate with Wazuh ## What is Wazuh? > Wazuh is an open source security platform that provides unified threat detection and response for endpoints and cloud workloads. > > \-- [https://wazuh.com/](https://wazuh.com/) ## Preparation The following placeholders are used in this guide: - `wazuh-dashboard.company` is the FQDN of the Wazuh Dashboard installation. - `wazuh-indexer.company` is the FQDN of the Wazuh Indexer installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Wazuh with authentik, you need to create a group, a property mapping, and an application/provider pair in authentik. ### Create a user group in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups** and click **Create**. 3. Set a name for the group, such as `wazuh-administrators`, and click **Create**. 4. Click the name of the newly created group and navigate to the **Users** tab. 5. Click **Add existing user**, select the users that need Wazuh administrator access, and click **Add**. ### Create a property mapping 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Create a **SAML Provider Property Mapping** with the following settings: - **Name**: choose a descriptive name, such as `Wazuh roles`. - **SAML Attribute Name**: `Roles`. - **Expression**: change `wazuh-administrators` to the authentik group name that should receive administrator access in Wazuh. ```python if ak_is_group_member(request.user, name="wazuh-administrators"): yield "wazuh-admin" ``` The yielded value, `wazuh-admin`, is the backend role that Wazuh evaluates later. To map additional Wazuh roles, add more group checks that yield different backend role values. 4. Click **Finish**. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://wazuh-dashboard.company/_opendistro/_security/saml/acs`. - Set the **Audience** to `wazuh-saml`. - Set the **SLS URL** to `https://wazuh-dashboard.company/_opendistro/_security/saml/logout`. - Set the **SLS Binding** to `Redirect`. - Set the **Logout Method** to `Front-channel (Iframe)`. - Under **Advanced protocol settings**: - Select a **Signing Certificate**. If you do not already have one, create it under **System** > **Certificates** before configuring the provider. - Set **NameID Property Mapping** to the property mapping that Wazuh should use for usernames, such as `authentik default SAML Mapping: Name` or `authentik default SAML Mapping: Email`. - Add the Wazuh roles property mapping that you created earlier. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the provider metadata 1. Navigate to **Applications** > **Providers** and open the SAML provider that you created in the previous section. 2. Open the **Metadata** tab. 3. Under **SAML Metadata**, click **Download**. Save the file as `wazuh_authentik_meta.xml`; this metadata file is required in the next section. ## Wazuh configuration To support the integration of authentik with Wazuh, you need to configure SAML authentication on the Wazuh Indexer server and create role mappings on the Wazuh Dashboard server. ### Configure SAML on the Wazuh Indexer server Back up the Wazuh Indexer security configuration before changing it. 1. Generate a 64-character exchange key: ```bash openssl rand -hex 32 ``` The output is the `exchange_key` value that you will use in `/etc/wazuh-indexer/opensearch-security/config.yml`. 2. Copy the downloaded `wazuh_authentik_meta.xml` file to the `/etc/wazuh-indexer/opensearch-security/` directory on your Wazuh Indexer server. 3. Change ownership of the metadata file: ```bash sudo chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/wazuh_authentik_meta.xml ``` 4. Edit `/etc/wazuh-indexer/opensearch-security/config.yml`. Set `order` to `0` and `challenge` to `false` in the existing `basic_internal_auth_domain` section, then add a `saml_auth_domain` section under `authc`: ```yaml {7,10,13-30} showLineNumbers title="/etc/wazuh-indexer/opensearch-security/config.yml" --- authc: basic_internal_auth_domain: description: "Authenticate via HTTP Basic against internal users database" http_enabled: true transport_enabled: true order: 0 http_authenticator: type: "basic" challenge: false authentication_backend: type: "intern" saml_auth_domain: http_enabled: true transport_enabled: false order: 1 http_authenticator: type: saml challenge: true config: idp: metadata_file: "/etc/wazuh-indexer/opensearch-security/wazuh_authentik_meta.xml" entity_id: "https://authentik.company/application/saml//metadata/" sp: entity_id: "wazuh-saml" kibana_url: "https://wazuh-dashboard.company/" roles_key: Roles exchange_key: "" authentication_backend: type: noop ``` 5. Run the `securityadmin.sh` script to load the configuration changes. Update the `-h` value to your Wazuh Indexer FQDN: ```bash sudo env JAVA_HOME=/usr/share/wazuh-indexer/jdk/ bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h wazuh-indexer.company -nhnv ``` 6. Edit `/etc/wazuh-indexer/opensearch-security/roles_mapping.yml` and include `wazuh-admin` as a `backend_role` in the appropriate section. The following example maps `wazuh-admin` to the `all_access` role: ```yaml showLineNumbers {5} title="/etc/wazuh-indexer/opensearch-security/roles_mapping.yml" all_access: reserved: true hidden: false backend_roles: - "wazuh-admin" - "admin" hosts: [] users: [] and_backend_roles: [] description: "Maps admin to all_access" ``` 7. Run the `securityadmin.sh` script again, with the `-f` value set to `/etc/wazuh-indexer/opensearch-security/roles_mapping.yml`. Update the `-h` value to your Wazuh Indexer FQDN: ```bash sudo env JAVA_HOME=/usr/share/wazuh-indexer/jdk/ bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h wazuh-indexer.company -nhnv ``` ### Configure the Wazuh Dashboard server 1. On the Wazuh Dashboard server, check the value of `run_as` in the `/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml` configuration file: ```yaml showLineNumbers {8} title="/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml" hosts: - default: url: https://127.0.0.1 port: 55000 username: wazuh-wui password: "" run_as: false ``` When `run_as` is set to `true`, Wazuh uses authorization context information to assign roles to users. If `run_as` is set to `false`, proceed to step 4. If `run_as` is set to `true`, proceed with the following steps to add a role mapping on the Wazuh dashboard. 2. On the Wazuh dashboard, click the upper-left menu icon ☰ to open the menu, then go to **Server management** > **Security** > **Roles mapping**. 3. Click **Create Role mapping** and configure the following parameters: - **Role Name**: set a name for the role mapping, such as `authentik_admins`. - **Roles**: select a role, such as `administrator`. - **Custom rules**: click **Add new rule** and set: - **User field**: `backend_roles` - **Search operation**: `FIND` - **Value**: `wazuh-admin` Click **Save role mapping**. 4. On the Wazuh Dashboard server, add the SAML settings to `/etc/wazuh-dashboard/opensearch_dashboards.yml`. If `opensearch_security.session.keepalive` already exists in your configuration, change it to `false`. ```yaml showLineNumbers title="/etc/wazuh-dashboard/opensearch_dashboards.yml" opensearch_security.auth.type: "saml" server.xsrf.allowlist: [ "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated", ] opensearch_security.session.keepalive: false ``` Use this configuration block instead if you want to keep both username/password authentication and SAML SSO enabled: ```yaml showLineNumbers title="/etc/wazuh-dashboard/opensearch_dashboards.yml" opensearch_security.auth.type: ["basicauth", "saml"] opensearch_security.auth.multiple_auth_enabled: true server.xsrf.allowlist: [ "/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated", ] opensearch_security.session.keepalive: false ``` 5. Restart the Wazuh dashboard service using the following command: ```bash sudo systemctl restart wazuh-dashboard ``` ## Configuration verification To confirm that authentik is properly configured with Wazuh, open Wazuh and log in using an account that is a member of the appropriate authentik group, such as `wazuh-administrators`. ## Resources - [Wazuh documentation - authentik SSO](https://documentation.wazuh.com/current/user-manual/user-administration/single-sign-on/authentik.html) - [Wazuh documentation - Wazuh RBAC](https://documentation.wazuh.com/current/user-manual/user-administration/rbac.html) - [Wazuh documentation - Authorization context](https://documentation.wazuh.com/current/user-manual/api/rbac/auth-context.html) --- ## Integrate with What's Up Docker ## What is What's Up Docker? > What's Up Docker (WUD) is an easy-to-use tool that alerts you whenever a new version of your Docker containers is released. > > \-- [https://getwud.github.io/wud/](https://getwud.github.io/wud/) ## Preparation The following placeholders are used in this guide: - `wud.company` is the FQDN of the WUD installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of What's Up Docker with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring What's Up Docker. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://wud.company/auth/oidc/authentik/cb`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## What's Up Docker configuration To configure What's Up Docker to use authentik for SSO, add the following values to your `.env` file: ```env title=".env" WUD_AUTH_OIDC_AUTHENTIK_CLIENTID= WUD_AUTH_OIDC_AUTHENTIK_CLIENTSECRET= WUD_AUTH_OIDC_AUTHENTIK_DISCOVERY=https://authentik.company/application/o//.well-known/openid-configuration WUD_AUTH_OIDC_AUTHENTIK_REDIRECT=true ``` The `AUTHENTIK` part of the variable names defines the WUD OIDC authentication name and must match the `authentik` segment of the redirect URI. After making these changes, restart your WUD container to apply the new configuration. If WUD cannot determine its public URL from your reverse proxy headers, set `WUD_PUBLIC_URL` to `https://wud.company`. ## Configuration verification To confirm that authentik is properly configured with What's Up Docker, open the integration and verify that you are redirected to authentik. If `WUD_AUTH_OIDC_AUTHENTIK_REDIRECT` is not enabled, click **Connect** on the WUD login page. ## Resources - [WUD documentation for OpenID Connect authentication](https://getwud.github.io/wud/#/configuration/authentications/oidc/) --- ## Integrate with Zabbix ## What is Zabbix? > Zabbix is an enterprise-class open source observability solution. > > \-- [https://www.zabbix.com](https://www.zabbix.com) ## Preparation The following placeholders are used in this guide: - `zabbix.company` is the FQDN of the Zabbix installation. - `authentik.company` is the FQDN of the authentik installation. This guide assumes that the Zabbix frontend is available at `https://zabbix.company/zabbix`. If your Zabbix frontend uses a different path, adjust every Zabbix URL in this guide to match your public frontend URL. Zabbix requires `php-openssl` for SAML authentication. You also need access to the Zabbix frontend `conf/certs` directory to add the authentik signing certificate. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Zabbix with authentik, you need to create an application/provider pair in authentik. If you want Zabbix to create users during their first SAML login (JIT provisioning), you also need to create SAML property mappings for users' given names and surnames. ### Create JIT property mappings in authentik *(optional)* 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings**, click **Create**, select **SAML Provider Property Mappings**, and click **Next**. 3. Configure the first mapping for the user's given name: - **Name**: `givenname` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname` - **Friendly Name**: Leave blank - **Expression**: ```python return request.user.name.split(" ", 1)[0] ``` 4. Click **Finish** to save the mapping. 5. Repeat the process to create a mapping for the user's surname: - **Name**: `surname` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname` - **Friendly Name**: Leave blank - **Expression**: ```python return request.user.name.rsplit(" ", 1)[-1] ``` 6. Click **Finish**. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring Zabbix. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **ACS URL**: `https://zabbix.company/zabbix/index_sso.php?acs` - **Audience**: `https://zabbix.company/zabbix` - **SLS URL**: `https://zabbix.company/zabbix/index_sso.php?sls` - **SLS Binding**: `Redirect` - **Logout Method**: `Front-channel (Iframe)` - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - If you want to use Zabbix JIT provisioning, under **Property mappings**, add the `givenname` and `surname` mappings that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and open the provider that you created. 2. Under **Related objects** > **Download signing certificate**, click **Download**. 3. Save the downloaded certificate as `idp.crt` in the Zabbix frontend `conf/certs` directory, for example `/usr/share/zabbix/conf/certs/idp.crt`. ## Zabbix configuration 1. Log in to Zabbix as an administrator. 2. Navigate to **Users** > **Authentication**, then select the **SAML settings** tab. 3. Enable SAML authentication. 4. Configure the following fields: - **IdP entity ID**: `https://authentik.company/application/saml//metadata/` - **SSO service URL**: `https://authentik.company/application/saml//` - **SLO service URL**: `https://authentik.company/application/saml//` - **Username attribute**: `http://schemas.goauthentik.io/2021/02/saml/username` - **SP entity ID**: `https://zabbix.company/zabbix` - **SP name ID format**: `urn:oasis:names:tc:SAML:2.0:nameid-format:transient` 5. Click **Update** to save the configuration. ### Enable JIT provisioning *(optional)* To provision Zabbix users during their first SAML login, create the required Zabbix user groups and user roles before enabling JIT provisioning. Create one or more Zabbix user groups and user roles whose combinations match the authentik groups that should have access to Zabbix. If you do not want to use the Zabbix `disabled` group for deprovisioned users, create a dedicated disabled Zabbix user group before continuing. 1. Navigate to **Users** > **Authentication**, then select the **Authentication** tab. 2. Set **Deprovisioned users group** to `disabled`, or to the disabled Zabbix user group that you created for deprovisioned users. 3. Select the **SAML settings** tab. 4. Enable **Enable JIT provisioning** and **Configure JIT provisioning**. 5. Configure the following JIT fields: - **Group name attribute**: `http://schemas.xmlsoap.org/claims/Group` - **User name attribute**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname` - **User last name attribute**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname` 6. Under **User group mapping**, click **Add** and configure a mapping: - **SAML group pattern**: enter the name of the authentik group to map. - **User groups**: select the Zabbix user groups that members of the authentik group should receive. - **User role**: select the Zabbix user role that members of the authentik group should receive. 7. Click **Add** to save the mapping, then repeat the previous step for each authentik group that you want to map to Zabbix user groups and roles. 8. Under **Media type mapping**, click **Add** and configure the email mapping: - **Name**: `Email` - **Media type**: select `Email` or `Email (HTML)`. - **Attribute**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` 9. Click **Add** to save the media type mapping. 10. Click **Update** to save the SAML settings. ### Sign Zabbix authentication requests To have Zabbix sign SAML AuthN requests, generate a certificate and private key for Zabbix: ```bash openssl req -new -x509 -days 3650 -nodes \ -subj "/CN=zabbix.company" \ -keyout sp.key -out sp.crt ``` Copy `sp.key` and `sp.crt` to the Zabbix frontend `conf/certs` directory, then enable **Sign** > **AuthN requests** in the Zabbix SAML settings. To make authentik require this signature, upload `sp.crt` in authentik under **System** > **Certificates**, then edit the Zabbix SAML provider and select that certificate as the **Verification Certificate**. ### Configure reverse proxy deployments If Zabbix is behind an HTTPS-terminating reverse proxy and SAML requests are generated with an internal HTTP URL, configure the Zabbix frontend with the public base URL: ```php title="conf/zabbix.conf.php" $SSO['SETTINGS'] = [ 'strict' => false, 'baseurl' => 'https://zabbix.company/zabbix/', 'use_proxy_headers' => true ]; ``` ## Configuration verification To confirm that authentik is properly configured with Zabbix, log out of Zabbix and click **Sign in with Single Sign-On (SAML)**. You should be redirected to authentik to log in, then redirected back to Zabbix. ## Resources - [Zabbix SAML authentication documentation](https://www.zabbix.com/documentation/current/en/manual/web_interface/frontend_sections/users/authentication/saml) - [Zabbix authentication documentation](https://www.zabbix.com/documentation/current/en/manual/web_interface/frontend_sections/users/authentication) - [Zabbix SAML setup with Microsoft Entra ID](https://www.zabbix.com/documentation/current/en/manual/appendix/install/azure_ad) --- ## Integrate with Aruba Orchestrator ## What is Aruba Orchestrator? > Aruba Orchestrator, part of HPE Aruba Networking EdgeConnect SD-WAN, provides centralized management, monitoring, and orchestration for EdgeConnect appliances and SD-WAN fabrics. > > \-- [https://www.hpe.com/us/en/aruba-edgeconnect-sd-wan.html](https://www.hpe.com/us/en/aruba-edgeconnect-sd-wan.html) ## Preparation The following placeholders are used in this guide: - `arubaorchestrator.company` is the FQDN of the Aruba Orchestrator installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Aruba Orchestrator with authentik, you need to create a SAML property mapping, an application/provider pair, and application entitlements for the Orchestrator RBAC roles users should receive. Aruba Orchestrator requires either a role attribute or a default role for SAML users. This guide sends assigned authentik application entitlement names in the `sp-roles` SAML attribute. ### Create property mappings 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **SAML Provider Property Mapping** with the following settings: - **Name**: provide a descriptive name, such as `Aruba Orchestrator roles`. - **SAML Attribute Name**: `sp-roles` - **Expression**: ```python roles = [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ] return roles if roles else None ``` ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://arubaorchestrator.company/gms/rest/authentication/saml2/consume`. - Set the **Audience** to `https://arubaorchestrator.company/gms/rest/authentication/saml2/consume`. - Set the **SLS URL** to`https://arubaorchestrator.company/gms/rest/authentication/saml2/logout`. - Set the **SLS Binding** to `Redirect`. - Set the **Logout Method** to `Front-channel (Iframe)`. - Under **Advanced protocol settings**, select an available **Signing certificate**. - Under **Advanced protocol settings** > **Property mappings**, add the newly created property mapping. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Navigate to **Applications** > **Providers**, open the provider you created, and download the signing certificate. ### Create application entitlements Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the Orchestrator RBAC roles that this application should assign. 1. Open the Aruba Orchestrator application that you just created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each Orchestrator RBAC role that users should be able to receive, such as `SuperAdmin`, `Monitor`, or a custom Orchestrator role name. 4. Bind the appropriate users or groups to each entitlement. Each entitlement name must exactly match the Orchestrator RBAC role value. These values are case-sensitive. ## Aruba Orchestrator configuration 1. Log in to the Aruba Orchestrator. 2. Navigate to **Orchestrator** > **Orchestrator Server** > **Users & Authentication** > **Authentication** and click **+Add New Server**. 3. Select `SAML` as the server type and configure the following values: - **Name**: `authentik` - **Username Attribute**: `http://schemas.goauthentik.io/2021/02/saml/username` - **Issuer URL**: `https://authentik.company/application/saml//metadata/` - **SSO Endpoint**: `https://authentik.company/application/saml//init/` - **IdP X.509 Cert**: paste the downloaded signing certificate. - **Roles Attribute**: `sp-roles` 4. If you do not assign application entitlements for every user who can access Orchestrator, set **Default role** to the fallback RBAC role users should receive. 5. Click **Save**. The **ACS URL** and **EdgeConnect SLO Endpoint** fields are generated by Aruba Orchestrator. For self-hosted Orchestrator deployments, ensure these URLs use the public Orchestrator FQDN or public IP address that authentik can reach. ## Configuration verification To confirm that authentik is properly configured with Aruba Orchestrator, open Aruba Orchestrator and click **Log In Using authentik** on the login screen. ## Resources - [HPE Aruba Networking EdgeConnect SD-WAN Orchestrator authentication documentation](https://arubanetworking.hpe.com/techdocs/sdwan/docs/orch/orchestrator/server/remote-auth/) - [HPE Aruba Networking EdgeConnect SD-WAN Orchestrator RBAC documentation](https://arubanetworking.hpe.com/techdocs/sdwan/docs/orch/orchestrator/server/rbac/) --- ## Integrate with Cisco Secure Firewall Management Center ## What is Cisco Secure Firewall Management Center? > Cisco Secure Firewall Management Center (FMC) centralizes management for Cisco Secure Firewall policies, events, intrusion prevention, URL filtering, and malware protection. > > \-- [https://www.cisco.com/site/us/en/products/security/firewalls/secure-firewall-management-center/index.html](https://www.cisco.com/site/us/en/products/security/firewalls/secure-firewall-management-center/index.html) ## Preparation The following placeholders are used in this guide: - `fmc.company` is the FQDN of the Cisco FMC. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This guide was tested with Cisco Secure Firewall Management Center 7.6.5. ## authentik configuration To support the integration of Cisco Secure Firewall Management Center with authentik, you need to create an application/provider pair in authentik. Cisco FMC requires the SAML NameID and SSO account usernames to be valid email addresses. Ensure that each authentik user who signs in to Cisco FMC has an email address. ### Create a role mapping property mapping *(optional)* If you want Cisco FMC to assign user roles from SAML attributes, create a SAML property mapping that sends this application's entitlements to Cisco FMC. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `Cisco FMC roles` - **SAML Attribute Name**: `fmc_roles` - **Expression**: ```python return [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ] ``` 5. Click **Finish** to save the property mapping. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring Cisco FMC. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://fmc.company/saml/acs`. - Set the **Audience** to `https://fmc.company/saml/metadata`. - Under **Advanced protocol settings**: - Set the **Signing Certificate** to the certificate authentik should use to sign SAML responses. - Enable **Sign responses**. - Set the **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - If you created the optional role mapping property mapping, add `Cisco FMC roles` to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements *(optional)* Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the Cisco FMC role assignment values that this application should send. 1. Open the Cisco FMC application that you created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each Cisco FMC role assignment value that users should be able to receive, such as `FMC-Administrator`. 4. Open each entitlement and bind the users or groups that should receive it. ### Download the signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the Cisco FMC provider. 3. Click **Download** under **Download signing certificate**. You will import this certificate into Cisco FMC. ## Cisco Secure Firewall Management Center configuration 1. Log in to the Cisco Secure Firewall Management Center web interface as an administrator. 2. Click the **gear icon** in the upper-right corner and choose **Users**. 3. Click the **Single Sign-On (SSO)** tab. 4. Click the toggle button to enable SSO. 5. Under **Select the SAML provider**, select `Other`, then click **Next**. 6. Configure the **Identity Provider (IdP) Settings**: - **Identity Provider Single Sign-On (SSO) URL**: enter the **SAML Endpoint** from the authentik SAML provider, such as `https://authentik.company/application/saml//`. - **Identity Provider Issuer**: enter the **EntityID/Issuer** from the authentik SAML provider, such as `https://authentik.company/application/saml//metadata/`. - **X.509 Certificate**: paste the contents of the signing certificate that you downloaded from authentik. 7. Under **Advanced Configuration (Role Mapping)**, review the **Default User Role**. Cisco FMC assigns this role to SSO users that do not match a role mapping. 8. If you configured the optional `Cisco FMC roles` property mapping in authentik, set **Group Member Attribute** to `fmc_roles`, and then enter a regular expression for each Cisco FMC user role that should match an entitlement value, such as `^FMC-Administrator$`. 9. Click **Next**. 10. Click **Save** to apply the configuration. ## Configuration verification To confirm that authentik is properly configured with Cisco Secure Firewall Management Center, navigate to your FMC login page and select the SSO login option. Complete the authentik sign-in flow. After authentication, FMC should redirect you back and grant access to the management interface. ## Resources - [Cisco Secure Firewall Management Center Administration Guide - SAML single sign-on](https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/760/management-center-admin-76/system-users.html#Configure_SAML_Single_SignOn_) --- ## Integrate with Firezone ## What is Firezone? > Firezone is an open-source remote access platform built on WireGuard®, a modern VPN protocol that's 4-6x faster than OpenVPN. > > \-- [https://www.firezone.dev](https://www.firezone.dev) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Firezone with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://app.firezone.dev/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Firezone configuration 1. Log in to the Firezone admin portal as an administrator. 2. Navigate to **Settings** > **Authentication**. 3. Click **Add Provider** and select **OIDC**. 4. Configure the provider with the following values: - **Name**: enter a descriptive name, such as `authentik`. This name is shown to users on the sign-in page. - **Authentication Context**: select where users should be able to sign in with authentik. - **Discovery Document URI**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Client ID**: enter the client ID from authentik. - **Client Secret**: enter the client secret from authentik. - **Email Verification**: select **Proof**. 5. Confirm that the **Redirect URI** shown by Firezone is `https://app.firezone.dev/auth/oidc/callback`. 6. Click **Verify Now** and complete the authentication flow with authentik. 7. After Firezone shows the provider as verified, click **Save**. Firezone's universal OIDC provider does not sync users or groups. Create users in Firezone before they sign in with authentik, and create any groups that you need for Firezone access policies. ## Configuration verification To verify that authentik is correctly integrated with Firezone, open Firezone and sign in with the authentik provider. A successful login redirects you back to Firezone. ## Resources - [Firezone Docs - SSO with OpenID Connect](https://www.firezone.dev/kb/authenticate/oidc) - [Firezone Docs - Create Users](https://www.firezone.dev/kb/deploy/users) - [Firezone Docs - Create Groups](https://www.firezone.dev/kb/deploy/groups) --- ## Integrate with FortiGate Admin Login ## What is FortiGate? > FortiGate is Fortinet's next-generation firewall. FortiGate firewalls provide security services such as application control, intrusion prevention, web filtering, and VPN access. > > \-- [https://www.fortinet.com/products/next-generation-firewall](https://www.fortinet.com/products/next-generation-firewall) ## Preparation The following placeholders are used in this guide: - `fortigate.company` is the FQDN of the FortiGate installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of FortiGate Admin Login with authentik, you need to create a SAML property mapping and an application/provider pair in authentik. ### Create a property mapping FortiGate expects a SAML attribute named `username` that contains the FortiGate administrator username. This example uses the authentik username, but you can return any user attribute that matches the FortiGate administrator account name. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `FortiGate username` - **SAML Attribute Name**: `username` - **Expression**: ```python return request.user.username ``` 5. Click **Finish** to save the property mapping. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring FortiGate. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://fortigate.company/saml/?acs`. - Set the **Audience** to `https://fortigate.company/metadata/`. - Set the **SLS URL** to `https://fortigate.company/saml/?sls`. - Under **Advanced protocol settings**: - Set the **Signing Certificate** to the certificate authentik should use to sign SAML responses. - Enable **Sign responses**. - Add `FortiGate username` to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the FortiGate Admin Login provider. 3. Click **Download** under **Download signing certificate**. You will import this certificate into FortiGate. ## FortiGate configuration ### Import the authentik signing certificate 1. Log in to the FortiGate administrative interface. 2. Navigate to **System** > **Certificates**. 3. Select **Create/Import** > **Remote Certificate**. 4. Upload the authentik signing certificate you downloaded earlier. 5. Note the certificate name that FortiGate assigns to the imported certificate. ### Configure SAML single sign-on 1. Navigate to **Security Fabric** > **Fabric Connectors**. 2. Open **Security Fabric Setup** and then open **Single Sign-On Settings**. 3. Enable **Service Provider (SP)** mode. 4. Configure the **SP settings**: - **SP Address**: `fortigate.company` - **Default login page**: select **Normal** while testing the integration. After SAML authentication is working, you can select **Single Sign-On** if FortiGate should redirect directly to authentik. - **Default admin profile**: select the administrator profile FortiGate should assign to SAML administrators created on first login. To require manual profile assignment before a new SAML administrator can access FortiGate, select `admin_no_access`. 5. Configure the **IdP Details**: - **IdP Type**: `Custom` - **IdP entity ID**: `https://authentik.company/application/saml//metadata/` - **IdP single sign-on URL**: `https://authentik.company/application/saml//` - **IdP single logout URL**: `https://authentik.company/application/saml//` - **IdP Certificate**: select the authentik signing certificate that you imported earlier. 6. Click **Apply** to save the configuration. If your FortiGate web administration interface uses a non-standard HTTPS port, include the port in **SP Address** and in the authentik **ACS URL** and **SLS URL**. ### Confirm the SP details FortiGate shows its **SP entity ID**, **SP ACS URL**, and **SP SLS URL** after you configure the **SP Address**. Confirm that these values match the **Audience**, **ACS URL**, and **SLS URL** values in the authentik provider. If FortiGate shows a different **SP entity ID**, update the authentik provider **Audience** value to match FortiGate exactly. ### Recovery and debugging If SAML is set as the default login method and SAML authentication is not working, open `https://fortigate.company/saml/?acs` and select **Login Locally**, or use the FortiGate CLI to restore the normal login page: ```text config system saml set default-login-page normal end ``` To enable SAML debug logging, run the following commands and then repeat the login attempt: ```text diagnose debug console timestamp enable diagnose debug application httpsd -1 diagnose debug application samld -1 diagnose debug enable ``` When you are finished debugging, disable debug logging: ```text diagnose debug disable diagnose debug reset ``` ## Configuration verification To confirm that authentik is properly configured with FortiGate Admin Login, open FortiGate and sign in via authentik. ## Resources - [Fortinet - Configuring SAML SSO](https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/254248/configuring-saml-sso) - [Fortinet Community - Configuring SAML SSO login for FortiGate administrators with Entra ID acting as SAML IdP](https://community.fortinet.com/fortigate-3/technical-tip-configuring-saml-sso-login-for-fortigate-administrators-with-entra-id-acting-as-saml-idp-96661) - [Fortinet Community - Configuring SAML SSO login for FortiGate administrators with Okta acting as SAML IdP](https://community.fortinet.com/fortigate-3/technical-tip-configuring-saml-sso-login-for-fortigate-administrators-with-okta-acting-as-saml-idp-97935) --- ## Integrate with FortiGate SSL VPN ## What is FortiGate SSL VPN? > FortiGate is Fortinet's next-generation firewall. Its SSL VPN feature lets remote users connect to protected network resources through a FortiGate firewall. > > \-- [https://www.fortinet.com/products/next-generation-firewall](https://www.fortinet.com/products/next-generation-firewall) ## Preparation The following placeholders are used in this guide: - `fortigate.company` is the FQDN of your FortiGate SSL VPN. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ### Prerequisites - A working FortiGate SSL VPN configuration. - A FortiGate local certificate to use for the SAML service provider (SP). - An authentik certificate to use for signing SAML responses. ## authentik configuration To support the integration of FortiGate SSL VPN with authentik, you need to create an application/provider pair in authentik. ### Create a user group 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups** and click **Create**. 3. Set a descriptive name for the group, for example `FortiGate SSL VPN Users`. 4. Add the users who should have access to FortiGate SSL VPN. 5. Click **Save**. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://fortigate.company/remote/saml/login`. - Set the **Audience** to `https://fortigate.company/remote/saml/metadata`. - Set the **SLS URL** to `https://fortigate.company/remote/saml/logout`. - Under **Advanced protocol settings**: - Set **Signing Certificate** to the certificate authentik should use to sign SAML responses. - Enable **Sign responses**. - **Configure Bindings**: create a [binding](/docs/add-secure-apps/bindings-overview/) to the FortiGate SSL VPN user group. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the FortiGate SSL VPN provider. 3. Click **Download** under **Download signing certificate**. You will import this certificate into FortiGate. ## FortiGate configuration ### Import the authentik signing certificate 1. Log in to the FortiGate administrative interface. 2. Navigate to **System** > **Certificates**. 3. Select **Create/Import** > **Remote Certificate**. 4. Upload the authentik signing certificate you downloaded earlier. 5. Note the certificate name that FortiGate assigns to the imported certificate. ### Create the SAML single sign-on server SSH into FortiGate and run the following commands, replacing `authentik-signing-certificate` with the imported authentik certificate name and `Fortinet_Factory` with the FortiGate local certificate that FortiGate should use as the SP certificate. ```text config user saml edit "authentik-sso" set cert "" set entity-id "https://fortigate.company/remote/saml/metadata" set single-sign-on-url "https://fortigate.company/remote/saml/login" set single-logout-url "https://fortigate.company/remote/saml/logout" set idp-entity-id "https://authentik.company/application/saml//metadata/" set idp-single-sign-on-url "https://authentik.company/application/saml//" set idp-single-logout-url "https://authentik.company/application/saml//" set idp-cert "authentik-signing-certificate" set user-name "http://schemas.goauthentik.io/2021/02/saml/username" set group-name "http://schemas.xmlsoap.org/claims/Group" set digest-method sha256 next end ``` ### Create the FortiGate user group Run the following commands, replacing `FortiGate SSL VPN Users` with the exact name of the authentik group whose members should have VPN access. ```text config user group edit "sslvpn-users" set member "authentik-sso" config match edit 1 set server-name "authentik-sso" set group-name "FortiGate SSL VPN Users" next end next end ``` ### Add the group to SSL VPN 1. In the FortiGate administrative interface, navigate to **VPN** > **SSL-VPN Settings**. 2. In the **Authentication/Portal Mapping** table, create a mapping for the `sslvpn-users` group and select the SSL VPN portal that group should use. 3. Apply your changes. 4. Ensure that the SSL VPN firewall policy includes the `sslvpn-users` group. If users are redirected back to authentik with an immediate logout after authentication, confirm that the FortiGate user group is mapped to an SSL VPN portal and included in the relevant firewall policy. ## Configuration verification To confirm that authentik is properly configured with FortiGate SSL VPN, open the FortiGate SSL VPN portal. You should be redirected to authentik to authenticate, and then redirected back to the FortiGate SSL VPN portal. If you use FortiClient tunnel mode, enable **Enable Single Sign On (SSO) for VPN Tunnel** in the FortiClient SSL VPN connection settings. ## Troubleshooting To enable SAML debug logging in FortiGate, run the following commands: ```text diagnose debug console timestamp enable diagnose debug application samld -1 diagnose debug enable ``` Check that the `user-name` and `group-name` values in FortiGate exactly match the SAML attribute names sent by authentik, and that the FortiGate user group match uses the exact authentik group name. ## Resources - [Fortinet - Configuring SAML SSO](https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/254248/configuring-saml-sso) - [Fortinet - Configuring SAML SSO login for SSL VPN with Entra ID acting as SAML IdP](https://docs.fortinet.com/document/fortigate-public-cloud/8.0.0/azure-administration-guide/584456/configuring-saml-sso-login-for-ssl-vpn-with-entra-id-acting-as-saml-idp) - [Fortinet - Configuring SAML SSO in the GUI](https://docs.fortinet.com/document/fortigate/7.0.0/new-features/989067/configuring-saml-sso-in-the-gui-7-0-2) - [Fortinet - Remote certificate](https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/212403/remote-certificate) --- ## Integrate with FortiManager ## What is FortiManager? > FortiManager is an enterprise solution that enables centralized network management, ensures compliance with best practices, and automates workflows to enhance breach protection. > > \-- [https://www.fortinet.com/products/management/fortimanager](https://www.fortinet.com/products/management/fortimanager) ## Preparation The following placeholders are used in this guide: - `fortimanager.company` is the FQDN of the FortiManager installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of FortiManager with authentik, you need to create a SAML property mapping and an application/provider pair in authentik. ### Create a property mapping in authentik FortiManager expects a SAML attribute named `username` that contains the value used to identify the administrator account. This example uses the authentik username, but you can return any user attribute that matches the FortiManager administrator identifier. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `FortiManager username` - **SAML Attribute Name**: `username` - **Expression**: ```python return request.user.username ``` 5. Click **Finish** to save the property mapping. FortiManager also accepts `profilename` and `adoms` attributes. The `profilename` attribute assigns a matching admin profile that already exists on FortiManager. The `adoms` attribute grants access to one or more administrative domains (ADOMs). To use either attribute, create additional SAML provider property mappings with the corresponding **SAML Attribute Name**, return the desired values from the **Expression**, and add the mappings to **Selected User Property Mappings** when configuring the provider. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because you will use it when configuring FortiManager. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://fortimanager.company/saml/?acs`. - Set the **SLS URL** to `https://fortimanager.company/saml/?sls`. - Under **Advanced protocol settings**: - Set the **Signing Certificate** to any available certificate. - Add `FortiManager username` to **Selected User Property Mappings**. - Set the **NameID Property Mapping** to `authentik default SAML Mapping: Username`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## FortiManager configuration 1. Log in to the FortiManager web interface as an administrator. 2. Navigate to **System Settings** > **SAML SSO**. 3. Configure the **Single Sign-On Settings**: - **Server Address**: `fortimanager.company` - **Single Sign-On Mode**: `Service Provider (SP)` - **SP Certificate**: select an available certificate. - **Default Login Page**: select whether FortiManager should show the normal login page with an SSO option, or redirect directly to authentik. - **Auto Create Admin**: enable this setting if FortiManager should create SSO administrators on first login. If you leave it disabled, create matching SSO administrators in FortiManager before testing the integration. 4. Configure the **IdP Settings**: - **IdP Type**: `Custom` - **IdP Entity ID**: `https://authentik.company/application/saml//metadata/` - **IdP Login URL**: `https://authentik.company/application/saml//` - **IdP Logout URL**: `https://authentik.company/application/saml//` - **IdP Certificate**: import the signing certificate that you selected in the authentik SAML provider. You can download it from the authentik SAML provider page, under **Related objects** > **Download signing certificate**. 5. If you enabled any options under **Signing Options** in FortiManager, align them with the corresponding options under **Advanced protocol settings** in the authentik SAML provider. 6. Click **Apply** to save the configuration. With **Auto Create Admin** enabled, newly-created SSO administrators receive the configured default admin profile. If users should receive permissions through SAML attributes instead, create matching FortiManager admin profiles and administrative domains, and send the optional `profilename` and `adoms` attributes from authentik. ## Configuration verification To confirm that authentik is properly configured with FortiManager, open FortiManager and sign in via authentik. ## Resources - [FortiManager Administration Guide - SAML admin authentication](https://docs.fortinet.com/document/fortimanager/8.0.0/administration-guide/981386/saml-admin-authentication) - [FortiManager CLI Reference - SAML](https://docs.fortinet.com/document/fortimanager/8.0.0/cli-reference/91498/saml) --- ## Integrate with GlobalProtect ## What is GlobalProtect? > GlobalProtect simplifies remote access management with identity-aware authentication and client or clientless deployment methods for mobile users. > > \-- [https://www.paloaltonetworks.com/sase/globalprotect](https://www.paloaltonetworks.com/sase/globalprotect) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `gp.company` is the FQDN of the GlobalProtect portal or gateway that uses this provider. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. A trusted web certificate must be bound to the GlobalProtect portal. The certificate can be signed by a trusted internal root certificate authority (CA), but a self-signed, expired, or otherwise invalid portal certificate can cause SAML authentication to fail. ### Prerequisites - A working GlobalProtect portal and gateway configuration. - A certificate configured in authentik for signing SAML responses. - Administrative access to the Palo Alto Networks firewall or Panorama instance that manages GlobalProtect. ## authentik configuration To support the integration of GlobalProtect with authentik, you need to create an application/provider pair in authentik. If multiple GlobalProtect portals or gateways initiate SAML requests with different FQDNs, create a separate application/provider pair for each FQDN. Each provider must use the matching FQDN in the **ACS URL** and **Audience**. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://gp.company:443/SAML20/SP/ACS`. - Set the **Audience** to `https://gp.company:443/SAML20/SP`. - Under **Advanced protocol settings**, select an available **Signing Certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage access to the application. 3. Click **Submit** to save the new application and provider. If GlobalProtect uses a non-standard SAML port, replace `:443` in the **ACS URL** and **Audience** with the configured SAML port. Configure the same custom SAML port on the firewall. ### Download the SAML metadata 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the GlobalProtect provider. 3. Under **Metadata**, click **Download**. The metadata file is required in the GlobalProtect configuration. ## GlobalProtect configuration ### Create a SAML identity provider profile 1. Log in to the Palo Alto Networks firewall or Panorama instance that manages GlobalProtect. 2. Navigate to **Device** > **Server Profiles** > **SAML Identity Provider**. 3. Click **Import** and configure the profile: - **Profile Name**: provide a descriptive name, such as `authentik`. - **Identity Provider Metadata**: upload the metadata file you downloaded from authentik. - **Validate Identity Provider Certificate**: enable this if you have configured a certificate profile that trusts the CA which issued the authentik signing certificate. 4. Click **OK**. ### Create an authentication profile 1. Navigate to **Device** > **Authentication Profile** and click **Add**. 2. Configure the profile: - **Name**: provide a descriptive name. - **Type**: select **SAML**. - **IdP Server Profile**: select the SAML identity provider profile you created. - **Certificate for Signing Requests**: select a certificate only if authentik is configured to validate signed SAML requests. - **Certificate Profile**: select a certificate profile if you enabled **Validate Identity Provider Certificate** in the SAML identity provider profile. - **Username Attribute**: `http://schemas.goauthentik.io/2021/02/saml/username` 3. Open the **Advanced** tab and add `all` to **Allow List**. 4. Click **OK**. ### Assign the authentication profile 1. Navigate to **Network** > **GlobalProtect** > **Portals** and open the portal that should use SAML. 2. Open the portal authentication settings and select the authentication profile you created. 3. If you do not require a client certificate, select **Yes (User Credentials OR Client Certificate Required)**. 4. Navigate to **Network** > **GlobalProtect** > **Gateways** and make the same authentication profile change for each gateway that should use SAML. If a gateway uses a different FQDN in its SAML request, use an authentication profile connected to a matching authentik provider. 5. Commit the changes. ## Configuration verification To confirm that authentik is properly configured with GlobalProtect, open the GlobalProtect app or the GlobalProtect portal, connect to `gp.company`, and complete the authentik sign-in flow. After authentication, GlobalProtect should return to the portal or gateway and complete the connection. ## Resources - [Palo Alto Networks - Set Up SAML Authentication](https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-user-authentication/set-up-external-authentication/set-up-saml-authentication) - [Palo Alto Networks - Configure Mobile Users without Cloud Identity Engine](https://docs.paloaltonetworks.com/prisma-access/integration/microsoft-integrations-with-prisma-access/azure-ad-saml-authentication-for-mobile-user-deployments/configure-mobile-users-without-cloud-identity-engine) - [Palo Alto Networks - SAML Authentication for GlobalProtect Portals on Non-Standard Ports](https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-user-authentication/set-up-external-authentication/set-up-saml-authentication/saml-authentication-for-globalprotect-portals-on-non-standard-ports) --- ## Integrate with Gravity ## What is Gravity? > Gravity is a fully-replicated DNS, DHCP, and TFTP server powered by [etcd](https://etcd.io/), offering features like built-in caching, ad/privacy blocking, automatic DNS registration, and metric tracking. > > \-- [https://gravity.beryju.io/](https://gravity.beryju.io/) ## Preparation The following placeholders are used in this guide: - `gravity.company` is the FQDN of the Gravity installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Gravity automatically triggers SSO authentication when configured. To prevent this behavior, log in using the following URL: `https://gravity.company/ui/?local`. Gravity grants OIDC-authenticated users administrative access. Use authentik application bindings or policies to restrict which users can access Gravity. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Gravity with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, a slug, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value as it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://gravity.company/auth/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Gravity configuration 1. Log in to the Gravity administrative interface. 2. Navigate to **Cluster** > **Roles** and click **API**. 3. Under the **OIDC** section, configure the following values: - **Issuer**: `https://authentik.company/application/o//` - **Client ID**: use the Client ID from authentik - **Client Secret**: use the Client Secret from authentik - **Redirect URL**: `https://gravity.company/auth/oidc/callback` 4. Click **Update** to save and apply your configuration. ## Configuration verification To verify the integration with authentik, log out of Gravity and open Gravity. You should be automatically redirected to authentik. ## Resources - [Gravity API role configuration documentation](https://gravity.beryju.io/docs/api/role_config/) --- ## Integrate with Headscale ## What is Headscale? > Headscale is an open source, self-hosted implementation of the Tailscale control server. > > \-- [https://headscale.net](https://headscale.net) ## Preparation The following placeholders are used in this guide: - `headscale.company` is the FQDN of the Headscale installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Headscale with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://headscale.company/oidc/callback`. - Select any available signing key. - Leave **Encryption Key** empty. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Headscale configuration To support the integration of Headscale with authentik, update the `oidc` section in the Headscale configuration file: ```yaml showLineNumbers title="/etc/headscale/config.yaml" oidc: issuer: "https://authentik.company/application/o//" client_id: "" client_secret: "" # OIDC scopes to request (defaults: "openid", "profile", "email") # Additional scopes can be added to request extra user information scope: ["openid", "profile", "email", "custom"] # Passed on to the browser login request - used to tweak behaviour for the OIDC provider (optional) extra_params: domain_hint: acmecorp.net # Reject authentication if user doesn't match these criteria (optional) allowed_domains: - acmecorp.net # Group-based access control (optional) allowed_groups: - /headscale # Specific user allowlist (optional) allowed_users: - dominic@acmecorp.net pkce: enabled: true ``` If you store the client secret outside the configuration file, use Headscale's `client_secret_path` setting or the `HEADSCALE_OIDC_CLIENT_SECRET` environment variable instead of `client_secret`. Restart Headscale for the configuration changes to take effect. ## Configuration verification To confirm that authentik is properly configured with Headscale, open Headscale and sign in with OIDC. ## Resources - [Headscale OIDC documentation](https://headscale.net/stable/ref/oidc/#basic-configuration) - [Headscale configuration documentation](https://headscale.net/stable/ref/configuration/) --- ## Integrate with Hoop.dev ## What is Hoop.dev? > hoop.dev is a layer 7 gateway that masks sensitive data, blocks dangerous commands, approves risky writes, and records every session inline, before anything reaches your infrastructure. > > \-- [https://hoop.dev](https://hoop.dev) ## Preparation The following placeholders are used in this guide: - `hoop.company` is the FQDN of the Hoop.dev installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Hoop.dev with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, note the **slug** value, and configure an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://hoop.company/api/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Hoop.dev configuration To support the integration of Hoop.dev with authentik, you must configure Hoop.dev to use authentik as its identity provider. 1. Log in to Hoop.dev as an administrator. 2. Navigate to **Integrations** > **Authentication**. 3. Select **Identity Provider**. 4. Under **Protocol**, select **OIDC**. 5. Under **Identity Provider**, select **Other**. 6. Configure the following settings: - **Client ID**: enter the **Client ID** from authentik. - **Client Secret**: enter the **Client Secret** from authentik. - **Issuer URL**: `https://authentik.company/application/o//` 7. Click **Save**. Hoop.dev automatically synchronizes authentik groups at login whenever the ID token includes the `groups` claim. To use groups for Hoop.dev access control, ensure users are added to the appropriate authentik groups before they log in. ## Configuration verification To confirm that authentik is properly configured with Hoop.dev, open Hoop.dev, log out, and log back in. You should be redirected to authentik for authentication and then returned to Hoop.dev. You can also verify CLI authentication by running the following commands: ```bash hoop config create --api-url https://hoop.company hoop login ``` ## Resources - [Hoop.dev Identity Providers overview](https://hoop.dev/docs/setup/configuration/idp/get-started) - [Hoop.dev Environment Variables documentation](https://hoop.dev/docs/setup/configuration/env-vars) - [Hoop.dev OIDC login callback API reference](https://hoop.dev/docs/api-reference/authentication/oidc-%7C-login-callback) --- ## Integrate with NetBird ## What is NetBird > NetBird is an open source, zero trust networking platform that allows you to create secure private networks for your organization or home. > > \-- [https://netbird.io](https://netbird.io) ## Preparation The following placeholders are used in this guide: - `netbird.company` is the FQDN of the NetBird installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## Configuration methods NetBird can use authentik in two ways: - **Management setup**: add authentik as an external identity provider while keeping NetBird's embedded IdP and local users. - **Standalone setup**: replace NetBird's embedded IdP with authentik. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support adding authentik as an external identity provider in NetBird, you need to create an application/provider pair and application entitlements in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Leave **Redirect URIs/Origins** empty. NetBird generates the redirect URI in a later step. - Under **Advanced protocol settings** > **Selected Scopes**, add `authentik default OAuth Mapping: OpenID 'entitlements'`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to define which NetBird groups can be assigned to authentik users. 1. Open the NetBird application in authentik. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each NetBird group you want to assign to users. 4. Open each entitlement and bind the users or groups that should receive it. Name each entitlement exactly as the NetBird group value that NetBird should sync. This keeps NetBird-specific authorization scoped to the NetBird application instead of relying on global authentik group names. ## NetBird configuration 1. Log in to the NetBird Management Dashboard as an administrator. 2. Navigate to **Settings** > **Identity Providers** and click **Add Identity Provider**. 3. Configure the following settings: - **Type**: select **authentik** if available; otherwise select **Generic OIDC**. - **Name**: `authentik` - **Client ID**: enter the client ID from authentik. - **Client Secret**: enter the client secret from authentik. - **Issuer**: `https://authentik.company/application/o//` 4. Copy the redirect URL shown by NetBird. Do not complete the provider setup yet. 5. Return to authentik, navigate to **Applications** > **Providers**, and edit the NetBird provider. 6. Under **Redirect URIs/Origins**, add the redirect URL from NetBird as a `Strict` `Authorization` redirect. 7. Click **Update**. 8. Return to NetBird and complete the identity provider setup. ### Configure entitlement sync NetBird can sync group membership from a JWT claim. Use the `entitlements` claim so NetBird receives the application entitlements assigned to the user. 1. In authentik, edit the NetBird provider. 2. Under **Advanced protocol settings**, enable **Include claims in id\_token**. 3. Ensure the `entitlements` scope is selected. 4. In NetBird, enable JWT group sync and set the JWT claim to `entitlements`. ## authentik configuration To support replacing NetBird's embedded IdP with authentik, you need to create an application/provider pair, a service account, and a device code flow. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** value because it will be required later. - Set **Client type** to `Public`. - Add a **Redirect URI** of type `Strict` `Authorization` as `http://localhost:53000`. - Add a **Redirect URI** of type `Regex` `Authorization` as `https://netbird.company/.*`. - Select any available signing key. - Under **Advanced protocol settings**, set **Access Code Validity** to `minutes=10`. - Under **Advanced protocol settings**, set **Subject Mode** to `Based on the User's ID`. - Under **Advanced protocol settings**, add the `authentik default OAuth Mapping: OpenID 'offline_access'`, `authentik default OAuth Mapping: OpenID 'entitlements'`, and `authentik default OAuth Mapping: authentik API access` scopes to **Selected Scopes**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. It is important to set a signing key to secure the provider because this is a `Public` client. If access to the NetBird application is restricted with bindings, the NetBird service account must be allowed by those bindings. Otherwise, NetBird can return a 401 error after login. ### Set up a service account 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Users** and click **Create a service account**. 3. Set the **Username** to `NetBird` and disable the **Create group** option. 4. Click **Create**. 5. Navigate to **Directory** > **Tokens and App passwords** and click **Create**. 6. Set **User** to the NetBird service account, create an app password, and copy the generated password because it will be required later. ### Make the service account an administrator NetBird requires the service account to have full administrative access to the authentik instance. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups** and click **authentik Admins**. 3. Switch to the **Users** tab, click **Add existing user**, and select the NetBird service account. ### Create and apply a device code flow 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Flows and Stages** > **Flows** and click **Create**. 3. Set the following required configurations: - **Name**: provide a name, such as `default-device-code-flow`. - **Title**: provide a title, such as `Device code flow`. - **Slug**: provide a slug, such as `default-device-code-flow`. - **Designation**: `Stage Configuration` - **Authentication**: `Require authentication` 4. Click **Create**. 5. Navigate to **System** > **Brands** and click the **Edit** icon on the default brand. 6. Under **Default flows**, set **Device code flow** to the newly created device code flow and click **Update**. ## NetBird configuration To configure NetBird to use authentik as its standalone IdP, add the following environment variables to your NetBird deployment: ```yaml showLineNumbers title="setup.env" NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://authentik.company/application/o//.well-known/openid-configuration" NETBIRD_USE_AUTH0=false NETBIRD_AUTH_CLIENT_ID="" NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access entitlements goauthentik.io/api" NETBIRD_AUTH_AUDIENCE="" NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="" NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE="" NETBIRD_MGMT_IDP="authentik" NETBIRD_IDP_MGMT_CLIENT_ID="" NETBIRD_IDP_MGMT_EXTRA_USERNAME="NetBird" NETBIRD_IDP_MGMT_EXTRA_PASSWORD="" NETBIRD_AUTH_REDIRECT_URI="/auth" NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth" # Needs disabling due to issue with IdP. Learn more at https://github.com/netbirdio/netbird/issues/3654 NETBIRD_AUTH_PKCE_DISABLE_PROMPT_LOGIN=true ``` Restart the NetBird service for the changes to take effect. If using Docker, redeploy the NetBird container for the changes to take effect. ## Configuration verification To confirm that authentik is properly configured with NetBird, log out and log back in via authentik. ## Troubleshooting When accessing NetBird through a reverse proxy, you might encounter a loop where the `/peers` URL continuously reloads. To resolve this, set the following variables accordingly: ```yaml title="setup.env" NETBIRD_MGMT_API_PORT=443 NETBIRD_SIGNAL_PORT=443 ``` Run the `configure.sh` script for the change to take effect. ## Resources - [NetBird docs - authentik with NetBird self-hosted](https://docs.netbird.io/selfhosted/identity-providers/authentik) - [NetBird docs - authentik SSO with NetBird self-hosted advanced setup](https://docs.netbird.io/selfhosted/identity-providers/advanced/authentik) --- ## Integrate with Omada Controller ## What is Omada Controller? > Omada Controller is a software platform used to centrally manage and monitor Omada networking devices such as access points, switches, and routers. > > \-- [https://www.omadanetworks.com/](https://www.omadanetworks.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This guide applies to Omada Standard Cloud-Based Controller, Omada Software Controller, and OC300/OC400 hardware controllers. OC200 hardware controllers do not support SAML SSO. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Omada Controller with authentik, you need to create SAML property mappings, an application/provider pair, and application entitlements to map users to Omada groups. ### Create property mappings in authentik Omada expects SAML assertions to include user profile attributes, a `username` attribute, and a `usergroup_name` attribute. Create custom SAML property mappings so authentik sends the attribute names Omada expects. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create the following **SAML Provider Property Mappings** entries: - **Omada given name mapping**: - **Name**: `Omada given name` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname` - **Expression**: ```python return request.user.name.split(" ", 1)[0] if request.user.name else request.user.username ``` - **Omada surname mapping**: - **Name**: `Omada surname` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname` - **Expression**: ```python return request.user.name.rsplit(" ", 1)[-1] if " " in request.user.name else "" ``` - **Omada username mapping**: - **Name**: `Omada username` - **SAML Attribute Name**: `username` - **Expression**: ```python return request.user.username ``` - **Omada SAML user group mapping**: - **Name**: `Omada user group` - **SAML Attribute Name**: `usergroup_name` - **Expression**: ```python omada_entitlements = [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) if entitlement.name.startswith("Omada-") ] return omada_entitlements[0] if omada_entitlements else None ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set **ACS URL** to `https://temp.temp`. - Temporarily set **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**: - Set an available **Signing certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: UPN`. - Add the property mappings that you created earlier. - Remove `authentik default SAML Mapping: Groups`, because Omada receives role assignment from the `usergroup_name` attribute instead of authentik groups. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements in authentik Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the Omada SAML user groups that this application should assign. 1. Open the Omada Controller application that you just created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each Omada SAML user group that users should be able to receive, such as `Omada-admins`. 4. Open each entitlement and bind the users or groups that should receive it. Omada supports one SAML user group value per user. Ensure that each user receives only one `Omada-` entitlement for this application. The entitlement name must exactly match the **SAML User Group Name** value in Omada. The `Omada-` prefix keeps Omada-specific authorization scoped to this application and lets the `usergroup_name` property mapping ignore unrelated entitlements. ### Copy the provider metadata URL 1. Navigate to **Applications** > **Providers** and open the SAML provider that you created in the previous section. 2. Click the **Metadata** tab. 3. Under **SAML Metadata**, click **Copy download URL**. This metadata URL is required in the next section. ## Omada Controller configuration ### Create a SAML connection 1. Log in to the Omada Controller. 2. Navigate to **Global View** > **Settings** > **SAML SSO** and click **Add New SAML Connection**. 3. Configure the following settings: - **Identity Provider Name**: `authentik` - **Configuration Method**: select `Metadata URL`. - Paste the metadata URL that you copied from authentik. 4. Click **Load Info**, and then click **Send**. 5. In the **Actions** column, click **Details** for the authentik SAML connection. 6. Copy the **Entity ID**, **Sign-On URL**, **Omada ID**, and **Resource ID** values. These values are required in later sections. 7. Click **OK**. ### Create a SAML user group 1. At the top-right corner of the **SAML SSO** page, click **Go to SAML User Group**. 2. Click **Add New SAML User Group**. 3. Configure the **SAML User Group Name**, **Role**, **User Type**, and **Privileges** for the new SAML user group. 4. Click **Create**. The **SAML User Group Name** must exactly match the authentik application entitlement name that users receive. The value is case sensitive. ## Reconfigure the authentik provider ### Encode the default relay state The default relay state is the Base64-encoded value of the **Resource ID** and **Omada ID**, separated by an underscore (`_`). ```bash echo -n '_' | base64 --wrap=0 ``` ```powershell [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('_')) ``` ### Update the SAML provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and edit the Omada Controller provider. 3. Configure the following settings: - **ACS URL**: enter the **Sign-On URL** value from Omada. - **Audience**: enter the **Entity ID** value from Omada. - Under **Advanced protocol settings**, set **Default relay state** to the encoded relay state value from the previous section. 4. Click **Update** to save your changes. ## Configuration verification To verify that authentik is correctly integrated with Omada Controller, log out of Omada Controller. Open the Omada Controller application from the authentik User interface. You should be redirected to the Omada Controller dashboard. ## Resources - [Omada Networks Documentation - How to Configure SAML SSO on Omada Controller](https://support.omadanetworks.com/us/document/26917/) --- ## Integrate with OPNsense ## What is OPNsense? > OPNsense is an open source FreeBSD-based firewall and routing platform. > > \-- [https://opnsense.org/](https://opnsense.org/) ## Preparation The following placeholders are used in this guide: - `opnsense.company` is the FQDN of the OPNsense installation. - `authentik.company` is the FQDN of the authentik installation. - `ldap.company` is the FQDN of the authentik LDAP outpost. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This guide uses LDAPS. The LDAP outpost must use a certificate that is trusted by OPNsense and valid for `ldap.company`. If you use a private certificate authority, import that authority into OPNsense under **System** > **Trust** > **Authorities** before configuring the LDAP server. ## authentik configuration To support the integration of OPNsense with authentik, you need an LDAP application/provider pair, a service account for LDAP binding, LDAP search permissions for that service account, and an LDAP outpost. Follow the [LDAP provider documentation](/docs/add-secure-apps/providers/ldap/create-ldap-provider) to create these resources. While following the LDAP provider documentation, use the following OPNsense-specific settings: - On the LDAP provider, set **Certificate** to the certificate OPNsense will trust for `ldap.company`. - On the LDAP provider, set **TLS Server Name** to `ldap.company`. - For the LDAP bind service account name, use a descriptive name such as `opnsense-user`. - If you configure application bindings, ensure that the LDAP bind service account and users who should authenticate to OPNsense have access to the application. ## OPNsense configuration ### Add the LDAP authentication server 1. Log in to the OPNsense web UI at `opnsense.company`. 2. Navigate to **System** > **Access** > **Servers** and click **Add**. 3. Configure the LDAP server with the following settings: - **Descriptive name**: `authentik` - **Type**: `LDAP` - **Hostname or IP address**: `ldap.company` - **Port value**: `636` - **Transport**: `SSL - Encrypted` - **Bind credentials**: - **User DN**: `CN=opnsense-user,OU=users,DC=ldap,DC=goauthentik,DC=io` - **Password**: enter the password for the LDAP bind service account. - **Base DN**: `DC=ldap,DC=goauthentik,DC=io` - **Authentication containers**: `OU=users,DC=ldap,DC=goauthentik,DC=io;OU=groups,DC=ldap,DC=goauthentik,DC=io` - **Extended Query**: `objectClass=user` - **Initial Template**: `OpenLDAP` 4. Click **Save**. ### Enable authentik authentication OPNsense can use LDAP for authentication, but GUI privileges still need to be assigned in OPNsense. Before enabling the LDAP server for GUI login, ensure that the LDAP users or groups that should access the OPNsense web UI exist in OPNsense and have the required privileges. 1. Navigate to **System** > **Settings** > **Administration**. 2. Under **Authentication**, add `authentik` to the **Server** list. 3. Keep **Local Database** selected as a fallback while testing the new LDAP server. 4. Click **Save**. You can import users or synchronize users and groups from authentik LDAP. For more information, refer to the OPNsense LDAP documentation in the Resources section. ## Configuration verification To confirm that authentik is properly configured with OPNsense, navigate to **System** > **Access** > **Tester** in OPNsense, select the `authentik` authentication server, and test with an authentik user's username and password. After the test succeeds, log out of OPNsense and log back in with an authentik account that has the required OPNsense privileges. ## Resources - [OPNsense documentation - Access / Servers / LDAP](https://docs.opnsense.org/manual/how-tos/user-ldap.html) - [OPNsense documentation - Access / User Management](https://docs.opnsense.org/manual/users.html) - [OPNsense source - LDAP connector](https://github.com/opnsense/core/blob/master/src/opnsense/mvc/app/library/OPNsense/Auth/LDAP.php) --- ## Integrate with Pangolin ## What is Pangolin? > Pangolin is a self-hosted tunneled reverse proxy server with identity and access control, designed to securely expose private resources on distributed networks. > > \-- [https://pangolin.net](https://pangolin.net) ## Preparation The following placeholders are used in this guide: - `pangolin.company` is the FQDN of the Pangolin installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Pangolin with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Temporarily add a **Redirect URI** of type `Strict` `Authorization` as `https://temp.temp`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Pangolin configuration 1. Log in to Pangolin as a server administrator. 2. Navigate to **Server Admin** > **Identity Providers**, and click **Add Identity Provider**. - Under **General Information**: - **Name**: `authentik` - **Provider Type**: select **OAuth2/OIDC**. - **Auto Provision Users** *(optional)*: enable this option for authentik users to be automatically provisioned in Pangolin on first login. If this option is disabled, create the user in Pangolin before the first login. - Under **OAuth2/OIDC Configuration**: - **Client ID**: Client ID from authentik. - **Client Secret**: Client Secret from authentik. - **Authorization URL**: `https://authentik.company/application/o/authorize/` - **Token URL**: `https://authentik.company/application/o/token/` 3. Click **Create Identity Provider**. 4. Open the identity provider, and note the **Redirect URL** value because it will be required in the next section. ## Reconfigure authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon of the newly created Pangolin provider. 3. Add a **Redirect URI** of type `Strict` `Authorization` as the value taken from Pangolin, for example `https://pangolin.company/auth/idp//oidc/callback`. 4. Click **Update**. ## Configuration verification To confirm that authentik is properly configured with Pangolin, log out and log back in via the **authentik** login button. ## Resources - [Pangolin Docs - Add Identity Providers](https://docs.pangolin.net/manage/identity-providers/add-an-idp) - [Pangolin Docs - OAuth2/OIDC](https://docs.pangolin.net/manage/identity-providers/openid-connect) --- ## Integrate with pfSense ## What is pfSense? > pfSense is a free and open source firewall and router that also features unified threat management, load balancing, multi WAN, and more. > > \-- [https://www.pfsense.org/](https://www.pfsense.org/) This guide configures pfSense to authenticate users against authentik through LDAP. ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `ldap.company` is the FQDN that pfSense uses to reach the authentik LDAP outpost. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of pfSense with authentik, you need to create an LDAP application/provider pair, a service account, and an LDAP outpost in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **LDAP Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name) and the bind flow to use for this provider. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create a service account and LDAP outpost After creating the application/provider pair, follow the LDAP provider setup to create a [service account](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#create-a-service-account), assign the [LDAP search permission](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#assign-the-ldap-search-permission-to-the-service-account) to the service account, and [create an LDAP outpost](/docs/add-secure-apps/providers/ldap/create-ldap-provider/#create-an-ldap-outpost) for the pfSense LDAP provider. ## pfSense configuration ### Configure the LDAPS certificate pfSense must trust the certificate presented by the authentik LDAP outpost for `ldap.company`. If you use a certificate from an authority that pfSense already trusts, no pfSense certificate authority setup is required. To create a certificate in pfSense for the authentik LDAP provider: 1. In pfSense, navigate to **System** > **Certificates** and open the **Authorities** tab. 2. Click **Add** and configure the certificate authority: - **Descriptive Name**: `pfSense CA` - **Method**: `Create an internal Certificate Authority` - **Common Name**: `pfSense CA` 3. Click **Save**. 4. Open the **Certificates** tab. 5. Click **Add/Sign** and configure the certificate: - **Method**: `Create an internal Certificate` - **Descriptive Name**: `ldap.company` - **Certificate authority**: `pfSense CA` - **Common Name**: `ldap.company` - **Certificate Type**: `Server Certificate` 6. Click **Save**. 7. Export the certificate and private key from pfSense. 8. In authentik, navigate to **System** > **Certificates** and import the exported certificate and private key. 9. Navigate to **Applications** > **Providers** and edit the LDAP provider. 10. Set **Certificate** to the imported certificate. 11. Set **TLS Server Name** to `ldap.company`. 12. Click **Update**. ### Add the LDAP authentication server 1. In pfSense, navigate to **System** > **User Manager** and open the **Authentication Servers** tab. 2. Click **Add**. 3. Set **Type** to `LDAP`. 4. Configure the LDAP server: - **Descriptive name**: `LDAP authentik` - **Hostname or IP address**: `ldap.company` - **Transport**: `SSL/TLS Encrypted` - **Peer Certificate Authority**: `pfSense CA` - **Search scope**: `Entire Subtree` - **Base DN**: `dc=ldap,dc=goauthentik,dc=io` - **Authentication containers**: `ou=users,dc=ldap,dc=goauthentik,dc=io` - **Extended Query**: enable the setting and set **Query** to `&(objectClass=user)`. - **Bind Anonymous**: unchecked - **Bind Credentials**: - **User DN**: `cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io` - **Password**: the password for the `ldapservice` service account. - **Group member attribute**: `memberOf` 5. Click **Save**. ### Configure pfSense groups If pfSense should use LDAP group membership for local privileges, create matching local groups in pfSense and assign the required privileges to those groups. The local group names must match the LDAP group names returned during authentication. ### Change the default authentication server 1. In pfSense, navigate to **System** > **User Manager** and open the **Settings** tab. 2. Set **Authentication Server** to `LDAP authentik`. 3. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with pfSense, navigate to **Diagnostics** > **Authentication** in pfSense, select `LDAP authentik` as the authentication server, and test with an authentik user. After the test succeeds, open pfSense in a private browser window and log in with an authentik user. ## Resources - [pfSense Documentation - LDAP Authentication Servers](https://docs.netgate.com/pfsense/en/latest/usermanager/ldap.html) - [pfSense Documentation - Certificate Authority Management](https://docs.netgate.com/pfsense/en/latest/certificates/ca.html) - [pfSense Documentation - Certificate Management](https://docs.netgate.com/pfsense/en/latest/certificates/certificate.html) - [pfSense Documentation - Troubleshooting Authentication](https://docs.netgate.com/pfsense/en/latest/troubleshooting/authentication.html) --- ## Integrate with Tailscale ## What is Tailscale? > Tailscale is a mesh VPN service that creates secure, encrypted, peer-to-peer connections between devices across different networks using the WireGuard protocol. > > \-- [https://tailscale.com](https://tailscale.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This guide covers creating a new tailnet with custom OIDC. To migrate an existing tailnet to custom OIDC, contact Tailscale support after configuring WebFinger. Tailscale requires a WebFinger endpoint at `https://example.com/.well-known/webfinger` on the domain used for your administrator email address. Set this up according to your web server or application specifications. Use this JSON template for your WebFinger response: ```json { "subject": "acct:admin@example.com", "links": [ { "href": "https://authentik.company/application/o//", "rel": "http://openid.net/specs/connect/1.0/issuer" } ] } ``` Replace `admin@example.com` with the administrator email address that you will use when creating your tailnet. The domain in the email address must match the domain where the WebFinger endpoint is served and the domain you will use for Tailscale. The issuer URL must exactly match the issuer in authentik's OpenID configuration, and both the WebFinger endpoint and authentik issuer must be reachable by Tailscale. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Tailscale with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required for the WebFinger response. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://login.tailscale.com/a/oauth_response`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Tailscale configuration 1. Open Tailscale's [Sign up with OIDC](https://login.tailscale.com/start/oidc) page. 2. Enter the administrator email address that matches your WebFinger endpoint and click **Get OIDC Issuer**. If prompted for an identity provider type, select **authentik**. 3. Set the following configurations: - **Client ID**: enter the client ID from authentik. - **Client secret**: enter the client secret from authentik. 4. Click **Sign up with OIDC** and authenticate with authentik using the administrator email address from the previous step. ## Configuration verification To verify the integration with Tailscale, open Tailscale and log in using an email address from your configured SSO domain. You should be redirected to authentik and then back to the Tailscale admin console. ## Resources - [Tailscale custom OIDC providers documentation](https://tailscale.com/docs/integrations/identity/custom-oidc) --- ## Integrate with Technitium DNS ## What is Technitium DNS? > Technitium DNS Server is a free, open source, cross-platform, authoritative and recursive DNS server that can be self-hosted for privacy and security, software development, and testing on small to medium-sized networks. > > \-- [https://technitium.com/dns/](https://technitium.com/dns/) ## Preparation The following placeholders are used in this guide: - `technitium.company` is the FQDN of the Technitium DNS installation. - `authentik.company` is the FQDN of the authentik installation. This guide requires Technitium DNS Server version 15.0 or later. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Technitium DNS with authentik, you need to create a scope mapping, an application/provider pair, and application entitlements in authentik. ### Create a scope mapping in authentik Technitium DNS uses the `roles` claim to map SSO users to local groups. Create a scope mapping to pass authentik application entitlements as role values. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. - **Select type**: select **Scope Mapping**. - **Configure the Scope Mapping**: configure the following settings: - **Name**: provide a descriptive name, such as `Technitium DNS roles`. - **Scope name**: `profile` - **Expression**: ```python return { "roles": [ entitlement.name for entitlement in request.user.app_entitlements(provider.application) ], } ``` 3. Click **Finish** to save the scope mapping. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://technitium.company/sso/callback`. - Select any available signing key. - Ensure that the `openid`, `email`, and `profile` scopes are selected. Remove the `email` scope if you prefer usernames to use the preferred username claim instead of the email address; if you do this, remove the `email` scope from Technitium in the next section. - Under **Advanced protocol settings** > **Selected Scopes**, add the scope mapping that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements in authentik Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to represent the Technitium DNS groups that this application should assign. 1. Open the Technitium DNS application that you just created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each Technitium DNS group that users should be able to receive, such as `Technitium Admins`. 4. Expand each entitlement and click **Bind existing group/user** to bind the users or groups that should receive it. The entitlement names must exactly match the **Remote Group** values that you configure in the Technitium **Group Map**. ## Technitium configuration 1. Log in to the Technitium web console using a local administrator account. 2. Navigate to **Administration** > **Single Sign-On (SSO)**. 3. Select **Enable Single Sign-On (SSO)**. 4. Configure the following settings: - **Authority (Issuer)**: `https://authentik.company/application/o//` - **Client ID**: enter the client ID from authentik. - **Client Secret**: enter the client secret from authentik. 5. If you removed the `email` scope from the authentik provider, remove `email` from the Technitium **Scopes** list. 6. Configure **SSO User Sign Up** as appropriate: - **Allow New User Sign Up**: enable this to allow automatic provisioning of user accounts for new SSO users. - **Allow Sign Up Only For Mapped Users**: enable this to restrict sign-up to users that belong to a mapped remote group. If enabled, you must configure at least one entry in the **Group Map** section, otherwise new SSO users cannot sign up. 7. Configure the **Group Map** to map authentik application entitlements to local Technitium groups: - **Remote Group**: the name of the authentik application entitlement (e.g. `Technitium Admins`). - **Local Group**: the corresponding Technitium local group (e.g. `Administrators`). It is strongly recommended to keep a local administrator account as a fallback. Any DNS failure could cause SSO to stop working, making it impossible for SSO-only users to log in. 8. Click **Save Config** to apply the changes. The web service restarts automatically. ## Configuration verification To confirm that authentik is properly configured with Technitium DNS, log out of Technitium. Then, navigate to the Technitium login page and click **OpenID Connect**. You should be redirected to authentik to log in, and if successful, redirected to the Technitium dashboard. ## Resources - [Technitium DNS Server v15 release announcement](https://blog.technitium.com/2026/04/technitium-dns-server-v15-released.html) - [Technitium DNS Server API documentation](https://github.com/TechnitiumSoftware/DnsServer/blob/master/APIDOCS.md) - [Technitium DNS Server Docker environment variables](https://github.com/TechnitiumSoftware/DnsServer/blob/master/DockerEnvironmentVariables.md) --- ## Integrate with Anthropic ## What is Anthropic? > Anthropic is a public benefit corporation dedicated to securing AI's benefits and mitigating its risks. > > \-- [https://www.anthropic.com](https://www.anthropic.com) This guide configures authentik as the SAML identity provider for Claude and Claude Console user login, with optional JIT or SCIM provisioning. ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `example.company` is the email domain that you verify in Claude or Claude Console. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This guide covers user SSO and provisioning for Claude and Claude Console. API workload authentication is a separate flow; for that configuration, see [Integrate with Anthropic Workload Identity Federation](../anthropic-workload-identity-federation/). Before requiring SSO, review Anthropic's [important SSO and provisioning considerations](https://support.claude.com/en/articles/10276682-important-considerations-before-enabling-single-sign-on-sso-and-jit-scim-provisioning) and [SSO setup guide](https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso). Domain verification, parent organization setup, and organization merges are Anthropic-side prerequisites and are outside the scope of this integration guide. ## authentik configuration To support the integration of Anthropic with authentik, create SAML property mappings and an application/provider pair. ### Create property mappings Create SAML property mappings for the attributes that WorkOS expects from the identity provider. 1. Log in to authentik as an administrator. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create the following **SAML Provider Property Mapping** entries: - **ID mapping:** - **Name**: choose a descriptive name. - **SAML Attribute Name**: `id` - **Friendly Name**: leave blank. - **Expression**: ```python return str(request.user.uuid) ``` - **Email mapping:** - **Name**: choose a descriptive name. - **SAML Attribute Name**: `email` - **Friendly Name**: leave blank. - **Expression**: ```python return request.user.email ``` - **First name mapping:** - **Name**: choose a descriptive name. - **SAML Attribute Name**: `firstName` - **Friendly Name**: leave blank. - **Expression**: ```python return request.user.name.split(" ", 1)[0] if request.user.name else request.user.username ``` - **Last name mapping:** - **Name**: choose a descriptive name. - **SAML Attribute Name**: `lastName` - **Friendly Name**: leave blank. - **Expression**: ```python return request.user.name.rsplit(" ", 1)[-1] if " " in request.user.name else " " ``` - **Entitlements mapping** *(required for JIT entitlement mappings)*: - **Name**: choose a descriptive name. - **SAML Attribute Name**: `groups` - **Friendly Name**: leave blank. - **Expression**: ```python for entitlement in request.user.app_entitlements(provider.application): yield entitlement.name ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name or accept the auto-provided name, the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://temp.temp`. You will replace this after Anthropic provides the real ACS URL. - Set the **Audience** to `https://temp.temp`. You will replace this after Anthropic provides the real SP Entity ID. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Add the property mappings that you created earlier. - **Configure Bindings** *(optional)*: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. When a SCIM provider is added as a backchannel provider later, only users who can view this application are synchronized. 3. Click **Submit** to save the new application and provider. ### Copy the metadata URL 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created. 2. Under **Related objects** > **Metadata**, click **Copy download URL**. This metadata URL is required in the Anthropic setup flow. ## Anthropic configuration This guide expects that you have already reviewed Anthropic's SSO considerations, verified `example.company`, completed any required parent organization setup or organization merge, and can access the Anthropic identity settings page. For Claude, log in as an Owner or Primary Owner and open [**Organization and access**](https://claude.ai/admin-settings/organization). For Claude Console, log in as an Admin and open [**Identity and access**](https://platform.claude.com/settings/identity). ### Configure SSO 1. In the **Authentication** section, click **Setup SSO** or **Manage SSO**. 2. In the WorkOS setup flow, select SAML and use the custom SAML setup. 3. Copy the following WorkOS service provider values. You will use these values to update the authentik provider: - **ACS URL** - **SP Entity ID** 4. Paste the authentik metadata URL into the WorkOS identity provider metadata field. 5. Map the SAML attributes as follows: - `id` to the user ID field. - `email` to the email field. - `firstName` to the first name field. - `lastName` to the last name field. - `groups` to the groups field for JIT entitlement mappings. ### Update the authentik provider 1. Return to the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the SAML provider that you created earlier. 3. Update the provider with the WorkOS values: - **ACS URL**: set to the WorkOS **ACS URL**. - **Audience**: set to the WorkOS **SP Entity ID**. 4. Click **Update** to save the provider. ### Test and enforce SSO 1. Return to the WorkOS setup browser tab. 2. On the WorkOS verification step, run the SSO test. The test redirects to authentik for authentication and then back to Anthropic. 3. After the test succeeds, return to the identity settings page. 4. Enable **Require SSO for Claude** or **Require SSO for Console**. Do not require SSO until the users who need access are assigned to the Anthropic application in authentik. Users with verified-domain email addresses who are not assigned to the SSO application cannot sign in when SSO is required. ## Provisioning options To provision users automatically, choose one of the options below: - **Just-in-time (JIT)**: users assigned to the authentik application are automatically provisioned when they first log in. JIT is available for Team plans, Enterprise plans, and Claude Console organizations. - **SCIM directory sync**: users and groups are automatically provisioned and deprovisioned from authentik without waiting for user login. SCIM is available for Enterprise plans and Claude Console organizations with their own parent organization or joined to an Enterprise parent organization. ### Configure JIT provisioning 1. On the Anthropic identity settings page (**Organization and access** for Claude, **Identity and access** for Claude Console), find the **User provisioning** section. 2. Select **Just-in-time (JIT)**. 3. Confirm that all users who should be provisioned are assigned to the Anthropic application in authentik. 4. To use JIT without entitlement-based role or seat type mappings, click **Save changes**. New users assigned to the authentik application are automatically created with the Anthropic User role when they first sign in. #### Configure JIT entitlement mappings Use JIT entitlement mappings only when Anthropic should assign roles or seat types from authentik. Anthropic expects these values in the SAML `groups` attribute; this guide populates that attribute from authentik application entitlements instead of global authentik groups. Create the entitlements in authentik first, then map those entitlement names in Anthropic. Anthropic documents the current role and seat type options in [Set up JIT or SCIM provisioning](https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning). Create entitlement names for the Anthropic role and seat type mappings that apply to your plan: | Product | Roles | Seat types | | ------------------------------------------------- | -------------------------------------------------------------------- | ------------------------ | | Team plan | Owner, Admin, User | Premium, Standard | | Seat-based Enterprise plan | Owner, Admin, User, Custom roles | Premium, Standard | | Usage-based Enterprise plan (with two seat types) | Owner, Admin, User, Custom roles | Chat, Chat + Claude Code | | Usage-based Enterprise plan (single seat type) | Owner, Admin, User, Custom roles | Enterprise | | Console | Admin, Developer, Limited Developer, Billing, Claude Code User, User | None | ##### Create authentik entitlements 1. In authentik, open the Anthropic application that you created earlier. 2. Click the **Application entitlements** tab. 3. Click **Create entitlement**. 4. In **Name**, enter the IdP group value that you want to map in Anthropic, such as `Claude Owner` or `Console Developer`. 5. Leave **Attributes** empty unless you need to store additional metadata, then click **Create**. 6. In the entitlements list, expand the entitlement that you created. 7. Click **Bind existing group/user**. 8. Select **Group** or **User**, select the authentik group or user that should receive this Anthropic role or seat type, and click **Create**. 9. Repeat these steps for each Anthropic role or seat type that you want to assign with JIT entitlement mappings. ##### Map entitlements in Anthropic 1. Return to the Anthropic JIT provisioning settings. 2. Enable **group mappings** before saving the JIT provisioning configuration. 3. Map each entitlement value from the SAML `groups` attribute to the appropriate Anthropic role or seat type. When group mappings are enabled, every user who needs access must have a mapped role entitlement; seat type entitlements are optional unless your organization requires explicit seat assignment. 4. Click **Save changes**. Each entitlement name is sent in the SAML `groups` attribute. Use names that are easy to identify when you create the Anthropic mappings. For JIT entitlement mappings, role and seat type changes apply on the user's next login. Before saving mappings, make sure at least one administrator has an entitlement mapped to an Owner role for Claude or an Admin role for Claude Console. Otherwise that administrator can lose elevated access. For SCIM group mappings, Anthropic exempts only the Primary Owner from SCIM reconciliation; Owner and Admin users must still have a mapped role. ### Configure SCIM provisioning Use SCIM provisioning to automatically create, update, and remove users and groups in Claude or Claude Console from authentik. #### Create the SCIM connection in Anthropic 1. On the Anthropic identity settings page (**Organization and access** for Claude, **Identity and access** for Claude Console), find the **User provisioning** section. 2. Select **SCIM directory sync**. 3. Click **Setup SCIM**. After a SCIM connection exists, the button is **Manage SCIM**. 4. Follow the WorkOS setup flow until it provides the SCIM **Endpoint** and **Bearer Token**. 5. Copy the endpoint and token. These values are required in authentik. #### Create the SCIM provider in authentik 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click **Create**. 2. Select **SCIM Provider** as the provider type and click **Next**. 3. Configure the following settings: - **Name**: provide a descriptive name. - **URL**: enter the WorkOS SCIM **Endpoint**. - **Token**: paste the WorkOS SCIM **Bearer Token**. - **Authentication Mode**: select **Static token**. - **Group filters** *(optional)*: select only the Anthropic-specific groups that should be synchronized. 4. Click **Finish**. 5. Navigate to **Applications** > **Applications** and open the Anthropic application. 6. Add the SCIM provider to **Backchannel Providers**. 7. Click **Update**. #### Test SCIM provisioning 1. Open the SCIM provider in authentik and click **Run sync again**. 2. Return to the Anthropic identity settings page. 3. In **User provisioning**, open **Manage SCIM** and confirm that the expected users and groups appear in the directory. 4. Enable SCIM directory sync and any group mappings only after the expected users and groups are present. After changing SCIM group mappings, click **Sync now** in **User provisioning** > **Manage SCIM**, or wait for the next synchronization cycle. If SCIM or SCIM group mappings are enabled before users and groups are assigned correctly in authentik, Anthropic can remove users from the Claude or Claude Console organization. ## Configuration verification Sign out of Claude or Claude Console and start a new login. Choose **Continue with SSO**, enter an email address on the verified domain, and authenticate with authentik. After successful authentication, you should be redirected back to Claude or Claude Console. ## Resources - [Anthropic Help Center - Important considerations before enabling SSO and JIT/SCIM provisioning](https://support.claude.com/en/articles/10276682-important-considerations-before-enabling-single-sign-on-sso-and-jit-scim-provisioning) - [Anthropic Help Center - Set up single sign-on (SSO)](https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso) - [Anthropic Help Center - Set up JIT or SCIM provisioning](https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning) - [WorkOS documentation - SAML](https://workos.com/docs/integrations/saml) - [WorkOS documentation - SCIM](https://workos.com/docs/integrations/scim/1-set-up-your-directory-sync-endpoint) --- ## Integrate with Anthropic Workload Identity Federation ## What is Anthropic Workload Identity Federation? > Workload Identity Federation (WIF) lets your workloads authenticate to the Claude API using short-lived OpenID Connect (OIDC) tokens issued by an identity provider you already operate. > > \-- [https://platform.claude.com/docs/en/manage-claude/workload-identity-federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) This guide configures authentik as the OIDC issuer for Anthropic Workload Identity Federation. ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. To complete this guide, you need an Anthropic organization where you can manage workload identity federation and create service accounts. This guide covers API workload authentication. To configure SAML user login for Claude and Claude Console, see [Integrate with Anthropic](../anthropic/). Anthropic must be able to fetch the authentik OpenID configuration and JSON Web Key Set (JWKS) over public HTTPS on port 443. If your authentik instance is not publicly reachable, configure Anthropic with an inline JWKS instead of discovery. ## authentik configuration To support the integration of Anthropic Workload Identity Federation with authentik, you need to create an application/provider pair in authentik that issues signed OIDC tokens to your workload. ### Create an application and provider in authentik 1. Log in to authentik as an administrator. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a descriptive name and configure the following required settings. - Note the **Client ID** and **Client Secret** values because they are required later. - Under **Grant Types**, select only **Client credentials**. - Leave **Redirect URIs/Origins (RegEx)** empty. - Under **Protocol settings**, select a **Signing Key**. - Under **Advanced protocol settings**, set **Access Token Validity** to the amount of time that the authentik-issued identity token should remain valid. This value must not exceed the maximum identity token lifetime that you configure in Anthropic. - **Configure Bindings** *(optional)*: leave bindings empty for the initial setup. After the first token request creates the generated authentik service account, you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) if you need to restrict access to this application. 3. Click **Submit** to save the new application and provider. ### Generate and inspect a sample JWT Use the provider's client credentials flow to generate an OIDC token that you can inspect before creating the Anthropic federation rule. ```bash showLineNumbers TOKEN_RESPONSE="$(curl --silent --show-error --fail \ --request POST https://authentik.company/application/o/token/ \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "grant_type=client_credentials" \ --data-urlencode "client_id=" \ --data-urlencode "client_secret=" \ --data-urlencode "scope=openid profile")" printf '%s' "${TOKEN_RESPONSE}" > /tmp/authentik-anthropic-workload-identity-federation-token.json jq --raw-output '.id_token' /tmp/authentik-anthropic-workload-identity-federation-token.json \ > /tmp/authentik-anthropic-workload-identity-federation.jwt jq --raw-input 'split(".")[1] | gsub("-"; "+") | gsub("_"; "/") | @base64d | fromjson' \ /tmp/authentik-anthropic-workload-identity-federation.jwt ``` ```powershell showLineNumbers $body = @{ grant_type = "client_credentials" client_id = "" client_secret = "" scope = "openid profile" } $response = Invoke-RestMethod ` -Method Post ` -Uri "https://authentik.company/application/o/token/" ` -ContentType "application/x-www-form-urlencoded" ` -Body $body $response | ConvertTo-Json -Depth 10 | Set-Content "$env:TEMP\authentik-anthropic-workload-identity-federation-token.json" $response.id_token | Set-Content "$env:TEMP\authentik-anthropic-workload-identity-federation.jwt" $payload = $response.id_token.Split(".")[1].Replace("-", "+").Replace("_", "/") $padding = (4 - ($payload.Length % 4)) % 4 $payload = $payload + ("=" * $padding) [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($payload)) | ConvertFrom-Json | ConvertTo-Json -Depth 10 ``` The first client credentials token request creates a generated authentik service account for the provider. This account is the `sub` claim in the sample JWT and is separate from the Anthropic service account that you create in Claude Console. Confirm that the decoded JWT contains these claims: - `iss`: `https://authentik.company/application/o//` - `sub`: the generated authentik service account username, usually `ak--client_credentials`. - `aud`: the **Client ID** from authentik. - `exp`: a future timestamp. ## Anthropic configuration To support the integration of authentik with Anthropic Workload Identity Federation, connect a workload in the Claude Console using authentik as a custom OIDC issuer. ### Create a service account 1. Log in to the Claude Console as an Anthropic organization administrator. 2. Navigate to **Settings** > **Service accounts**. 3. Click **Create service account**. 4. Provide a name and optional description for the workload identity. 5. Add the service account to the workspace that the workload should use. 6. Note the service account ID. The ID starts with `svac_`. ### Connect the workload 1. In the Claude Console, navigate to **Settings** > **Workload identity**. 2. Click **Connect workload**. 3. Select the service account that you created earlier. 4. Select **Custom OIDC** as the identity provider and configure the issuer: - **Issuer name**: enter a descriptive name. - **Issuer URL**: `https://authentik.company/application/o//` - **JWKS source**: select **discovery**. - **Discovery base**: if the field is shown, set it to `https://authentik.company/application/o/` without a trailing slash. 5. Configure the federation rule: - **Rule name**: enter a descriptive name. - **Match type**: select **Static**. - **Subject prefix**: enter the exact `sub` claim from the sample JWT. - **Audience**: enter the **Client ID** from authentik. - **OAuth scope**: select the scope that the workload needs, such as `workspace:developer` or `workspace:inference`. - **Token lifetime**: choose the Anthropic access token lifetime for the workload. - **Maximum identity token lifetime**: choose a value equal to or longer than the authentik **Access Token Validity** value. 6. Save the workload connection. 7. Note the federation rule ID, organization ID, and service account ID from the workload connection. The federation rule ID starts with `fdrl_`, and the service account ID starts with `svac_`. Use a specific subject and audience for the federation rule. A broad subject prefix can allow more authentik-issued tokens to act as the Anthropic service account than intended. ## Workload configuration The authentik configuration above gives your workload a way to obtain an upstream OIDC JWT. Configure the workload to refresh the authentik-issued JWT before it expires and provide that token to the Anthropic SDK or CLI. Use the same authentik token request from [Generate and inspect a sample JWT](#generate-and-inspect-a-sample-jwt) to refresh the identity token file before the authentik token expires. For authentik client credentials options, see [Machine-to-Machine authentication](/docs/add-secure-apps/providers/oauth2/machine_to_machine/). Set the following environment variables for the workload: ```bash ANTHROPIC_FEDERATION_RULE_ID="" ANTHROPIC_ORGANIZATION_ID="" ANTHROPIC_IDENTITY_TOKEN_FILE="/path/to/authentik-anthropic-workload-identity-federation.jwt" ANTHROPIC_SERVICE_ACCOUNT_ID="" # ANTHROPIC_WORKSPACE_ID="" ``` Use `ANTHROPIC_IDENTITY_TOKEN_FILE` when the workload can refresh a token file, or use `ANTHROPIC_IDENTITY_TOKEN` when the workload receives the identity token directly. If the federation rule is enabled for more than one workspace, also set `ANTHROPIC_WORKSPACE_ID`. Keep authentik client credentials in your platform's secret store. When migrating an existing workload, remove `ANTHROPIC_API_KEY` and `ANTHROPIC_AUTH_TOKEN` wherever they are set because Anthropic gives them precedence over federation credentials. ## Configuration verification 1. Decode the authentik-issued JWT and confirm that `iss`, `sub`, `aud`, and `exp` match the Anthropic issuer and federation rule. 2. Start the workload without `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` set. 3. If the Anthropic SDK or CLI reports `invalid_grant`, compare the decoded JWT with the Anthropic issuer and rule. The `iss` value must exactly match the issuer URL, including the trailing slash. ## Resources - [Anthropic documentation - Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) - [Anthropic documentation - WIF reference](https://platform.claude.com/docs/en/manage-claude/wif-reference) --- ## Integrate with Appsmith ## What is Appsmith? > Appsmith is an open-source developer tool that enables the rapid development of internal applications. > > \-- [https://www.appsmith.com/](https://www.appsmith.com/) ## Preparation The following placeholders are used in this guide: - `appsmith.company` is the FQDN of the Appsmith installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. OIDC SSO is available with Appsmith Enterprise Edition. Appsmith also requires a self-hosted instance with a custom domain to configure OIDC. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Appsmith with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` with a value of `https://appsmith.company/login/oauth2/code/oidc`. - Select any available signing key. - Under **Advanced protocol settings**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to **Selected Scopes**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Appsmith configuration 1. Log in to Appsmith as an administrator. 2. Navigate to **Admin Settings** > **Authentication**. 3. Under **OIDC**, click **Enable**. 4. Confirm that the **Redirect URL** is `https://appsmith.company/login/oauth2/code/oidc`. 5. Configure the following settings: - **Client ID**: Client ID from authentik - **Client secret**: Client Secret from authentik - **Authorization URL**: `https://authentik.company/application/o/authorize/` - **Token URL**: `https://authentik.company/application/o/token/` - **User info URL**: `https://authentik.company/application/o/userinfo/` - **JWK set URL**: `https://authentik.company/application/o//jwks/` - **Scope**: add `offline_access`. 6. Click **Save & restart** and wait for the Appsmith instance to restart. If Appsmith runs in a highly available Kubernetes deployment, restart the Appsmith deployment after saving the OIDC configuration so that all replicas use the updated settings. ## Configuration verification To confirm that authentik is properly configured with Appsmith, open Appsmith and click **Sign in with OIDC SSO**. You should be redirected to authentik and returned to Appsmith after authentication. ## Resources - [Appsmith Docs - OpenID Connect SSO](https://docs.appsmith.com/getting-started/setup/instance-configuration/authentication/openid-connect-oidc) --- ## Integrate with Atlassian Cloud ## What is Atlassian Cloud? > Atlassian is a proprietary software company that specializes in collaboration tools designed primarily for software development and project management. Atlassian Cloud is their cloud platform and provides access to their popular apps, including Jira, Confluence, Bitbucket, Trello, and others. > > \-- [https://www.atlassian.com/](https://www.atlassian.com/) This guide configures authentik as a SAML identity provider for Atlassian Cloud applications. Atlassian Cloud has two types of users: **internal** users and **external** users. Internal users are managed accounts from a domain that is [verified in Atlassian Cloud](https://support.atlassian.com/user-management/docs/verify-a-domain-to-manage-accounts/). Internal users can use SAML SSO without Atlassian Cloud credentials. [External users](https://support.atlassian.com/security-and-access-policies/docs/who-are-external-users/) log in with Atlassian Cloud credentials first, and are then prompted for authentik credentials when they access protected Atlassian Cloud apps. ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. SAML SSO for Atlassian Cloud apps requires an [Atlassian Guard Standard](https://support.atlassian.com/security-and-access-policies/docs/understand-atlassian-guard/) subscription, a [verified domain](https://support.atlassian.com/user-management/docs/verify-a-domain-to-manage-accounts/), and an identity provider directory in Atlassian Cloud. Domain verification and directory ownership are Atlassian-side prerequisites and are outside the scope of this integration guide. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Atlassian Cloud with authentik, you need to create SAML property mappings and an application/provider pair in authentik. ### Create property mappings Atlassian Cloud expects an email NameID and a stable user ID attribute. Create Atlassian-specific mappings so the stable user ID is not based on the user's email address or display name. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Create three **SAML Provider Property Mapping** entries with the following settings: - **User ID mapping**: - **Name**: `Atlassian Cloud user ID` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` - **Expression**: ```python return str(request.user.uuid) ``` - **First name mapping**: - **Name**: `Atlassian Cloud first name` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname` - **Expression**: ```python name = request.user.name.strip() return name.split(" ", 1)[0] if name else request.user.username ``` - **Last name mapping**: - **Name**: `Atlassian Cloud last name` - **SAML Attribute Name**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname` - **Expression**: ```python name = request.user.name.strip() return name.rsplit(" ", 1)[1] if " " in name else "" ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it is required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://temp.temp`. You will replace this after Atlassian provides the real assertion consumer service URL. - Set the **Audience** to `https://temp.temp`. You will replace this after Atlassian provides the real service provider entity URL. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Add the three property mappings that you created earlier to **Selected User Property Mappings**. - Remove `authentik default SAML Mapping: Name` from **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created for Atlassian Cloud. 3. Under **Download signing certificate**, click **Download**. The contents of this certificate are required in the next section. ## Atlassian Cloud configuration 1. Log in to the [Atlassian administrator portal](https://admin.atlassian.com) as an Atlassian Cloud organization administrator. 2. Select your organization. 3. Navigate to **Security** > **User security** > **Identity providers**. 4. Choose **Other provider**. 5. Provide a directory name, for example `authentik`, and click **Add**. 6. Select the identity provider directory that you created, then click **Set up SAML single sign-on**. 7. Set the following required configurations: - **Identity provider Entity ID**: `https://authentik.company/application/saml//metadata/` - **Identity provider SSO URL**: `https://authentik.company/application/saml//` - **Public x509 Certificate**: enter the contents of the certificate that you downloaded from authentik. 8. Click **Save configuration**. 9. Copy the **Service provider entity URL** and **Service provider assertion consumer service URL**. These values are required in authentik. 10. If prompted, link the verified domains that should use this identity provider directory. ### Update the authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon for the Atlassian Cloud provider. 3. Update the following settings: - **ACS URL**: set to the **Service provider assertion consumer service URL** from Atlassian Cloud, such as `https://auth.atlassian.com/login/callback?connection=saml-example`. - **Audience**: set to the **Service provider entity URL** from Atlassian Cloud, such as `https://auth.atlassian.com/saml/example`. 4. Click **Update**. ## Enable SSO in Atlassian Cloud ### Internal users 1. Log in to the [Atlassian administrator portal](https://admin.atlassian.com) as an Atlassian Cloud organization admin. 2. Navigate to **Security** > **User security** > **Identity providers**. 3. Select the identity provider directory that you created for authentik. 4. Open **Authentication policies**. 5. Select **Edit** for the policy that should enforce SAML SSO. 6. Select **Enforce single sign-on**. 7. Click **Update**. ### External users 1. Log in to the [Atlassian administrator portal](https://admin.atlassian.com) as an Atlassian Cloud organization admin. 2. Navigate to **Security** > **User security** > **External users**. 3. Click **External user policy**. 4. Under **Authorization method**, select **Single sign-on**. 5. Under **Identity provider**, select the identity provider directory that you created for authentik. 6. Click **Update**. ## Configuration verification ### Internal users To confirm that authentik is properly configured with Atlassian Cloud for internal users, open an Atlassian Cloud app in a private or incognito browser window and log in with a managed account from a verified domain. You should be redirected to authentik and then back to Atlassian Cloud. ### External users To confirm that authentik is properly configured with Atlassian Cloud for external users, open an Atlassian Cloud app in a private or incognito browser window and log in with an external user account. From the Atlassian Cloud dashboard, open an app such as Jira. You should be prompted to verify your identity, redirected to authentik, and then returned to the selected Atlassian Cloud app. ## Resources - [Atlassian Support - Configure SAML single sign-on with an identity provider](https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/) - [Atlassian Support - Connect an identity provider](https://support.atlassian.com/provisioning-users/docs/what-are-setup-options-for-provisioning-and-single-sign-on/) - [Atlassian Support - Available external user security policy settings](https://support.atlassian.com/security-and-access-policies/docs/available-external-user-security-settings/) --- ## Integrate with Box ## What is Box? > Box is a cloud content management platform for secure file storage, sharing, collaboration, e-signatures, and content workflows. > > \-- [https://www.box.com/](https://www.box.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Box SSO requires a Business or Enterprise account. To let Box create users automatically from SSO, make sure each authentik user has an email address and a full name with a first and last name. ## authentik configuration To support the integration of Box with authentik, you need to create property mappings and an application/provider pair in authentik. ### Create property mappings 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Create three **SAML Provider Property Mapping**s with the following settings: - **Email mapping**: - **Name**: `Box email` - **SAML Attribute Name**: `email` - **Expression**: ```python return request.user.email ``` - **First name mapping**: - **Name**: `Box firstName` - **SAML Attribute Name**: `firstName` - **Expression**: ```python name = request.user.name.strip() return name.split(" ", 1)[0] if name else "" ``` - **Last name mapping**: - **Name**: `Box lastName` - **SAML Attribute Name**: `lastName` - **Expression**: ```python name = request.user.name.strip() return name.rsplit(" ", 1)[1] if " " in name else "" ``` ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to `https://sso.services.box.net/sp/ACS.saml2`. - Set **Audience** to `box.net`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Add the three property mappings that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download metadata file 1. In authentik, navigate to **Applications** > **Providers** and click the provider that you created for Box. 2. Under **Related objects** > **Metadata**, click **Download**. This metadata file is required in the next section. ## Box configuration 1. Log in to Box and open the **Admin Console**. 2. Navigate to **Enterprise Settings** > **User Settings**. 3. In the **Configure Single Sign-On (SSO) for All Users** section, click **Configure**. 4. Submit the [Box SSO Setup Support Form](https://support.box.com/hc/en-us/requests/new) and provide the authentik metadata file. 5. Use the following values for individual SAML fields: - **Entity ID**, **Connection ID**, or **External Key**: `https://authentik.company/application/saml//metadata/` - **Redirect URL**: `https://authentik.company/application/saml//` - **Public Certificate**: the signing certificate from the authentik SAML provider. - **Email attribute**: `email` - **First name attribute**: `firstName` - **Last name attribute**: `lastName` 6. After Box processes the SSO configuration, return to **Admin Console** > **Enterprise Settings** > **User Settings**. 7. In the **Enable Single Sign-On (SSO) for All Users** section, enable **SSO Test Mode**. 8. After you test the integration, disable **SSO Test Mode** and enable **SSO Required**. Test the SSO login flow before enabling **SSO Required**. Enabling **SSO Required** limits managed users to SSO login and is treated by Box as a critical administrator action. ## Box SSO account settings ### On-the-fly registration *(optional)* Box can create user accounts when a user signs in with SSO for the first time. To use on-the-fly registration, contact Box Customer Success or Box Product Support and provide the `email`, `firstName`, and `lastName` SAML attribute names. ### Group membership *(optional)* Box can update Box group membership from SAML assertions when users sign in. To send authentik group names to Box, add `authentik default SAML Mapping: Groups` to the Box SAML provider's **Property mappings**. If Box does not show the **User Groups Settings** section after SSO is enabled, contact Box Customer Success or Box Product Support to enable SAML groups. Nested group membership is not supported by Box. ## Configuration verification To confirm that authentik is properly configured with Box, open Box in a private or incognito browser window. Click **Sign In with SSO**, enter the email address of a managed Box user, and confirm that you are redirected to authentik and then back to Box. ## Resources - [Box Support - Setting Up Single Sign-On (SSO) for Your Organization](https://support.box.com/hc/en-us/articles/360043696514-Setting-Up-Single-Sign-On-SSO-for-Your-Organization) - [Box Support - Logging in with Single Sign On (SSO)](https://support.box.com/hc/en-us/articles/360044195153-Logging-in-with-Single-Sign-On-SSO) --- ## Integrate with Budibase ## What is Budibase? > Budibase is an open-source low-code platform for building internal tools and workflow applications. > > \-- [https://github.com/Budibase/budibase](https://github.com/Budibase/budibase) ## Preparation The following placeholders are used in this guide: - `budibase.company` is the FQDN of the Budibase installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Log in to Budibase as an administrator, open the builder, navigate to **Settings** > **Auth**, and copy the **Callback URL** displayed under **OpenID Connect**. You will use this URL when creating the authentik provider. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Budibase with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` using the **Callback URL** copied from Budibase. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Budibase configuration 1. Log in to Budibase as an administrator, open the builder, and navigate to **Settings** > **Auth**. 2. Under **OpenID Connect**, set the following values: - **Config URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Client ID**: `` - **Client Secret**: `` - **Name**: `authentik` - **Activated**: enabled 3. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with Budibase, open Budibase and log in with authentik. ## Resources - [Budibase official documentation on OpenID Connect](https://docs.budibase.com/docs/openid-connect) - [Budibase source code](https://github.com/Budibase/budibase) --- ## Integrate with Cloudflare ## What is Cloudflare? > Cloudflare Dashboard is the web interface used to manage Cloudflare accounts, zones, Zero Trust, security, performance, and other Cloudflare services. > > \-- [https://www.cloudflare.com/](https://www.cloudflare.com/) ## Preparation The following placeholders are used in this guide: - `company.com` is the email domain used by users in your Cloudflare organization. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. To proceed, you need: - A Cloudflare account where you are a **Super Administrator**. - A Cloudflare Zero Trust organization. - Control over DNS for `company.com`, because Cloudflare requires a TXT record to verify the email domain before Dashboard SSO can be enabled. - A working Cloudflare Access identity provider that uses authentik. If this is not already configured, follow the [Cloudflare Access integration guide](../../security/cloudflare-access/index.md) first. This guide configures SSO for the Cloudflare Dashboard. To protect applications with Cloudflare Access, use the [Cloudflare Access integration guide](../../security/cloudflare-access/index.md) instead. Cloudflare Dashboard SSO applies to every Cloudflare user with the configured email domain, including users who already exist in Cloudflare. Cloudflare does not support plus-addressed user emails, such as `user+cloudflare@company.com`, with Dashboard SSO. ## authentik configuration Cloudflare Dashboard SSO uses your existing Cloudflare Access identity provider. Before enabling Dashboard SSO, make sure Cloudflare Access is configured to use authentik and that the identity provider test succeeds in Cloudflare. To test the identity provider, open the Cloudflare dashboard and navigate to **Zero Trust** > **Integrations** > **Identity providers**. Next to the authentik identity provider, click **Test** and complete the login flow. ## Cloudflare configuration ### Create a recovery API token Cloudflare recommends creating an Account API token with the `SSO Connector Edit` role before enabling Dashboard SSO. Store this token securely so you can disable Dashboard SSO through the API if an identity provider misconfiguration locks you out. 1. Log in to the Cloudflare dashboard as a Super Administrator. 2. Navigate to **Manage Account** > **Account API Tokens** and click **Create**. 3. Under **Create Custom Token**, click **Get Started**. 4. Add the **Account** permission `SSO Connector Edit`. 5. Click **Continue to Summary**, then click **Create Token**. ### Register the email domain 1. In the Cloudflare dashboard, navigate to **Manage Account** > **Members** > **Settings**. 2. In the Dashboard SSO settings, add a new SSO domain. 3. Enter `company.com` as the email domain, then create the SSO connector. 4. Copy the verification code from Cloudflare. 5. Create a DNS `TXT` record at `company.com` with the verification code as its value. The value must include the `cloudflare_dashboard_sso=` prefix. 6. Wait for Cloudflare to verify domain ownership. If verification times out, begin verification again from the SSO connector actions menu after confirming the DNS record is available. ### Enable Dashboard SSO 1. In the Cloudflare dashboard, navigate to **Manage Account** > **Members** > **Settings**. 2. Open the actions menu for the SSO connector you created. 3. Click **Enable**. ## Configuration verification To confirm that authentik is properly configured with Cloudflare Dashboard SSO, open Cloudflare Dashboard in a private browser window and sign in with an email address from `company.com`. You should be redirected to authentik, complete the login flow, and return to Cloudflare Dashboard. ## Resources - [Cloudflare Docs - Set up dashboard SSO](https://developers.cloudflare.com/fundamentals/manage-members/dashboard-sso/) --- ## Integrate with Directus ## What is Directus? > Directus connects to a database and provides REST and GraphQL APIs, a no-code interface, and a native MCP server. > > \-- [https://directus.io/](https://directus.io/) ## Preparation The following placeholders are used in this guide: - `directus.company` is the FQDN of a self-hosted Directus installation. - `.directus.app` is the URL of a Directus Cloud project. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Directus SSO requires a Team or Enterprise license, or an Open Innovation Grant. You can configure SSO directly on a self-hosted deployment. Directus Customer Success must configure SSO for an Enterprise Cloud project. Before you begin, log in to Directus as an administrator. Navigate to **Settings** > **User Roles**, open the role that SSO users should receive, and note the role ID from the browser URL. Choose your Directus deployment below. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of self-hosted Directus with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` with a value of `https://directus.company/auth/login/authentik/callback`. - Select any available signing key. - **Configure Bindings** *(recommended)*: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to control which users can access Directus and be registered automatically. 3. Click **Submit** to save the new application and provider. ## Directus configuration The configuration enables automatic registration for users who can access the authentik application. Directus assigns those users the role that you specify. 1. Add the following environment variables to the Directus configuration. Replace `` with the role ID that you noted during preparation. ```env title=".env" PUBLIC_URL="https://directus.company" AUTH_PROVIDERS="authentik" AUTH_AUTHENTIK_DRIVER="openid" AUTH_AUTHENTIK_CLIENT_ID="" AUTH_AUTHENTIK_CLIENT_SECRET="" AUTH_AUTHENTIK_ISSUER_URL="https://authentik.company/application/o//.well-known/openid-configuration" AUTH_AUTHENTIK_ALLOW_PUBLIC_REGISTRATION="true" AUTH_AUTHENTIK_DEFAULT_ROLE_ID="" ``` If Directus already uses other SSO providers, add `authentik` to the comma-separated `AUTH_PROVIDERS` value instead of replacing the existing providers. 2. Restart Directus to apply the configuration. ## Configuration verification To confirm that authentik is properly configured with self-hosted Directus, open Directus and click **Log in with authentik**. You should be redirected to authentik and returned to Directus after authentication. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Directus Cloud with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` with a value of `https://.directus.app/auth/login/authentik/callback`. - Select any available signing key. - **Configure Bindings** *(recommended)*: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to control which users can access Directus and be registered automatically. 3. Click **Submit** to save the new application and provider. ## Directus configuration Contact Directus Customer Success and ask them to configure OpenID Connect SSO for the Enterprise Cloud project with the following values: - **Provider name**: `authentik` - **Client ID**: Client ID from authentik - **Client secret**: Client Secret from authentik - **Issuer URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Automatic registration**: enabled - **Default role ID**: the Directus role ID that you noted during preparation If the Cloud project already uses other SSO providers, ask Directus Customer Success to add authentik without replacing the existing providers. ## Configuration verification To confirm that authentik is properly configured with Directus Cloud, open Directus and click **Log in with authentik**. You should be redirected to authentik and returned to Directus after authentication. ## Resources - [Directus documentation - Auth and SSO configuration](https://directus.com/docs/configuration/auth-sso) - [Directus documentation - Single Sign-On](https://directus.com/docs/guides/auth/sso) - [Directus documentation - Create a Cloud project](https://directus.com/docs/cloud/projects/create) - [Directus pricing - SSO availability](https://directus.com/pricing) --- ## Integrate with Docker Platforms ## What are Docker platforms? > Docker provides services and applications for sharing container images, building and running containers, and running AI coding agents in isolated environments. > > \-- [https://www.docker.com/](https://www.docker.com/) This guide configures authentik as a SAML identity provider for Docker platforms through Docker SSO. Users can access **Docker Hub, Docker Desktop, and Docker Sandboxes** with the same Docker authentication and organization membership. ## Preparation The following placeholder is used in this guide: - `authentik.company` is the FQDN of the authentik installation. Docker SSO requires a Docker Business subscription and an organization owner account. Each user must have an email address in authentik that matches their Docker account email address and belongs to a verified domain. Domain verification is a Docker-side prerequisite and is outside the scope of this guide. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ### Start the SAML connection in Docker 1. Log in to [Docker Home](https://app.docker.com/) as an organization owner and select your organization. If the organization belongs to a company, select the company instead. 2. Navigate to **Identity & auth** > **SSO and SCIM** and click **Create Connection**. 3. Enter a descriptive connection name and select **SAML 2.0**. 4. Copy the **Entity ID** and **ACS URL** values. Keep the setup page open because you will return to it after configuring authentik. ## authentik configuration To support the integration of Docker platforms with authentik, create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - Under **UI Settings**, set **Launch URL** to `https://hub.docker.com/`. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name or accept the auto-provided name, select the authorization flow to use for this provider, and configure the following settings: - **ACS URL**: enter the **ACS URL** from Docker. - **Audience**: enter the **Entity ID** from Docker. - Set **Service Provider Binding** to **Post**. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Set **Default NameID Policy** to **Email address**. - **Configure Bindings** *(optional)*: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage which users can access Docker platforms from their **Application Dashboard** page. 3. Click **Submit** to save the application and provider. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created. 2. Under **Related objects** > **Download signing certificate**, click **Download**. The certificate is required to complete the Docker SSO connection. ## Docker SSO configuration ### Complete the SAML connection 1. Return to the Docker SSO setup page that you kept open. 2. Enter the following identity provider values: - **SAML Sign-in URL**: `https://authentik.company/application/saml//` - **x509 Certificate**: paste the complete contents of the signing certificate that you downloaded from authentik. 3. Select the verified email domain. 4. Select a default Docker team if your organization requires one. 5. Review the settings and click **Create connection**. Docker uses just-in-time (JIT) provisioning to add assigned users to the organization when they first sign in through SSO. ### Enforce SSO *(optional)* Test SSO with an organization owner account before enabling enforcement. Ensure that Docker CLI users and CI/CD pipelines use personal access tokens or organization access tokens because password-based CLI authentication is unavailable after SSO is enforced. 1. In a private or incognito browser window, open Docker Hub and sign in with an email address from the verified domain. Confirm that Docker redirects you to authentik and then back to Docker Hub. 2. In Docker Home, select your organization or company. 3. Navigate to **Identity & auth** > **SSO and SCIM**. 4. Open the **Action** menu for the SSO connection and select **Enable enforcement**. 5. Follow the on-screen instructions and click **Turn on enforcement**. ## Configuration verification To confirm that authentik is properly configured with Docker platforms, open the integration from the authentik Application Dashboard and sign in with an email address from the verified domain. You should be redirected to authentik and then returned to Docker Hub. ## Resources - [Docker Docs - Set up single sign-on](https://docs.docker.com/enterprise/security/single-sign-on/connect/) - [Docker Docs - Single sign-on overview](https://docs.docker.com/enterprise/security/single-sign-on/) - [Docker Docs - Provision users](https://docs.docker.com/enterprise/security/provisioning/) - [Docker Docs - Get started with Docker Sandboxes](https://docs.docker.com/ai/sandboxes/get-started/) - [Docker Docs - Docker Sandboxes sign-in enforcement](https://docs.docker.com/ai/sandboxes/governance/sign-in-enforcement/) --- ## Integrate with Drupal ## What is Drupal? > Drupal is a free and open-source content management system written in PHP and > paired with a database. > > \-- [https://en.wikipedia.org/wiki/Drupal](https://en.wikipedia.org/wiki/Drupal) ## Preparation The following placeholders are used in this guide: - `drupal.company` is the FQDN of the Drupal installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This guide uses the [OpenID Connect / OAuth client](https://www.drupal.org/project/openid_connect) module. Install and enable this module in Drupal before continuing. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Drupal with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://drupal.company/openid-connect/authentik`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Drupal configuration 1. Log in to Drupal as an administrator. 2. Navigate to **Configuration** > **People** > **OpenID Connect** and click **Generic OAuth 2.0**. 3. Configure the following settings: - **Name**: `authentik` - **Machine name**: `authentik` - **Client ID**: enter the **Client ID** from authentik. - **Client secret**: enter the **Client Secret** from authentik. - **Auto discover endpoints**: enable this setting. - **Issuer URL**: `https://authentik.company/application/o//` - **Scopes**: `openid email profile` 4. Confirm that the **Redirect URL** shown by Drupal is `https://drupal.company/openid-connect/authentik`. 5. Click **Save**. 6. Open the **Settings** tab and configure the following settings: - **Override registration settings**: enable this setting if Drupal should create users who do not already have an account. - **OpenID buttons display in user login form**: select where the authentik login button should appear on the Drupal login form. 7. Click **Save configuration**. ## Configuration verification To confirm that authentik is properly configured with Drupal, log out of Drupal, open the Drupal login page, and click **Log in with authentik**. You should be redirected to authentik to log in, and then redirected back to Drupal. ## Resources - [Drupal OpenID Connect Module Documentation](https://www.drupal.org/project/openid_connect) - [Drupal OpenID Connect client configuration documentation](https://www.drupal.org/docs/contributed-modules/openid-connect/client-configuration) --- ## Integrate with Elastic Cloud ## What is Elastic Cloud? > Elastic Cloud is a hosted service for Elasticsearch and Kibana. > > \-- [https://www.elastic.co/cloud](https://www.elastic.co/cloud) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `example.com` is a domain you control for Elastic Cloud login. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Elastic Cloud SAML SSO requires an Enterprise subscription and at least one claimed domain. Users can only authenticate if their email address matches a claimed domain. ## authentik configuration To support the integration of Elastic Cloud with authentik, create SAML property mappings, an application/provider pair, and application entitlements for the role-mapping values that Elastic Cloud should receive. ### Create property mappings You first need to create property mappings to provide the specific SAML attribute names that Elastic Cloud expects. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create the following **SAML Provider Property Mapping** entries: - **Email Mapping (required):** - **Name**: Choose a descriptive name - **SAML Attribute Name**: `email` - **Expression**: ```python return request.user.email ``` - **First name mapping (optional):** - **Name**: Choose a descriptive name - **SAML Attribute Name**: `firstName` - **Expression**: ```python name = request.user.name.strip() return name.split(" ", 1)[0] if name else "" ``` - **Last name mapping (optional):** - **Name**: Choose a descriptive name - **SAML Attribute Name**: `lastName` - **Expression**: ```python name = request.user.name.strip() return name.rsplit(" ", 1)[1] if " " in name else "" ``` - **Groups mapping (optional, required for role mappings):** - **Name**: Choose a descriptive name - **SAML Attribute Name**: `groups` - **Expression**: ```python for entitlement in request.user.app_entitlements(provider.application): yield entitlement.name ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://temp.temp`. You will replace this after Elastic Cloud provides the real ACS URL. - Set the **Audience** to `https://temp.temp`. You will replace this after Elastic Cloud provides the real service provider entity ID. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Add the property mappings that you created earlier to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Create application entitlements for Elastic role mappings Use [application entitlements](/docs/add-secure-apps/applications/manage_apps/#application-entitlements) to define the values that authentik sends in the `groups` SAML attribute for this Elastic Cloud application. 1. Open the Elastic Cloud application that you just created in the authentik Admin interface. 2. Click the **Application entitlements** tab. 3. Create one entitlement for each Elastic Cloud role-mapping value that you want to send, such as `elastic-org-owners`. 4. Bind the appropriate users or groups to each entitlement. For this integration, each entitlement name should exactly match the value that you want Elastic Cloud to evaluate in the `groups` SAML attribute. This keeps Elastic-specific authorization scoped to the Elastic Cloud application instead of relying on global authentik group names. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click on the name of the SAML provider you created in the previous section. 2. Under **Related objects** > **Download signing certificate**, click **Download**. This certificate file will be required in the next section. ## Elastic Cloud configuration To support the integration of authentik with Elastic Cloud, you need to claim your email domain and configure/enforce SSO in Elastic Cloud. ### Claim your email domain 1. Log in to Elastic Cloud as an Organization owner. 2. Open your organization's **Security** tab. 3. Under **Domains**, click **Add domain** and enter `example.com`. 4. Complete Elastic's DNS verification flow, then return to Elastic Cloud and click **Verify and add domain**. The exact DNS change is outside the scope of this guide. Follow the verification record shown in Elastic Cloud for your domain. ### Configure SSO 1. Log in to Elastic Cloud as an Organization owner. 2. Open your organization's **Security** tab. 3. Under **User authentication**, click **Configure SSO**. 4. Configure the following settings: - **Identity Provider Entity ID**: `https://authentik.company/application/saml//metadata/` - **Identity Provider SSO URL**: `https://authentik.company/application/saml//` - **Public x509 certificate**: Paste the contents of the authentik signing certificate in PEM format. - **Login identifier prefix**: the custom value used for the Elastic Cloud SSO login URL. Use lowercase letters, numbers, and hyphens. 5. Click **Update configuration**. 6. Note the following values provided by Elastic: - **SSO Login URL**: the Elastic Cloud SSO login URL for organization members. - **Service provider Entity ID**: the identifier your IdP uses to validate SAML requests. - **Service provider ACS URL**: the URL that receives SAML assertions from the IdP (also called the SSO or ACS URL). - **Metadata URL**: the URL your IdP can use to retrieve Elastic Cloud metadata. ### Update the authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the SAML provider you created earlier. 3. Update the provider with the Elastic values: - **ACS URL**: set to the Elastic **Service provider ACS URL**. - **Audience**: set to the Elastic **Service provider Entity ID**. 4. Click **Update** to save the provider. 5. Navigate to **Applications** > **Applications**, open the application you created earlier, and set **Launch URL** to the Elastic **SSO Login URL**. ### Enforce SAML SSO *(optional)* 1. Confirm that SSO works by opening the Elastic **SSO Login URL** in a private browsing session and signing in with authentik. 2. Return to Elastic Cloud as an Organization owner. 3. Open your organization's **Security** tab. 4. Under **User authentication**, click **Edit**. 5. Toggle **Enforce SAML SSO**. ### Configure role mappings Elastic Cloud requires the first role mapping in a SAML SSO configuration to include the **Organization owner** role. Make sure that the `groups` SAML attribute mapping is enabled in authentik. 1. In Elastic Cloud, under **Role mappings**, click **Create role mapping**. 2. Add a unique name for the role mapping, such as `Organization Owner`. 3. Click **Add roles** and select **Organization owner**. 4. In **Mapping rules**, select **Any are true** or **All are true**. 5. Add the exact entitlement name that authentik sends in the `groups` attribute, such as `elastic-org-owners`. 6. Click **Run test** and verify that the SAML response grants Organization owner access. 7. Click **Save**. Elastic Cloud requires the **Organization owner** role to be mapped to a value present in the SAML `groups` attribute before the role mapping can be saved. Elastic Cloud does not support IdP-initiated SSO. Use the Elastic **SSO login URL** to start sign-in. ## Configuration verification To confirm that authentik is properly configured with Elastic Cloud, open the integration from authentik or use the Elastic **SSO Login URL**. You should be redirected to authentik and, after authenticating, returned to Elastic Cloud with access to the organization. ## Resources - [Elastic Cloud Docs - Configure Elastic Cloud SAML single sign-on](https://www.elastic.co/docs/deploy-manage/users-roles/cloud-organization/configure-saml-authentication) --- ## Integrate with HubSpot ## What is HubSpot? > HubSpot is a customer platform with tools for CRM, marketing, sales, customer service, content management, operations, and commerce. > > \-- [https://www.hubspot.com/](https://www.hubspot.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This guide covers SAML Single Sign-On (SSO) for HubSpot. HubSpot SSO requires a HubSpot Professional or Enterprise account, or an active Professional or Enterprise trial, and a HubSpot user with **Super Admin** permissions. HubSpot identifies SSO users by email address, so the NameID sent by authentik must match the user's email address in HubSpot. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of HubSpot with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: set **Application Name**, **Slug**, an optional group, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider**: select **SAML Provider** on the **Choose a Provider Type** page. - **Configure SAML Provider**: provide a name (or accept the auto-provided name), select the authorization flow to use for this provider, and set the following values. - Set **ACS URL** to `https://temp.temp`. - Set **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Set **Service Provider Binding** to **Post**. - Set **Default NameID Policy** to **Email address**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Create Application** to save the new application and provider. ### Copy the SAML values from authentik 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click the SAML provider that you created for HubSpot. 2. Copy the **SAML Endpoint** value. This value is required in HubSpot. 3. Under **Related objects** > **Download signing certificate**, click **Download**. 4. Open the downloaded certificate file and copy the full PEM certificate. ## HubSpot configuration 1. Log in to HubSpot as a Super Admin. 2. In the top navigation bar, click the **settings** icon. 3. In the left sidebar, navigate to **Security**. 4. On the **Login** tab, do one of the following: - If portal login settings have not been configured yet, click **Setup Portal Login Settings**. - If portal login settings have already been configured, click **Set up** in the **Configure single sign-on (SSO)** section. 5. In the right panel, select the **All Other Identity Providers** tab. 6. Set the following values: - **Identity Provider Identifier or Issuer URL**: `https://authentik.company/application/saml//metadata/` - **Identity Provider Single Sign-On URL**: the **SAML Endpoint** value from authentik. - **X.509 Certificate**: the full PEM certificate that you downloaded from authentik. 7. Copy the following values from HubSpot. You will use them to finish the SAML provider configuration in authentik. - **Audience URI** - **ACS URL** 8. Keep the SSO setup panel open. ## Configure the remaining information in authentik 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and click the SAML provider that you created for HubSpot. 2. Click **Edit**. 3. Under **Protocol settings**, set the following values: - **ACS URL**: the **ACS URL** value from HubSpot. - **Audience**: the **Audience URI** value from HubSpot. 4. Click **Save Changes**. ## Verify HubSpot configuration 1. Return to the HubSpot SSO setup panel. 2. Click **Verify** and complete the authentik login flow. ## Configuration verification To confirm that authentik is properly configured with HubSpot, open HubSpot in a private browser window, click **Log in with SSO**, and enter the email address of a HubSpot user whose email address matches an authentik user. ## Resources - [HubSpot Knowledge Base - Set up single sign-on (SSO)](https://knowledge.hubspot.com/account-security/set-up-single-sign-on-sso) - [HubSpot - Single Sign-on in HubSpot](https://www.hubspot.com/products/single-sign-on) - [Cisco Duo - Duo Single Sign-On for HubSpot](https://duo.com/docs/sso-hubspot) --- ## Integrate with Microsoft 365 via SAML ## What is Microsoft365? > Microsoft 365 is the cloud productivity platform that delivers Office applications, Teams collaboration, and identity services from Microsoft's global infrastructure. > > \-- [https://microsoft365.com/](https://microsoft365.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `domain.company` is the custom domain federated with Microsoft Entra ID. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Microsoft 365 with authentik via SAML, you need to: 1. Create a property mapping for users' immutable identifier in authentik. 2. Create a property mapping for the `IDPEmail` claim in authentik. 3. Create a property mapping for MFA. (*optional*) 4. Create an application/provider pair in authentik. 5. Download a certificate file. ### 1. Property mapping for users' immutable identifier Microsoft Entra ID requires a unique and [immutable identifier (called `ImmutableId` or `sourceAnchor`)](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/plan-connect-design-concepts#sourceanchor) for each user during SAML federation. This identifier is sent as the SAML `NameID` attribute and must match the `ImmutableId` value configured in Entra for each user. #### For users synchronized from Active Directory If you are using an [Active Directory source](/docs/users-sources/sources/directory-sync/active-directory/) in authentik, the immutable identifier is typically the base64-encoded `objectGUID` from Active Directory. You will need to create a property mapping on your Active Directory source in authentik that stores this value in a custom user attribute, for example: `entra_immutable_id`. #### For cloud-only users If your users aren't synchronized from Active Directory and only exist in authentik, you can use any unique and stable identifier such as the user's UUID or user principal name (UPN). The simplest option is to use the user's email address as long as it matches the user's Microsoft Entra UPN. You will also need to configure the `ImmutableId` in Entra ID to match the identifier that authentik sends. #### Create a property mapping in authentik for `ImmutableId` 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. - **Select type**: select **SAML Provider Property Mapping**. - **Configure the SAML Provider Property Mapping**: provide a descriptive name (e.g. `Microsoft Entra Immutable ID`), and, optionally a friendly name. - **SAML Attribute Name**: `ImmutableID` - **Expression for users synchronized from Active Directory**: ```python showLineNumbers # For users synchronized from Active Directory with the 'entra_immutable_id' attribute. # Replace 'entra_immutable_id' with whatever you set this attribute's name to. return user.attributes.get("entra_immutable_id", "") ``` - **Expression for cloud-only users whose authentik email address matches their Entra UPN**: ```python showLineNumbers return user.email ``` 3. Click **Finish** to save the property mapping. This mapping is used as the provider's **NameID Property Mapping**, so the `NameID` sent to Microsoft Entra ID matches the user's `ImmutableId`. ### 2. Property mapping for `IDPEmail` Microsoft Entra ID also expects an `IDPEmail` attribute in the SAML assertion. This value must match the user's Microsoft Entra `UserPrincipalName` (UPN). #### Create a property mapping in authentik for `IDPEmail` 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. - **Select type**: select **SAML Provider Property Mapping**. - **Configure the SAML Provider Property Mapping**: provide a descriptive name (e.g. `Microsoft Entra IDPEmail`), and, optionally a friendly name. - **SAML Attribute Name**: `IDPEmail` - **Expression**: ```python showLineNumbers # For users synchronized from Active Directory, prefer the stored UPN. return user.attributes.get("upn", user.email) ``` 3. Click **Finish** to save the property mapping. ### 3. Property mapping for MFA If MFA is configured in Microsoft 365, you also need to create a property mapping for `AuthnContextClassRef` to ensure Entra ID recognizes that MFA was already performed. Without this mapping, users may be prompted to authenticate twice or register an MFA device in Entra ID. Whether Entra ID accepts the federated MFA claim depends on your tenant's security configuration: - If **Security defaults** are enabled, Entra ID will ignore federated MFA claims and require users to register an Entra ID MFA device regardless. You must disable Security defaults for federated MFA to work. - If you're using **Conditional Access policies**, ensure they're configured to trust external MFA. Otherwise, users will still be prompted to set up an Entra ID MFA device even when authenticating through the federated identity provider. #### Create a property mapping in authentik for `AuthnContextClassRef` 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. - **Select type**: select **SAML Provider Property Mapping**. - **Configure the SAML Provider Property Mapping**: provide a descriptive name (e.g. `Microsoft Entra AuthnContextClassRef`), and, optionally a friendly name. - **SAML Attribute Name**: `AuthnContextClassRef` - **Expression**: ```python showLineNumbers return "http://schemas.microsoft.com/claims/multipleauthn" ``` 3. Click **Finish** to save the property mapping. ### 4. Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://login.microsoftonline.com/login.srf`. - Set the **Audience** to `urn:federation:MicrosoftOnline`. - Under **Advanced protocol settings**: - Set **Signing Certificate** to use an available certificate. - Under **Property Mappings**, remove all the default **Selected User Property Mappings** and add the `IDPEmail` property mapping created in the previous section. - Set **NameID Property Mapping** to the `Microsoft Entra Immutable ID` property mapping created in the previous section. - If you created the MFA property mapping, set **AuthnContextClassRef Property Mapping** to the `AuthnContextClassRef` property mapping created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Create Application** to save the new application and provider. ### 5. Download certificate file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the SAML provider that you created in the previous section. 3. Under **Related objects** > **Download signing certificate**, click **Download**. This downloaded `.pem` file is your certificate file and is required in the next section. ## Microsoft 365 configuration You must use the [Microsoft Graph PowerShell](https://learn.microsoft.com/en-us/powershell/microsoftgraph/) module to federate your Microsoft Entra domain with authentik. The module can be installed by running the following PowerShell command: ```powershell Install-Module Microsoft.Graph -Scope CurrentUser ``` ### Set user `ImmutableId` values Before configuring federation, you need to set the `ImmutableId` for each user in Entra ID to match the identifier that authentik will send. #### For users synchronized from Active Directory If you're synchronizing users from Active Directory to authentik, the `ImmutableId` should already be set by Microsoft Entra Connect (typically from the `objectGUID`). Verify this is configured correctly before proceeding with federation. #### For cloud-only users If your users aren't synchronized from Active Directory and only exist in authentik, run the following PowerShell commands: ```powershell showLineNumbers # 1. Connect to Microsoft Graph Connect-MgGraph -Scopes "User.ReadWrite.All" # 2. Set ImmutableId for all users in the domain $users = Get-MgUser ` -All ` -Filter "endsWith(userPrincipalName,'@domain.company')" ` -ConsistencyLevel eventual ` -CountVariable userCount ` -Property Id,UserPrincipalName,OnPremisesSyncEnabled,OnPremisesImmutableId foreach ($user in $users) { if ($user.UserPrincipalName -and $user.OnPremisesSyncEnabled -ne $true) { Update-MgUser -UserId $user.Id -OnPremisesImmutableId $user.UserPrincipalName Write-Host "Set ImmutableId for $($user.UserPrincipalName)" } else { Write-Host "Skipped $($user.UserPrincipalName) because the user is still synced from on-prem" } } # 3. Verify a user's ImmutableId Get-MgUser -UserId "user@domain.company" -Property UserPrincipalName,OnPremisesImmutableId | Format-List UserPrincipalName,OnPremisesImmutableId ``` The `endsWith(...)` filter requires Microsoft Graph advanced query parameters. In Graph PowerShell, that means using both `-ConsistencyLevel eventual` and `-CountVariable` on `Get-MgUser`. If you chose a different cloud-only identifier in authentik, replace `$user.UserPrincipalName` in the update command with the same stable value that your **NameID Property Mapping** returns. ### Configure domain federation Run the following PowerShell commands to configure the federation between Microsoft Entra ID and authentik. Domain creation and DNS verification are outside the scope of this guide. Ensure your custom domain is already added and verified in Microsoft Entra ID before proceeding with this guide. ```powershell showLineNumbers # 1. Connect to Microsoft Graph Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All" # 2. Define all variables $domain = "domain.company" $PassiveLogOnUri = "https://authentik.company/application/saml//" $LogOffUri = "https://authentik.company/application/saml//" $IssuerUri = "https://authentik.company/application/saml//metadata/" $MetadataExchangeUri = $IssuerUri $ActiveSignInUri = "https://authentik.company/application/saml//" $SigningCert = (Get-Content "C:\path\to\authentik_certificate.pem" -Raw) ` -replace "-----BEGIN CERTIFICATE-----", "" ` -replace "-----END CERTIFICATE-----", "" ` -replace "\s", "" $DisplayName = $domain $FederatedIdpMfaBehavior = "acceptIfMfaDoneByFederatedIdp" # 3. Configure the federation # Note: The backtick (`) at the end of each line is PowerShell's line continuation character. Make sure to not remove this character when copying the command below. New-MgDomainFederationConfiguration ` -DomainId $domain ` -PassiveSignInUri $PassiveLogOnUri ` -SignOutUri $LogOffUri ` -IssuerUri $IssuerUri ` -MetadataExchangeUri $MetadataExchangeUri ` -SigningCertificate $SigningCert ` -DisplayName $DisplayName ` -FederatedIdpMfaBehavior $FederatedIdpMfaBehavior ` -PreferredAuthenticationProtocol "saml" ` -ActiveSignInUri $ActiveSignInUri ``` ## Configuration verification To confirm that authentik is properly configured with Microsoft 365, log out of your Microsoft account, then attempt to log back in by visiting [Microsoft 365 Portal](https://m365.cloud.microsoft/) and clicking **Sign In**. Enter an email address in your federated domain, then click **Next**. You should be redirected to authentik and, once authenticated, redirected back to Microsoft and logged in. ## Resources - [Microsoft Learn - Use a SAML 2.0 Identity Provider for Single Sign On](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-saml-idp) - [Microsoft Learn - Satisfy Microsoft Entra ID multifactor authentication controls with MFA claims from a federated IdP](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-expected-inbound-assertions) - [Microsoft Graph PowerShell - Domain Federation Configuration](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/new-mgdomainfederationconfiguration) --- ## Integrate with Microsoft 365 via WS-Federation ## What is Microsoft 365? > Microsoft 365 is a cloud-based productivity platform that includes applications and services such as Word, Excel, Outlook, OneDrive, and Teams. > > \-- [https://www.microsoft.com/microsoft-365](https://www.microsoft.com/microsoft-365) Microsoft Entra ID supports federated domain sign-in with either WS-Federation or SAML 2.0. This guide uses WS-Federation with SAML 1.1 assertions, similar to an AD FS federation. To use SAML 2.0 instead, follow the [Microsoft 365 SAML integration guide](../microsoft-saml/). The authentik WS-Federation provider supports browser-based passive authentication. It does not provide WS-Trust active authentication or Metadata Exchange (MEX) endpoints. Clients must support browser-based authentication. ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `domain.company` is the custom domain federated with Microsoft Entra ID. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. This integration requires an authentik Enterprise license. You also need: - An administrator account in authentik. - A Microsoft Entra administrator account that can update users and configure domain federation. - A custom domain that is added to and verified in Microsoft Entra ID. The default `onmicrosoft.com` domain cannot be federated. - A signing certificate in authentik. - A known immutable identifier for every user who signs in through the federated domain. Federating a domain changes authentication for every user in that domain. Keep a cloud-only administrator account on the tenant's `onmicrosoft.com` domain so that you can access Microsoft Entra ID if federation is unavailable. ## authentik configuration To support the integration of Microsoft 365 with authentik via WS-Federation, create the required property mappings and an application/provider pair. ### Create the immutable ID mapping Microsoft Entra ID uses an immutable identifier, also called the source anchor, to match the user in a SAML assertion to the corresponding Microsoft Entra user. For users synchronized by Microsoft Entra Connect, use the same source anchor that Entra Connect uses. Newer deployments commonly use `mS-DS-ConsistencyGuid`, while older deployments can use `objectGUID`. Store its base64-encoded value in an authentik user attribute such as `entra_immutable_id` during directory synchronization. For cloud-only users whose authentik email address matches their Microsoft Entra user principal name (UPN), you can use their email address if it will not change. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. - **Select type**: select **SAML Provider Property Mapping**. - **Configure the SAML Provider Property Mapping**: provide a descriptive name, such as `Microsoft Entra Immutable ID`. - **SAML Attribute Name**: `ImmutableID` - **Expression**: use the expression that matches your user source. For users synchronized from Active Directory with the source anchor stored in `entra_immutable_id`: ```python showLineNumbers # Replace entra_immutable_id if your directory source uses a different attribute. return user.attributes.get("entra_immutable_id", "") ``` For cloud-only users whose authentik email address matches their Microsoft Entra UPN: ```python showLineNumbers return user.email ``` 3. Click **Finish** to save the property mapping. The provider uses this mapping as its **NameID Property Mapping**. In a SAML 1.1 assertion, authentik places the resulting value in the `NameIdentifier` element. ### Create the `IDPEmail` mapping Microsoft Entra ID uses the `IDPEmail` claim to identify the user's UPN. 1. In the authentik Admin interface, navigate to **Customization** > **Property Mappings** and click **Create**. 2. Configure the mapping: - **Select type**: select **SAML Provider Property Mapping**. - **Configure the SAML Provider Property Mapping**: provide a descriptive name, such as `Microsoft Entra IDPEmail`. - **SAML Attribute Name**: `IDPEmail` - **Expression**: ```python showLineNumbers # Prefer the synchronized UPN, then fall back to the authentik email address. return user.attributes.get("upn", user.email) ``` 3. Click **Finish** to save the property mapping. ### Configure the federated MFA claim *(optional)* Microsoft Entra ID can accept MFA performed by authentik when the SAML 1.1 authentication statement contains the `multipleauthn` authentication method. The mapping in this section unconditionally tells Microsoft Entra ID that authentik performed MFA. Only use it when the authorization flow assigned to this provider requires MFA for every user. 1. In the authentik Admin interface, navigate to **Customization** > **Property Mappings** and click **Create**. 2. Configure the mapping: - **Select type**: select **SAML Provider Property Mapping**. - **Configure the SAML Provider Property Mapping**: provide a descriptive name, such as `Microsoft Entra MFA authentication method`. - **SAML Attribute Name**: `AuthnContextClassRef` - **Expression**: ```python showLineNumbers return "http://schemas.microsoft.com/claims/multipleauthn" ``` 3. Click **Finish** to save the property mapping. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **WS-Federation Provider**. - **Configure the Provider**: provide a name, select an authorization flow, and configure the following settings: - **Reply URL**: `https://login.microsoftonline.com/login.srf` - **Realm**: `urn:federation:MicrosoftOnline` - Under **Advanced protocol settings**: - **Signing Certificate**: select an available certificate. - **Property mappings**: remove the default selected mappings, then add the `Microsoft Entra Immutable ID` and `Microsoft Entra IDPEmail` mappings. - **NameID Property Mapping**: select `Microsoft Entra Immutable ID`. - **AuthnContextClassRef Property Mapping**: if you created the optional MFA mapping, select `Microsoft Entra MFA authentication method`. - **SAML assertion version**: select **SAML 1.1**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Create Application** to save the application and provider. ### Download the signing certificate 1. In the authentik Admin interface, navigate to **Applications** > **Providers** and open the WS-Federation provider that you created. 2. Under **Related objects** > **Download signing certificate**, click **Download**. 3. Save the downloaded PEM file. You need its path when configuring Microsoft Entra ID. ## Microsoft 365 configuration Use Microsoft Graph PowerShell to set each user's immutable ID and federate the Microsoft Entra domain with authentik. Install the Microsoft Graph PowerShell SDK: ```powershell Install-Module Microsoft.Graph -Scope CurrentUser ``` ### Set user immutable IDs The immutable ID stored in Microsoft Entra ID must exactly match the value returned by the authentik **NameID Property Mapping**. For users synchronized by Microsoft Entra Connect, the `OnPremisesImmutableId` value is managed by Entra Connect. Verify that your authentik mapping returns the same source anchor and do not update these users with the commands below. For cloud-only users whose UPN is the identifier returned by authentik, run the following commands: ```powershell showLineNumbers Connect-MgGraph -Scopes "User.ReadWrite.All" $users = Get-MgUser ` -All ` -Filter "endsWith(userPrincipalName,'@domain.company')" ` -ConsistencyLevel eventual ` -CountVariable userCount ` -Property Id,UserPrincipalName,OnPremisesSyncEnabled,OnPremisesImmutableId foreach ($user in $users) { if ($user.UserPrincipalName -and $user.OnPremisesSyncEnabled -ne $true) { Update-MgUser -UserId $user.Id -OnPremisesImmutableId $user.UserPrincipalName Write-Host "Set immutable ID for $($user.UserPrincipalName)" } else { Write-Host "Skipped $($user.UserPrincipalName) because the user is synchronized from on-premises" } } Get-MgUser -UserId "user@domain.company" -Property UserPrincipalName,OnPremisesImmutableId | Format-List UserPrincipalName,OnPremisesImmutableId ``` The `endsWith(...)` filter requires Microsoft Graph advanced query parameters. The `-ConsistencyLevel eventual` and `-CountVariable` arguments enable those parameters. If the authentik **NameID Property Mapping** returns a different identifier, replace `$user.UserPrincipalName` in the update command with that value. ### Configure domain federation Domain creation and DNS verification are outside the scope of this guide. Confirm that `domain.company` is already added and verified in Microsoft Entra ID before continuing. Set the path in `$SigningCertificate` to the PEM file that you downloaded from authentik, then run the following commands: ```powershell showLineNumbers # 1. Connect to Microsoft Graph Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All" # 2. Define all variables $domain = "domain.company" $passiveSignInUri = "https://authentik.company/application/wsfed/" $signOutUri = "https://authentik.company/application/wsfed//" $issuerUri = "https://authentik.company/application/saml//metadata/" $metadataExchangeUri = "https://authentik.company/application/wsfed//metadata/" $activeSignInUri = "https://authentik.company/application/wsfed/" $signingCert = (Get-Content "C:\path\to\authentik_certificate.pem" -Raw) ` -replace "-----BEGIN CERTIFICATE-----", "" ` -replace "-----END CERTIFICATE-----", "" ` -replace "\s", "" $displayName = $domain $federatedIdpMfaBehavior = "acceptIfMfaDoneByFederatedIdp" # 3. Configure the federation # Note: The backtick (`) at the end of each line is PowerShell's line continuation character. Make sure to not remove this character when copying the command below. New-MgDomainFederationConfiguration ` -DomainId $domain ` -PassiveSignInUri $passiveSignInUri ` -SignOutUri $signOutUri ` -IssuerUri $issuerUri ` -MetadataExchangeUri $metadataExchangeUri ` -SigningCertificate $signingCert ` -DisplayName $displayName ` -FederatedIdpMfaBehavior $federatedIdpMfaBehavior ` -PreferredAuthenticationProtocol "wsFed" ` -ActiveSignInUri $activeSignInUri ``` ## Configuration verification To confirm that authentik is properly configured with Microsoft 365, open Microsoft 365 and sign in with a user in the federated domain. Microsoft should redirect you to authentik and return you to Microsoft 365 after authentication. ## Resources - [Microsoft Learn - Create an internal domain federation](https://learn.microsoft.com/en-us/graph/api/domain-post-federationconfiguration) - [Microsoft Learn - Design concepts for the Microsoft Entra source anchor](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/plan-connect-design-concepts#sourceanchor) - [Microsoft Learn - Satisfy Microsoft Entra MFA controls with claims from a federated IdP](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-expected-inbound-assertions) - [Microsoft Graph PowerShell - New-MgDomainFederationConfiguration](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/new-mgdomainfederationconfiguration) --- ## Integrate with Personio ## What is Personio? > Personio is an HR software platform for managing core HR processes such as recruiting, onboarding, payroll, time tracking, and performance management. > > \-- [https://www.personio.com/](https://www.personio.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Personio with authentik, you need to create an application/provider pair in authentik. ### Copy the Personio callback URL 1. Log in to Personio as an administrator. 2. Navigate to **Settings** > **Security & integrations** > **Security & authentication**. 3. From the list of login methods, go to **Open ID Connect (OIDC)** and click **Configure**. 4. Under **Provider settings**, copy the **Callback URLs/Redirect URIs** value. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - Set the **Client type** to `Confidential`. - Add two **Redirect URIs** of type `Strict` `Authorization`: - The **Callback URLs/Redirect URIs** value from Personio. - `https://login.personio.com/login/callback` - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Personio configuration 1. Log in to Personio as an administrator. 2. Navigate to **Settings** > **Security & integrations** > **Security & authentication**. 3. From the list of login methods, go to **Open ID Connect (OIDC)** and click **Configure**. 4. Under **Configuration**, enter the following values: - **Button Display Text**: `Continue with authentik` - **Issuer**: `https://authentik.company/application/o//` - **Authorization URI**: `https://authentik.company/application/o/authorize/` - **Token URI**: `https://authentik.company/application/o/token/` - **Userinfo URI**: `https://authentik.company/application/o/userinfo/` - **JSON Web Key Set URI**: `https://authentik.company/application/o//jwks/` - **Scopes**: `openid,email` - **Client ID**: the Client ID from the authentik provider. - **Client Secret**: the Client Secret from the authentik provider. - **Claim Field**: `email` 5. Submit the changes and enable the connection. Personio matches incoming users by the value of the configured **Claim Field**. Make sure each employee has an active Personio profile and that the email address returned by authentik matches the email address of the corresponding Personio employee, otherwise the SSO login will fail. ## Configuration verification To confirm that authentik is properly configured with Personio, open Personio and click **Continue with authentik**. You should be redirected to authentik to log in, then redirected back to Personio. You can also use the **Test** button on the Personio OIDC configuration screen to validate the connection without logging out. ## Resources - [Personio Help Center - Set up your company's authentication method](https://support.personio.de/hc/en-us/articles/360000019129-Set-up-your-company-s-authentication-method) - [Personio Help Center - Set up single sign-on in Personio with Microsoft Entra ID using OpenID Connect](https://support.personio.de/hc/en-us/articles/4411236757521-Set-up-single-sign-on-in-Personio-with-Microsoft-Entra-ID-using-OpenID-Connect) - [Personio Help Center - Troubleshoot SSO login issues](https://support.personio.de/hc/en-us/articles/21947067413149-Troubleshoot-SSO-login-issues) --- ## Integrate with PocketBase ## What is PocketBase? > PocketBase is an open source backend consisting of an embedded SQLite database, realtime subscriptions, built-in auth management, a dashboard UI, and a REST-like API. > > \-- [https://pocketbase.io](https://pocketbase.io) ## Preparation The following placeholders are used in this guide: - `pocketbase.company` is the FQDN of the PocketBase installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of PocketBase with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://pocketbase.company/api/oauth2-redirect`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## PocketBase configuration 1. Sign in to the PocketBase superuser dashboard at `https://pocketbase.company/_/`. 2. If collection controls are locked, navigate to **Settings** > **Application**, disable **Hide/Lock collection and record controls**, and click **Save changes**. 3. Navigate to **Collections** and open the **users** auth collection. 4. Click the gear icon next to the collection name and select the **Options** tab. 5. Open the **OAuth2** section and click **Add provider**. 6. Select **OIDC** and enter the following values: - **Client ID**: enter the **Client ID** from authentik. - **Client secret**: enter the **Client Secret** from authentik. - **Display name**: `authentik` - **Auth URL**: `https://authentik.company/application/o/authorize/` - **Token URL**: `https://authentik.company/application/o/token/` - **User info URL**: `https://authentik.company/application/o/userinfo/` 7. Click **Set provider config**. 8. Click **Save changes**. ## Configuration verification To confirm that authentik is properly configured with PocketBase, open your application and sign in with the authentik OAuth2 provider. ## Resources - [PocketBase documentation - Authenticate with OAuth2](https://pocketbase.io/docs/authentication/#authenticate-with-oauth2) - [PocketBase source - OIDC provider](https://github.com/pocketbase/pocketbase/blob/master/tools/auth/oidc.go) - [PocketBase source - OAuth2 redirect route](https://github.com/pocketbase/pocketbase/blob/master/apis/record_auth.go) --- ## Integrate with Productive ## What is Productive? > Productive is a professional services automation platform for agencies, consultancies, and other service businesses. It includes tools for resource planning, time tracking, project management, CRM, budgeting, invoicing, forecasting, and reporting. > > \-- [https://productive.io/](https://productive.io/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Single Sign-On (SSO) is available on all Productive plans. Enforcing SSO and SCIM provisioning require Productive's Ultimate plan. To let Productive create users automatically from SSO or SCIM, make sure each authentik user has an email address and a full name with a first and last name. Before enabling SCIM, make sure your Productive workspace has enough seats for the users that will be synchronized. ## authentik configuration To support the integration of Productive with authentik, you need to create two property mappings and an application/provider pair in authentik. For optional SCIM provisioning, create the SCIM property mapping now. After you enable SSO and SCIM in Productive, return to the optional SCIM provider sections to finish the authentik configuration. ### Create property mappings Productive expects the SAML assertion to include `first_name` and `last_name` attributes. Because authentik stores a user's full name as a single string, create SAML provider property mappings that split the full name into first and last names. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `Productive first name` - **SAML Attribute Name**: `first_name` - **Expression**: ```python name = request.user.name or request.user.username return name.split(" ", 1)[0] ``` 5. Click **Finish**. 6. Repeat steps 2-5 to create the following additional SAML provider property mapping: - **Name**: `Productive last name` - **SAML Attribute Name**: `last_name` - **Expression**: ```python name = request.user.name or request.user.username return name.rsplit(" ", 1)[-1] if " " in name else "" ``` ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set **ACS URL** and **Audience** to `https://temp.temp`. You will replace these values after completing the Productive configuration. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Toggle on **Sign responses**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Under **Property mappings**, add the property mappings that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. If you add the SCIM provider as a backchannel provider later, only users who can view this application are synchronized. 3. Click **Submit** to save the new application and provider. ### Create a SCIM property mapping *(optional)* authentik can also provision Productive users with SCIM. SCIM requires SSO to be configured first. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SCIM Provider Mapping** as the property mapping type and click **Next**. 4. Set the following values: - **Name**: `Productive SCIM user` - **Expression**: ```python name = request.user.name or request.user.username given_name, family_name = name, " " formatted = name + " " if " " in name: given_name, _, family_name = name.partition(" ") formatted = name user_name = request.user.email or request.user.username emails = [] if request.user.email: emails = [{ "value": request.user.email, "type": "work", "primary": True, }] return { "userName": user_name, "name": { "formatted": formatted, "givenName": given_name, "familyName": family_name, }, "active": request.user.is_active, "emails": emails, } ``` 5. Click **Finish**. ### Create a SCIM provider *(optional)* Complete this section after you enable SCIM in Productive and copy its **Base URL** and **Bearer Token**. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **Create** to open the provider wizard. - **Choose a Provider type**: select **SCIM Provider** as the provider type. - **Configure the Provider**: provide a name for the provider, and the following required configurations. - **URL**: the **Base URL** value from Productive. - **Token**: the **Bearer Token** value from Productive. - Under **Attribute mapping**: - Remove `authentik default SCIM Mapping: User` from **Selected User Property Mappings** and add `Productive SCIM user`. 3. Click **Finish** to save the provider. ### Set the SCIM provider as a backchannel provider *(optional)* 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click the name of your Productive application. 3. Click the plus (+) icon next to **Backchannel Providers** and select the SCIM provider that you created in the previous section. 4. Click **Save Changes**. ## Productive configuration ### Configure SAML SSO 1. Log in to [Productive](https://app.productive.io/) as an administrator. 2. Navigate to **Settings** > **SSO and SCIM**. 3. Copy the **Single Sign-On URL** and **Audience URI** values. You will use these values in the next section. 4. Keep the Productive SSO settings open. ### Update the authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the provider that you created in the previous step. 3. Click **Edit**. 4. Under **Protocol settings**, set **ACS URL** to the **Single Sign-On URL** value from Productive. Then, set **Audience** to the **Audience URI** value from Productive. 5. Click **Update**. ### Enable SSO 1. Return to the Productive **SSO and SCIM** page. 2. Set the following values: - **Metadata URL**: `https://authentik.company/application/saml//metadata/` - **Identity Provider Single Sign-On URL**: `https://authentik.company/application/saml//` 3. Click **Enable SSO**. ### Enable SCIM *(optional)* 1. Log in to [Productive](https://app.productive.io/) as an administrator. 2. Navigate to **Settings** > **Single Sign-On** > **SCIM**. 3. Open the **SCIM** section and click **Enable SCIM**. 4. Copy the **Base URL** and **Bearer Token** values. 5. Return to the optional **Create a SCIM provider** section under **authentik configuration** to finish the SCIM setup. ## Configuration verification To confirm that authentik is properly configured with Productive, open Productive in a private or incognito browser window. Click **Use Single Sign-On (SSO)**, sign in with authentik, and confirm that you are redirected back to Productive. To confirm that SCIM is properly configured, open the Productive SCIM provider in authentik and click the run button on the **Full sync for SCIM provider** task. After the sync completes, verify that users with access to the Productive application are provisioned in Productive. ## Resources - [Productive Help Center - Single Sign-On (SSO) Options: Overview](https://help.productive.io/en/articles/4362408-single-sign-on-sso-options-overview) - [Productive Help Center - Enabling SSO Using Microsoft Entra](https://help.productive.io/en/articles/5148311-enabling-sso-using-microsoft-entra) - [Productive Help Center - Enabling SSO Using Google Workspace](https://help.productive.io/en/articles/4443738-enabling-sso-using-google-workspace) - [Productive Help Center - Automatically Sync Users Between Microsoft Entra and Productive with SCIM](https://help.productive.io/en/articles/10586327-automatically-sync-users-between-microsoft-entra-and-productive-with-scim) - [Productive Help Center - Configuring Optional SCIM Attribute Mappings in Microsoft Entra](https://help.productive.io/en/articles/11728308-configuring-optional-scim-attribute-mappings-in-microsoft-entra) --- ## Integrate with Salesforce ## What is Salesforce? > Salesforce is a cloud-based CRM platform that provides sales, service, marketing, and analytics applications. > > \-- [https://salesforce.com](https://salesforce.com) ## Preparation The following placeholders are used in this guide: - `company.my.salesforce.com` is the FQDN of your Salesforce organization. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Salesforce with authentik, you must create property mappings for Just-in-Time (JIT) user provisioning and an application/provider pair. ### Create property mappings Salesforce JIT provisioning requires specific SAML attributes to create users on first login. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Create five **SAML Provider Property Mapping**s with the following settings: - **Username mapping**: - **Name**: `Salesforce username` - **SAML Attribute Name**: `User.Username` - **Expression**: ```python return request.user.email ``` - **Email mapping**: - **Name**: `Salesforce email` - **SAML Attribute Name**: `User.Email` - **Expression**: ```python return request.user.email ``` - **Last name mapping**: - **Name**: `Salesforce last name` - **SAML Attribute Name**: `User.LastName` - **Expression**: ```python return request.user.name.split()[-1] if request.user.name else "User" ``` - **Profile ID mapping**: - **Name**: `Salesforce profile ID` - **SAML Attribute Name**: `User.ProfileId` - **Expression**: ```python return "00eXXXXXXXXXXXXXXX" # Replace with your Salesforce Profile ID ``` To find your Salesforce Profile ID, in Salesforce, navigate to **Setup** > **Users** > **Profiles**, click the profile, and copy the 18-character ID from the URL. Profile IDs start with `00e`. - **Federation identifier mapping**: - **Name**: `Salesforce federation identifier` - **SAML Attribute Name**: `User.FederationIdentifier` - **Expression**: ```python return request.user.email ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** as it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **ACS URL** to `https://company.my.salesforce.com?so=00DXXXXXXXXXXXXXXX`, replacing `00DXXXXXXXXXXXXXXX` with your Salesforce Organization ID. - Set **Audience** to `https://company.my.salesforce.com`. - Set **SLS URL** to `https://company.my.salesforce.com/services/auth/sp/saml2/logout`. - Set **SLS Binding** to `Redirect`. - Set **Logout Method** to `Front-channel (Iframe)`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Add all five property mappings that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download certificate file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created in the previous section. 3. Under **Related objects** > **Download signing certificate**, click **Download**. This downloaded file is required in the next section. ## Salesforce configuration ### Enable SAML Single Sign-On 1. Log in to your Salesforce organization as an administrator. 2. Navigate to **Setup** > **Identity** > **Single Sign-On Settings**. 3. Click **Edit** and enable **SAML Enabled**. 4. Click **Save**. ### Create a new SAML Single Sign-On configuration 1. On the **Single Sign-On Settings** page, under **SAML Single Sign-On Settings**, click **New**. 2. Enter the following values: - **Name**: `authentik` - **Issuer**: `https://authentik.company/application/saml//metadata/` - **Entity ID**: `https://company.my.salesforce.com` - **Identity Provider Certificate**: upload the signing certificate that you downloaded from authentik. - **Request Signature Method**: `RSA-SHA256` - **SAML Identity Type**: select **Assertion contains the Federation ID from the User object**. - **SAML Identity Location**: select **Identity is in the NameIdentifier element of the Subject statement**. - **Service Provider Initiated Request Binding**: `HTTP POST` - **Identity Provider Login URL**: enter the **SAML Endpoint** from the SAML provider that you created in authentik. - **Identity Provider Single Logout URL**: `https://authentik.company/application/saml//` - **Single Logout Request Binding**: `HTTP Redirect` 3. Click **Save**. ### Enable Just-in-Time provisioning 1. On the SAML Single Sign-On configuration page that you just created, click **Edit**. 2. Under **Just-in-Time User Provisioning**, check **User Provisioning Enabled**. 3. Select **Standard** for the provisioning type. 4. Click **Save**. ### Add authentik to the My Domain login page 1. In Salesforce **Setup**, search for **My Domain**. 2. Under **Authentication Configuration**, click **Edit**. 3. Select the `authentik` authentication service. 4. Click **Save**. ## Salesforce as an OAuth source You can configure Salesforce as an OAuth source to allow users to log in to authentik using their Salesforce credentials. Optionally, this can be used alongside [SCIM provisioning](#scim-provisioning-optional) to keep your Salesforce users in sync with your authentik users. ### Salesforce configuration #### Create an external client app 1. Log in to your Salesforce organization as an administrator. 2. Navigate to **Setup** and search for **App Manager**. 3. Click **New External Client App**. 4. Fill in the basic information: - **External Client App Name**: `authentik` - **API Name**: `authentik` - **Contact Email**: your email address. 5. Under **API (Enable OAuth Settings)**, configure the following settings: - Check **Enable OAuth**. - Set **Callback URL** to `https://authentik.company/source/oauth/callback//`, replacing `` with the slug you will use when creating the OAuth Source in authentik, for example `salesforce`. - Under **Selected OAuth Scopes**, add: - `Allow access to your unique identifier (openid)` - `Manage user data via APIs (api)` - Check **Enable Client Credentials Flow** if you plan to use SCIM with OAuth authentication. - Check **Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows** if available. 6. Click **Save**. #### Configure client credentials flow *(required for SCIM with OAuth)* If you plan to use [SCIM provisioning](#scim-provisioning-optional) with OAuth authentication: 1. Navigate to **Setup** > **External Client App Manager**. 2. Find your external client app and open it. 3. Click **Edit Policies**. 4. Under **Client Credentials Flow**: - Set **Run As** to an admin user that has permissions to manage users. 5. Click **Save**. #### Get the consumer key and secret 1. Navigate to **Setup** > **External Client App Manager**. 2. Find your external client app and open it. 3. Under **Settings** > **OAuth Settings**, click **Consumer Key and Secret**. 4. Copy the **Consumer Key** and **Consumer Secret**. ### authentik configuration #### Create an OAuth source 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Federation and Social login** and click **Create**. 3. Select **OpenID OAuth Source** and click **Next**. 4. Enter the following values: - **Name**: `Salesforce` - **Slug**: `salesforce` - **Consumer key**: paste the Consumer Key from Salesforce. - **Consumer secret**: paste the Consumer Secret from Salesforce. - **Authorization URL**: `https://company.my.salesforce.com/services/oauth2/authorize` - **Access Token URL**: `https://company.my.salesforce.com/services/oauth2/token` - **Profile URL**: `https://company.my.salesforce.com/services/oauth2/userinfo` - **Scopes**: `*openid api` - **PKCE Method**: select **S256**. 5. Click **Finish** to save the source. ## SCIM provisioning *(optional)* You can configure SCIM provisioning to sync users from authentik to Salesforce. This guide covers OAuth2 SCIM integration, which requires an enterprise authentik account. ### Create SCIM property mappings Salesforce requires specific SCIM attributes that are not included in the default mappings. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Create two **SCIM Provider Mapping**s with the following settings: - **Profile ID mapping**: - **Name**: `Salesforce SCIM: Profile ID` - **Expression**: ```python return { "entitlements": [ { "value": "00eXXXXXXXXXXXXXXX" # Replace with your Salesforce Profile ID } ] } ``` To find your Salesforce Profile ID, in Salesforce, navigate to **Setup** > **Users** > **Profiles**, click the profile, and copy the 18-character ID from the URL. Profile IDs start with `00e`. - **Username mapping**: - **Name**: `Salesforce SCIM: Username` - **Expression**: ```python return { "userName": request.user.email } ``` ### Create a SCIM provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **Create**. 3. Select **SCIM Provider** as the provider type and click **Next**. 4. Enter the following values: - **URL**: `https://company.my.salesforce.com/services/scim/v2` - **Authentication Mode**: select **OAuth (Silent)**. - **OAuth Source**: select the Salesforce OAuth Source you created earlier. - **OAuth Parameters**: ```yaml grant_type: client_credentials ``` - **Compatibility Mode**: select **Salesforce**. - **User Property Mappings**: keep `authentik default SCIM Mapping: User` selected, then add the `Salesforce SCIM: Profile ID` and `Salesforce SCIM: Username` mappings. 5. Click **Finish** to save the provider. ### Add the SCIM provider to your application 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and create or select your Salesforce application. 3. Click **Edit**. 4. In the **Backchannel Providers** field, select the SCIM provider you created. 5. Click **Update** to save the application. ## Configuration verification To confirm that authentik is properly configured with Salesforce, open the Salesforce application in authentik and confirm that you can sign in. If you configured JIT provisioning, test with a user that does not already exist in Salesforce and confirm that Salesforce creates the user. If you configured SCIM, open the SCIM provider and click **Run sync again**. After the sync completes, confirm that the user is provisioned in Salesforce. ## Resources - [Salesforce Help - Configure SSO with Salesforce as a SAML Service Provider](https://help.salesforce.com/s/articleView?id=sf.sso_saml.htm\&type=5) - [Salesforce Help - Just-in-Time SAML Assertion Fields for Salesforce](https://help.salesforce.com/s/articleView?id=sf.sso_jit_requirements.htm\&type=5) - [Salesforce Help - Add Identity Providers to the My Domain Login Page](https://help.salesforce.com/s/articleView?id=sf.domain_name_login_id_prov.htm\&type=5) - [Salesforce Help - SCIM User Provisioning](https://help.salesforce.com/s/articleView?id=sf.identity_scim_overview.htm\&type=5) - [Salesforce Help - SCIM and REST API Reference Sheet](https://help.salesforce.com/s/articleView?id=sf.identity_scim_rest_api.htm\&type=5) - [Salesforce Help - External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm\&type=5) --- ## Integrate with Stripe ## What is Stripe? > Stripe is a financial infrastructure platform that enables businesses to accept online and in-person payments, embed financial services, and build custom revenue models. > > \-- [https://stripe.com](https://stripe.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `example.com` is the email domain that you verify for Stripe SSO. - `stripe_account_id` is the Stripe account ID to configure, such as `acct_...`. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Stripe requires a verified email domain before SSO can be enabled. ## authentik configuration To support the integration of Stripe with authentik, create a group, a property mapping, and an application/provider pair in authentik. ### Create a user group Use a group attribute to define the Stripe role that authentik sends for each user. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups** and click **Create**. 3. Set a descriptive group name, such as `Stripe Admins`. 4. In the **Attributes** field, set the Stripe role for members of this group: ```yaml stripe_role: admin ``` Use the Stripe role value that members of this group should receive, such as `admin`, `developer`, or `view_only`. Stripe lists the available role values in their [SSO documentation](https://docs.stripe.com/get-started/account/sso/other#configuring-your-identity-provider). 5. Click **Create**. 6. Click the name of the newly created group and navigate to the **Users** tab. 7. Click **Add existing user**, select the user that needs Stripe access, and click **Add**. ### Create a property mapping authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** and click **Next**. 4. Configure the property mapping with the following settings: - **Name**: `Stripe Role` - **SAML Attribute Name**: `Stripe-Role-` - **Friendly Name**: leave blank. - **Expression**: ```python return request.user.group_attributes(request).get("stripe_role", "") ``` 5. Click **Finish** to save the property mapping. For organization-level SSO, use `Stripe-Role-` as the SAML attribute name instead of `Stripe-Role-`. ### Create an application and provider pair 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **Slug** value because it is required later. - Under **UI Settings**, set **Launch URL** to `https://dashboard.stripe.com/login/saml_direct/domain/example.com/merchant/`. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://dashboard.stripe.com/login/saml/consume`. - Set the **Audience** to `https://dashboard.stripe.com/saml/metadata`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Add the `Stripe Role` property mapping to **Selected User Property Mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created. 2. Under **Related objects** > **Download signing certificate**, click **Download**. This certificate file is required in the next section. ## Stripe configuration This guide expects that you have already verified `example.com` for SSO in Stripe. 1. Log in to the [Stripe Dashboard](https://dashboard.stripe.com/) as an administrator. 2. Click the **Settings** cogwheel, then navigate to **Team and security** > **Single sign-on (SSO)**. 3. Open the SSO settings for your verified domain. 4. Enter the following settings: - **Identity provider URL**: `https://authentik.company/application/saml//` - **Issuer ID**: `https://authentik.company/application/saml//metadata/` - **Identity provider certificate**: paste the contents of the authentik signing certificate. 5. Click **Test** and complete the SSO test with a Stripe user whose email address belongs to the verified domain and who has the required Stripe role attribute from authentik. 6. If the test succeeds, save the settings and choose the appropriate **SSO enforcement** mode. Do not require SSO until the users who need Stripe access are assigned to the Stripe application in authentik and receive a valid Stripe role attribute. If users do not receive a valid role attribute, Stripe rejects the login. ## Configuration verification To confirm that authentik is properly configured with Stripe, open the Stripe application from the authentik Application Dashboard. You should be redirected to authentik for authentication and then to the Stripe Dashboard. ## Resources - [Stripe Docs - Single sign-on with SAML Identity Provider](https://docs.stripe.com/get-started/account/sso/other) - [Stripe Docs - Organization-level SSO](https://docs.stripe.com/get-started/account/orgs/sso) - [Stripe Docs - Troubleshoot SSO](https://docs.stripe.com/get-started/account/sso/troubleshooting) --- ## Integrate with ToolJet ## What is ToolJet? > ToolJet is a low-code platform for building internal tools and business applications. > > \-- [https://tooljet.com/](https://tooljet.com/) ## Preparation The following placeholder is used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ToolJet's OIDC SSO is available on the Team plan. To configure instance-level SSO, you must be a ToolJet super administrator. To configure workspace-level SSO, you must be a ToolJet workspace administrator. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of ToolJet with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they are required later. - Add a **Redirect URI** of type `Strict` `Authorization` with a temporary value of `https://temp.temp`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## ToolJet configuration ### Generate the redirect URL 1. Log in to ToolJet with the required administrator role. 2. Click the settings icon in the lower-left corner and open the login settings for the required scope: - For instance-level SSO, navigate to **Settings** > **Instance login**. - For workspace-level SSO, navigate to **Workspace Settings** > **Workspace login**. 3. Enable **OpenID Connect**. 4. In the modal, select **App provider** and enable the provider using the toggle in the upper-right corner. 5. Click **Save changes** without entering the provider settings. ToolJet generates a **Redirect URL**. 6. Open the OpenID Connect modal again and copy the **Redirect URL**. ### Update the authentik provider 1. In a separate browser tab, log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the provider that you created for ToolJet. 3. Replace the temporary **Redirect URI** with the **Redirect URL** that you copied from ToolJet. Keep the URI type set to `Strict` `Authorization`. 4. Click **Update** to save the provider. ### Complete the OIDC configuration Return to the OpenID Connect modal in ToolJet and configure the following settings: - **Name**: `authentik` - **Grant type**: `Authorization Code` - **Client ID**: Client ID from authentik - **Client Secret**: Client Secret from authentik - **Well known URL**: `https://authentik.company/application/o//.well-known/openid-configuration` Ensure that the provider is enabled and click **Save changes**. ## Configuration verification To confirm that authentik is properly configured with ToolJet, open ToolJet and click **Sign in with authentik**. You should be redirected to authentik and returned to ToolJet after authentication. ## Resources - [ToolJet Docs - OpenID Connect setup](https://docs.tooljet.com/docs/user-management/sso/oidc/setup/) --- ## Integrate with WordPress ## What is WordPress? > WordPress is an open source publishing platform used to create websites, blogs, and other web content. > > \-- [https://wordpress.org/](https://wordpress.org/) There are many WordPress plugins that support SSO with different authentication protocols. This guide uses the **OpenID Connect Generic Client** plugin by Jonathan Daggerhart from the WordPress Plugin Directory. ## Preparation The following placeholders are used in this guide: - `wp.company` is the FQDN of the WordPress installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of WordPress with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Set the **Launch URL** to `https://wp.company/wp-login.php`. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and application **slug** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://wp.company/wp-admin/admin-ajax.php?action=openid-connect-authorize`. - Select any available signing key. - Under **Advanced protocol settings** > **Scopes**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to the **Selected Scopes** list. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. If WordPress is installed in a subdirectory, use the **Redirect URI** shown in the OpenID Connect Generic Client plugin's **Notes** section instead of the example redirect URI. ## WordPress configuration This guide assumes that you have installed and activated the **OpenID Connect Generic Client** plugin. 1. Log in to WordPress as an administrator. 2. In the WordPress dashboard, navigate to **Settings** > **OpenID Connect Client**. 3. Expand **Quick Setup: Import from Discovery Document** and set the **Discovery URL** to `https://authentik.company/application/o//.well-known/openid-configuration`. 4. Click **Load Configuration**. 5. Review the populated endpoint settings, then configure the following settings: - **Client ID**: `` - **Client Secret Key**: `` - **OpenID Scope**: `email profile openid offline_access` 6. Click **Save Changes**. The `offline_access` scope lets WordPress use refresh tokens for longer-lived sessions. Review the WordPress plugin's optional settings for your environment. Common settings include **Link Existing Users**, **Create user if does not exist**, and **Enforce Privacy**. ## Configuration verification To confirm that authentik is properly configured with WordPress, log out of WordPress and open the WordPress integration from authentik. On the WordPress login page, click **Login with OpenID Connect** and authenticate with authentik. ## Resources - [WordPress.org](https://wordpress.org/) - [OpenID Connect Generic Client WordPress plugin](https://wordpress.org/plugins/daggerhart-openid-connect-generic/) - [OpenID Connect Generic Client GitHub repository](https://github.com/oidc-wp/openid-connect-generic) --- ## Integrate with Zoho ## What is Zoho? > Zoho provides a suite of cloud applications for business operations, including email, collaboration, CRM, finance, HR, and analytics tools. > > \-- [https://www.zoho.com](https://www.zoho.com) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `accounts.zoho.com` is the Zoho Accounts URL for your organization's data center. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Use the Zoho Accounts URL that matches your organization's data center: - United States: `https://accounts.zoho.com` - Australia: `https://accounts.zoho.com.au` - Europe: `https://accounts.zoho.eu` - India: `https://accounts.zoho.in` - China: `https://accounts.zoho.com.cn` - Japan: `https://accounts.zoho.jp` - Canada: `https://accounts.zohocloud.ca` - Saudi Arabia: `https://accounts.zoho.sa` ## Download Zoho metadata file 1. Log in to Zoho Accounts as an administrator at the Zoho Accounts URL for your data center. 2. Navigate to **Organization** > **SAML Authentication**. 3. Click **Download Metadata**. You will require this Zoho metadata file in the next section. ## authentik configuration To support the integration of Zoho with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider from Metadata** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization and invalidation flows to use for this provider, and the following required configuration: - **Metadata**: select the Zoho metadata file that you downloaded in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Navigate to **Applications** > **Providers** and click the **Edit** icon of the Zoho provider. 5. Configure the following settings: - Confirm that the **SLS URL** and **SLS Binding** were imported from the Zoho metadata file, then set **Logout Method** to `Front-channel (Iframe)`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. 6. Click **Update**. ### Download authentik metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created for Zoho. 3. Under **Related objects** > **Metadata**, click on **Download**. You will require this authentik metadata file in the next section. ## Zoho configuration 1. Log in to Zoho Accounts as an administrator using your Zoho Accounts URL. 2. Navigate to **Organization** > **SAML Authentication**, and under **SAML Authentication** select **Set up Now**. 3. Click **Upload Metadata** and upload your authentik metadata file. 4. Ensure **Single Logout** is enabled so that signing out of authentik also signs users out of Zoho. Zoho uses the logout endpoint advertised in the authentik metadata that you uploaded. 5. In **Zoho Service**, select the Zoho service that users should open after IdP-initiated sign-in from authentik. 6. Click **Submit**. If you do not enable Zoho's Just-in-Time provisioning, users must already exist in your Zoho organization before they can sign in with authentik. If you enable Just-in-Time provisioning, Zoho validates the SAML response and the user's domain before adding the user. Domain verification and user-field mapping in Zoho are outside the scope of this guide. ## Configuration verification To confirm that authentik is properly configured with Zoho, open the Zoho integration from the authentik Application Dashboard. You should be redirected to Zoho and signed in to the Zoho service you selected during the Zoho configuration. You can also test the SP-initiated flow by opening the Zoho sign-in page for your data center, entering the email address of an account that exists in both Zoho and authentik, and selecting the SAML sign-in option when prompted. You should be redirected to authentik to authenticate, then back to Zoho. ## Resources - [Zoho Help - Configure SAML in Zoho Accounts](https://help.zoho.com/portal/en/kb/accounts/manage-your-organization/saml/articles/configure-saml-in-zoho-accounts#Configure_SAML_in_your_IdP_using_Zohos_Metadata) - [Zoho Help - SAML terminology](https://help.zoho.com/portal/en/kb/accounts/manage-your-organization/saml/articles/saml-terminologies) - [Zoho Help - Data center for Zoho Account](https://help.zoho.com/portal/en/kb/accounts/manage-your-zoho-account/articles/data-center-for-zoho-account) - [Zoho China Help - Configure SAML in Zoho Accounts](https://www.zoho.com.cn/accounts/help/saml/configure-zoho-accounts.html) --- ## Integrate with 1Password ## What is 1Password? > 1Password is a password management tool that simplifies the process of creating, storing, and sharing passwords. It allows you to create strong, unique passwords, securely store them in a vault, and automatically fill them in when needed. > > \-- [https://1password.com/](https://1password.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `your-domain.1password.com` is your 1Password sign-in address. If your account uses another region or the enterprise region, replace it with your full sign-in address, such as `your-domain.1password.ca`, `your-domain.1password.eu`, or `your-domain.ent.1password.com`. - `scim-bridge.company` is the FQDN of the 1Password SCIM Bridge *(optional)*. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of 1Password with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set **Client Type** to `Public`. - Note the **Client ID** and **slug** values because they will be required later. - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://your-domain.1password.com/sso/oidc/redirect/` and `onepassword://sso/oidc/redirect`. - Select any available **Signing Key**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. If you add a SCIM provider as a backchannel provider later, only users who can view this application are synchronized. 3. Click **Submit** to save the new application and provider. ## 1Password configuration 1. Log in to the [1Password dashboard](https://start.1password.com/) as an administrator. 2. In the sidebar, click **Policies**. 3. Under **Single sign-on**, click **Manage policies**. 4. Select **Other** as the identity provider. 5. Set the following values: - **Client ID**: paste the Client ID from authentik. - **Well-known URL**: `https://authentik.company/application/o//.well-known/openid-configuration` 6. Click **Next**, then click **Next** again. The redirect URIs were already configured in authentik. 7. Click **Test connection** to validate the configuration. 8. After the test completes successfully, click **Save**. ## Configuration verification To verify that authentik is properly integrated with 1Password, first sign out of your account. Then, open 1Password, enter an email address that's configured to unlock with SSO in 1Password, and click **Sign in with authentik**. You will be redirected to authentik for authentication before being sent back to 1Password. ## Automated user provisioning *(optional)* You can optionally configure automated user provisioning from authentik to 1Password. This allows you to create users and groups, manage access, and suspend users in 1Password with authentik. To support automated user provisioning, you need to deploy the 1Password SCIM Bridge, create a group and SCIM provider in authentik, and add the SCIM provider as a backchannel provider for the 1Password application. For more information, see the [1Password SCIM Bridge Documentation](https://support.1password.com/scim/). ### Set up automated user provisioning in authentik #### Create a user group 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Directory** > **Groups** and click **Create**. 3. Set a name for the group (e.g. `1Password Users`), and click **Create**. 4. Click the name of the newly created group and navigate to the **Users** tab. 5. Click **Add existing user**, select the users that need 1Password access, and click **Add**. #### Create a SCIM provider 1. Log in to authentik as an admin and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **Create**. - **Choose a Provider type**: select **SCIM Provider** as the provider type. - **Configure the Provider**: provide a name (e.g. `1password-scim`), and the following required configurations. - **URL**: `https://scim-bridge.company/scim` - **Token**: paste the bearer token from your 1Password SCIM Bridge deployment. - **Group Filter**: select the groups that should be provisioned to 1Password. 3. Click **Finish** to save the new provider. #### Add the SCIM provider to the 1Password application 1. Navigate to **Applications** > **Applications** and click the **Edit** icon of the 1Password application. 2. In the **Backchannel Providers** field, select the SCIM provider that you created. 3. Click **Update**. 4. Ensure that the users who should be provisioned to 1Password can access the application. If you created the `1Password Users` group above, add it as a binding for the application. ### Set up automated user provisioning in 1Password 1. Log in to the [1Password dashboard](https://start.1password.com/) as an administrator. 2. Click **Integrations** in the sidebar. 3. Choose your identity provider from the **User Provisioning** section, then follow the 1Password setup flow to deploy the SCIM Bridge and generate the bearer token. 4. After the SCIM Bridge is deployed, select the groups you want to sync in the **Managed Groups** section. ### Verify automated user provisioning Open the SCIM provider in authentik. In the **Schedules** section, click the play icon for the SCIM sync schedule. After the sync completes, confirm that the user is provisioned in 1Password. 1Password requires the SCIM Bridge to be reachable from authentik and the 1Password service. DNS and hosting setup for the SCIM Bridge are outside the scope of this guide. ## Resources - [Configure Unlock 1Password with SSO using OpenID Connect Documentation](https://support.1password.com/sso-configure-generic/) - [Set up automated provisioning using 1Password SCIM Bridge](https://support.1password.com/scim/) - [About 1Password SCIM Bridge endpoints](https://support.1password.com/scim-endpoints/) - [1Password SCIM Bridge deployment examples](https://github.com/1Password/scim-examples) --- ## Integrate with Bitwarden ## What is Bitwarden? > Bitwarden is a freemium, open-source password management service that helps users store, manage, and share sensitive information securely online. > > \-- [https://bitwarden.com/](https://bitwarden.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `bitwarden.company` is the FQDN of the Bitwarden installation (if using self-hosted Bitwarden). This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. To enable Single Sign-On (SSO) with Bitwarden, an [enterprise subscription](https://bitwarden.com/help/password-manager-plans/#compare-business-plans) is required. ## Configuration methods You can configure Bitwarden to use either OIDC or SAML; this guide explains both options. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Bitwarden with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add the redirect URIs for your Bitwarden deployment: - For Bitwarden Cloud US: - Add a **Redirect URI** of type `Strict` `Authorization` as `https://sso.bitwarden.com/oidc-signin`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://sso.bitwarden.com/oidc-signedout`. - For Bitwarden Cloud EU: - Add a **Redirect URI** of type `Strict` `Authorization` as `https://sso.bitwarden.eu/oidc-signin`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://sso.bitwarden.eu/oidc-signedout`. - For self-hosted Bitwarden: - Add a **Redirect URI** of type `Strict` `Authorization` as `https://bitwarden.company/sso/oidc-signin`. - Add a **Redirect URI** of type `Strict` `Post Logout` as `https://bitwarden.company/sso/oidc-signedout`. - Select any available **Signing Key**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Bitwarden configuration 1. Log in to the Bitwarden web app as an administrator. For Bitwarden Cloud EU accounts, select `bitwarden.eu` from the **Accessing** menu. If you are using self-hosted Bitwarden, log in to `https://bitwarden.company/#/login`. 2. Open the **Admin Console** using the product switcher. 3. In the sidebar, navigate to **Settings** > **Single sign-on**, and enter the following settings: - **Allow SSO authentication**: Select this option. - **SSO Identifier**: enter a globally unique SSO identifier. Members with a matching [claimed domain](https://bitwarden.com/help/claimed-domains/) can bypass entering this identifier; domain verification is outside the scope of this guide. - **Type**: select **OpenID Connect**. - Under **OpenID connect configuration**: - **Authority**: `https://authentik.company/application/o//` - **Client ID**: `` - **Client Secret**: `` - **OIDC Redirect Behavior**: select **Redirect GET**. 4. Click **Save**. ## authentik configuration To support the integration of Bitwarden with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** to `https://temp.temp` - Under **Advanced protocol settings**, select any available **Signing Certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download certificate file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the provider that you created in the previous section (e.g. `Provider for Bitwarden`). 3. Under **Related objects** > **Download signing certificate**, click on **Download**. This downloaded file is your certificate file and it will be required in the next section. ## Bitwarden configuration 1. Log in to the Bitwarden web app as an administrator. For Bitwarden Cloud EU accounts, select `bitwarden.eu` from the **Accessing** menu. If you are using self-hosted Bitwarden, log in to `https://bitwarden.company/#/login`. 2. Open the **Admin Console** using the product switcher. 3. In the sidebar, navigate to **Settings** > **Single sign-on**, and enter the following settings: - **Allow SSO authentication**: Select this option. - **SSO Identifier**: enter a globally unique SSO identifier. Members with a matching [claimed domain](https://bitwarden.com/help/claimed-domains/) can bypass entering this identifier; domain verification is outside the scope of this guide. - **Type**: select **SAML 2.0**. - Under **SAML service provider configuration**: - **Expect signed assertions**: Select this option. - Under **SAML identity provider configuration**: - **Entity ID**: `https://authentik.company/application/saml//metadata/` - **Single sign-on service URL**: `https://authentik.company/application/saml//` - **Single log-out service URL**: `https://authentik.company/application/saml//` - **X509 public certificate**: Paste the contents of your certificate file, without the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. 4. Under **SAML service provider configuration**, note the **SP entity ID** and **Assertion consumer service (ACS) URL** values because they will be required in the next section. 5. Click **Save**. Bitwarden [does not yet support Single Logout](https://bitwarden.com/help/configure-sso-saml/) but recommends pre-configuring the **Single log-out service URL** for future use. ## Reconfigure authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon of the newly created Bitwarden provider. 3. Under **Protocol settings**, set the following required configurations: - **ACS URL**: set to the **Assertion consumer service (ACS) URL** from Bitwarden. - **Audience**: set to the **SP entity ID** from Bitwarden. 4. Click **Update**. ## Configuration verification To confirm that authentik is properly configured with Bitwarden, log out and open Bitwarden. Enter the email address of a Bitwarden account and click **Use single sign-on**. If you haven't claimed the email domain in Bitwarden, enter the unique SSO identifier that you selected, and click **Continue**. You should be redirected to authentik to log in. After successfully logging in, you should be redirected to the Bitwarden dashboard. Depending on your **Member decryption options** setting in Bitwarden, you may still be required to enter your master password after signing in via SSO. ## Resources - [Bitwarden Help - OIDC Configuration](https://bitwarden.com/help/configure-sso-oidc/) - [Bitwarden Help - SAML 2.0 Configuration](https://bitwarden.com/help/configure-sso-saml/) - [Bitwarden Help - About Single Sign-On](https://bitwarden.com/help/about-sso/) - [Bitwarden Help - Claimed Domains](https://bitwarden.com/help/claimed-domains/) --- ## Integrate with Cloudflare Access ## What is Cloudflare Access? > Cloudflare Access is a secure, cloud-based zero-trust solution for managing and authenticating user access to internal applications and resources. > > \-- [https://www.cloudflare.com/zero-trust/products/access/](https://www.cloudflare.com/zero-trust/products/access/) ## Preparation The following placeholders are used in this guide: - `company.cloudflareaccess.com` is the FQDN of your Cloudflare Access team domain. - `authentik.company` is the FQDN of the authentik installation. To proceed, you need a Cloudflare account with Cloudflare Zero Trust enabled and a publicly accessible authentik instance with a trusted SSL certificate. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Looking to integrate authentik with your Cloudflare Dashboard? See our [integration guide](../../platforms/cloudflare/index.md) for more information. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Cloudflare Access with authentik, you need to create an application/provider pair in authentik. Cloudflare uses your Cloudflare Access team name in the callback URL. You can find the team name in the Cloudflare dashboard under **Settings** > **Team name and domain** > **Team name**. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://company.cloudflareaccess.com/cdn-cgi/access/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Cloudflare Access configuration 1. Open the [Cloudflare dashboard](https://one.dash.cloudflare.com) and go to **Zero Trust** > **Integrations** > **Identity providers**. 2. Under **Your identity providers**, click **Add new identity provider**, and then select **OpenID Connect**. 3. Configure the identity provider using values from the authentik provider created earlier: - **Name**: enter a descriptive name, for example `authentik`. - **App ID**: enter the **Client ID** from authentik. - **Client Secret**: enter the **Client Secret** from authentik. - **Auth URL**: enter `https://authentik.company/application/o/authorize/`. - **Token URL**: enter `https://authentik.company/application/o/token/`. - **Certificate URL**: enter `https://authentik.company/application/o//jwks/`. 4. Click **Save**. ## Configuration verification To confirm that authentik is properly configured with Cloudflare Access, open Cloudflare Access, go to **Authentication** > **Login methods**, and click **Test** next to the authentik login method. Complete the login flow and verify that Cloudflare displays a successful test result. ## Resources - [Cloudflare Access Generic OIDC documentation](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-oidc/) --- ## Integrate with FortiMail ## What is FortiMail? > FortiMail is a secure email gateway from Fortinet that provides protection against phishing, spam, malware, and data loss for on-premises or cloud-hosted email environments. > > \-- [https://www.fortinet.com/products/email-security](https://www.fortinet.com/products/email-security) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `fortimailadmin.company` is the FQDN or IP address of your FortiMail admin interface. - `fortimailuser.company` is the FQDN or IP address of your FortiMail user/webmail portal. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. FortiMail Cloud supports SSO for webmail users. The Admin Portal SSO steps apply to FortiMail Appliance and VM. When SSO is enabled for FortiMail webmail users, CalDAV and WebDAV authentication do not use SSO and continue to require local password authentication. If your FortiMail system is deployed in server mode, configure an LDAP profile for the domain users before enabling webmail SSO. ## authentik configuration To support the integration of FortiMail with authentik, you need to create an application/provider pair in authentik. You can configure either Admin Portal SSO or User Portal SSO, or both, depending on the intended users and the desired scope of authentication. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name (for example, `FortiMail Admin`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** to `https://temp.temp`. - Temporarily set the **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**, select any available certificate as the **Signing Certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Create Application** to save the new application and provider. ### Download metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the name of the provider that you created in the previous section (for example, `Provider for FortiMail Admin`). 3. Under **Related objects** > **Metadata**, click **Download**. This file is required in the next section. ## FortiMail configuration 1. Sign in to the FortiMail admin interface. 2. Navigate to **System** > **Single Sign On** and open the **Profile** tab. 3. Create a new SSO profile and configure the following settings: - **Profile name**: enter a descriptive name (for example, `authentik-admin`). - **Metadata**: upload the authentik metadata file that you downloaded in the previous section. - **Attribute used to identify email address**: `http://schemas.goauthentik.io/2021/02/saml/username` 4. Click **Create** or **OK** to save the SSO profile. 5. Open the **Setting** tab and enable **Single sign-on**. 6. If FortiMail displays **Use different service provider for admin and webmail access**, select **Admin** as the service provider metadata target. 7. In the **Service Provider Metadata** section, configure the following values: - **Entity ID**: `https://fortimailadmin.company/sp` - **Host name**: `fortimailadmin.company` 8. Click **Apply**. 9. Copy the following FortiMail service provider values: - **Entity ID** - **ACS URL** ### Reconfigure the authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the provider that you created for FortiMail Admin. 3. Click **Edit**. 4. Under **Protocol settings**, set the following values: - **ACS URL**: paste the **ACS URL** value from FortiMail. - **Audience**: paste the **Entity ID** value from FortiMail. 5. Click **Update**. ### Configure administrator accounts FortiMail does not automatically provision administrator accounts through SSO. Create or edit each administrator that should use SSO: 1. In the FortiMail admin interface, navigate to **System** > **Administrator** > **Administrator**. 2. For each SSO-enabled administrator, set **Authentication type** to **Single Sign On** and set **Single sign on profile** to the SSO profile that you created for authentik. ### Enforce SSO-only access (optional) To show only SSO on the administrator login page, run the following commands in the FortiMail CLI: ```shell config system appearance set admin-sso-login-option sso-only end ``` When administrator SSO-only login is enabled, the built-in `admin` account cannot sign in to the GUI. Keep SSH or local console access available before enabling this option. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name (for example, `FortiMail User Portal`), an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** to `https://temp.temp`. - Temporarily set the **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**, select any available certificate as the **Signing Certificate**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Create Application** to save the new application and provider. ### Download metadata file 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the name of the provider that you created in the previous section (for example, `Provider for FortiMail User Portal`). 3. Under **Related objects** > **Metadata**, click **Download**. This file is required in the next section. ## FortiMail configuration 1. Sign in to the FortiMail admin interface. 2. Navigate to **System** > **Single Sign On** and open the **Profile** tab. 3. Create a new SSO profile and configure the following settings: - **Profile name**: enter a descriptive name (for example, `authentik-webmail`). - **Metadata**: upload the authentik metadata file that you downloaded in the previous section. - **Attribute used to identify email address**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` 4. Click **Create** or **OK** to save the SSO profile. 5. Open the **Setting** tab and enable **Single sign-on**. 6. Enable **Use different service provider for admin and webmail access**, and then select **Webmail** as the service provider metadata target. 7. In the **Service Provider Metadata** section, configure the following values: - **Entity ID**: `https://fortimailuser.company/sp2` - **Host name**: `fortimailuser.company` 8. Click **Apply**. 9. Copy the following FortiMail service provider values: - **Entity ID** - **ACS URL** ### Reconfigure the authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the provider that you created for the FortiMail User Portal. 3. Click **Edit**. 4. Under **Protocol settings**, set the following values: - **ACS URL**: paste the **ACS URL** value from FortiMail. - **Audience**: paste the **Entity ID** value from FortiMail. 5. Click **Update**. ### Configure webmail access 1. In the FortiMail admin interface, navigate to **Domain & Users** > **Domain** and edit the domain that should use SSO. 2. Open **Advanced Setting** > **Other** and set **Webmail single sign on** to the SSO profile that you created for authentik. ### Enforce SSO-only access (optional) To show only SSO on the webmail login page, run the following commands in the FortiMail CLI: ```shell config system appearance set webmail-sso-login-option sso-only end ``` ## Configuration verification To confirm that authentik is properly configured with FortiMail, open the FortiMail portal that you configured and start the SSO login flow. After authenticating with authentik, verify that you return to FortiMail without being prompted for additional credentials. ## Resources - [Fortinet - FortiMail](https://www.fortinet.com/products/email-security) - [Fortinet Docs - Configuring single sign-on (SSO)](https://docs.fortinet.com/document/fortimail/8.0.0/administration-guide/73231/configuring-single-sign-on-sso) - [Fortinet Docs - FortiMail Cloud Configuring single sign-on (SSO)](https://docs.fortinet.com/document/fortimail-cloud/1.0.0/fortimail-cloud-administration-guide/73231/configuring-single-sign-on-sso) - [Fortinet Docs - system saml](https://docs.fortinet.com/document/fortimail/8.0.0/cli-reference/856423/system-saml) - [Fortinet Docs - system appearance](https://docs.fortinet.com/document/fortimail/7.4.3/cli-reference/523895/system-appearance) --- ## Integrate with GitGuardian ## What is GitGuardian? > GitGuardian is a security platform that helps teams detect and remediate exposed secrets, monitor software development lifecycle credentials, and govern non-human identities. > > \-- [https://www.gitguardian.com/](https://www.gitguardian.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `gitguardian.company` is the FQDN of the GitGuardian installation, when using self-hosted GitGuardian. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. GitGuardian SAML SSO can be configured by the Owner or any Manager of the workspace. GitGuardian supports Just-In-Time (JIT) provisioning for users who are authorized to access the authentik application. SCIM provisioning requires SAML SSO to be configured first. ## Integration configuration To support the integration of GitGuardian with authentik, you need to create property mappings and an application/provider pair in authentik. Optionally, to provision GitGuardian users and teams from authentik, also create the SCIM property mappings and a SCIM provider. ### authentik configuration #### Create property mappings GitGuardian expects SAML attributes named `first_name` and `last_name`. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the property mapping type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `GitGuardian first name` - **SAML Attribute Name**: `first_name` - **Expression**: ```python return request.user.name.split(" ", 1)[0] if request.user.name else request.user.username ``` 5. Click **Finish** to save the property mapping. 6. Repeat steps 2-5 to create the following additional SAML provider property mapping: - **Name**: `GitGuardian last name` - **SAML Attribute Name**: `last_name` - **Expression**: ```python return request.user.name.rsplit(" ", 1)[-1] if " " in request.user.name else "" ``` #### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** and **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**: - Select any available **Signing Certificate**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Set **Default NameID Policy** to `Email address`. - Add the `GitGuardian first name` and `GitGuardian last name` property mappings that you created in the previous section. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. #### Download the signing certificate 1. Navigate to **Applications** > **Providers** and click the name of the SAML provider that you created. 2. Under **Related objects** > **Download signing certificate**, click **Download**. This certificate file is required in the GitGuardian SSO setup flow. ### GitGuardian configuration 1. Log in to the GitGuardian dashboard as the workspace Owner or a Manager. For GitGuardian SaaS, use [https://dashboard.gitguardian.com/](https://dashboard.gitguardian.com/). For self-hosted GitGuardian, use `https://gitguardian.company`. 2. Navigate to **Settings** > **Authentication**. 3. Under **SAML**, click **Configure**. 4. Copy the following values because they are required in the next section: - **ACS URL** - **SP Entity ID** 5. Keep the GitGuardian SAML setup page open. #### Update the authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and open the provider that you created earlier. 3. Under **Protocol settings**, set the following values: - **ACS URL**: the **ACS URL** value from GitGuardian. - **Audience**: the **SP Entity ID** value from GitGuardian. 4. Click **Update** to save the provider. #### Register the identity provider 1. Return to the GitGuardian SAML setup page. 2. Configure the identity provider fields with the following values: - **Entity Id**: `https://authentik.company/application/saml//metadata/` - **Single Sign On Url**: `https://authentik.company/application/saml//` - **X509 certificate**: upload or paste the signing certificate that you downloaded from authentik. - **I have mapped the attributes first\_name and last\_name in my IdP**: select this option. 3. Submit the form to finish the SAML integration. #### Configure access controls *(optional)* GitGuardian can create users on their first SAML login with JIT provisioning. To control who can join the workspace, configure an authentik binding for this application so only authorized users can access it. After SAML works, GitGuardian SaaS can also reserve your email domain so users are automatically redirected to SSO from the standard login page and cannot create separate workspaces with that email domain. Domain reservation is outside the scope of this integration guide and is not available for self-hosted GitGuardian. ### Configuration verification To confirm that authentik is properly configured with GitGuardian, log out of GitGuardian and open the GitGuardian SSO login URL. You should be redirected to authentik and, after authenticating, returned to GitGuardian. For self-hosted GitGuardian, use the SSO login URL shown in your self-hosted dashboard. Use SCIM provisioning to create, update, deactivate, and delete GitGuardian users and teams from authentik. Configure SAML SSO first, as described in the **SAML SSO** tab. GitGuardian SCIM provisioning uses email addresses as user identifiers, so only users with emails can be provisioned. Ensure every authentik user you plan to provision to GitGuardian has a valid email address configured. ### Create SCIM property mappings in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SCIM Provider Mapping** as the property mapping type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `GitGuardian SCIM user` - **Expression**: ```python user_email = request.user.email given_name = request.user.name or request.user.username family_name = " " formatted = request.user.name or request.user.username if " " in formatted: given_name, _, family_name = formatted.partition(" ") return { "userName": user_email, "externalId": user_email, "name": { "formatted": formatted, "givenName": given_name, "familyName": family_name, }, "displayName": formatted, "active": request.user.is_active, "emails": [ { "value": user_email, "type": "work", "primary": True, } ], } ``` 5. Click **Finish** to save the property mapping. 6. Repeat steps 2-5 to create the following additional SCIM provider property mapping: - **Name**: `GitGuardian SCIM group` - **Expression**: ```python return { "displayName": group.name, "externalId": str(group.pk), } ``` ### Enable SCIM in GitGuardian 1. In GitGuardian, navigate to **API** > **Service accounts**. 2. Click **Create service account**. 3. Enter a name, then add the following permissions: - `members:write` - `teams:write` 4. Click **Create** and copy the generated token. 5. Navigate to **Settings** > **Authentication**. 6. Under **SCIM**, enable SCIM integration. ### Create the SCIM provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click **Create**. 3. Select **SCIM Provider** as the provider type and click **Next**. 4. Configure the following settings: - **Name**: provide a descriptive name. - **URL**: - For GitGuardian SaaS, enter `https://api.gitguardian.com/v1/scim/v2`. - For self-hosted GitGuardian, enter `https://gitguardian.company/exposed/v1/scim/v2`. - **Token**: paste the GitGuardian service account token. - **User Property Mappings**: remove `authentik default SCIM Mapping: User`, then add `GitGuardian SCIM user`. - **Group Property Mappings**: remove `authentik default SCIM Mapping: Group`, then add `GitGuardian SCIM group`. - **Group filters** *(optional)*: select only the GitGuardian-specific groups that should be provisioned as teams. 5. Click **Finish** to save the provider. 6. Navigate to **Applications** > **Applications** and open the GitGuardian application. 7. Add the SCIM provider to **Backchannel Providers**. 8. Click **Update**. Users that should be provisioned to GitGuardian must be bound to the GitGuardian application in authentik. If no group filters are selected on the SCIM provider, authentik synchronizes all groups. ### Configuration verification To confirm that SCIM provisioning is working, assign a test user to the GitGuardian application in authentik. Open the SCIM provider in authentik, click **Run sync again**, and confirm that the user is provisioned in GitGuardian. ## Resources - [GitGuardian Docs - Configure SAML SSO](https://docs.gitguardian.com/platform/enterprise-administration/saml-sso-configuration) - [GitGuardian Docs - Configure SCIM](https://docs.gitguardian.com/platform/enterprise-administration/scim-configuration) - [GitGuardian Docs - Generic SAML2 IdP](https://docs.gitguardian.com/platform/enterprise-administration/sso-providers/generic) - [GitGuardian Docs - Manage email domain](https://docs.gitguardian.com/platform/enterprise-administration/email-domain-management) --- ## Integrate with HashiCorp Vault ## What is HashiCorp Vault? > HashiCorp Vault secures, stores, and controls access to tokens, passwords, certificates, encryption keys, and other sensitive data. > > \-- [https://developer.hashicorp.com/vault](https://developer.hashicorp.com/vault) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `vault.company` is the FQDN of the HashiCorp Vault installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of HashiCorp Vault with authentik, you need to create an application and provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - Add two **Redirect URIs** of type `Strict` `Authorization` as `https://vault.company/ui/vault/auth/oidc/oidc/callback` and `http://localhost:8250/oidc/callback`. - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## HashiCorp Vault configuration This guide assumes that the Vault OIDC auth method is mounted at `oidc`, which is the path used by `vault auth enable oidc`. If you mount the auth method at a different path, replace `oidc` in the Vault paths and in the Vault UI redirect URI. Vault policies This guide configures OIDC authentication only. Create the Vault policies that you reference, such as `reader`, according to your Vault access model before assigning them to roles or identity groups. 1. Enable the OIDC auth method. ```bash vault auth enable oidc ``` 2. Configure the OIDC auth method with the authentik provider details. ```bash vault write auth/oidc/config \ oidc_discovery_url="https://authentik.company/application/o//" \ oidc_client_id="" \ oidc_client_secret="" \ default_role="reader" ``` 3. Create a Vault OIDC role named `reader`. ```bash vault write auth/oidc/role/reader \ bound_audiences="" \ allowed_redirect_uris="https://vault.company/ui/vault/auth/oidc/oidc/callback" \ allowed_redirect_uris="http://localhost:8250/oidc/callback" \ user_claim="sub" \ token_policies="reader" ``` ## External groups You can optionally use Vault external identity groups to assign Vault policies based on authentik group membership. This example maps an authentik group named `vault-reader` to a Vault external group that grants the `reader` policy. The authentik default `profile` scope mapping supplies the `groups` claim used by Vault. 1. Update the `reader` role to request the `profile` scope and read group membership from the `groups` claim. ```bash vault write auth/oidc/role/reader \ bound_audiences="" \ allowed_redirect_uris="https://vault.company/ui/vault/auth/oidc/oidc/callback" \ allowed_redirect_uris="http://localhost:8250/oidc/callback" \ user_claim="sub" \ groups_claim="groups" \ oidc_scopes="profile" ``` 2. Create an external Vault group for the `vault-reader` authentik group. ```bash vault write identity/group/name/vault-reader \ policies="reader" \ type="external" VAULT_GROUP_ID=$(vault read -field=id identity/group/name/vault-reader) ``` 3. Get the OIDC auth method mount accessor. ```bash OIDC_ACCESSOR=$(vault read -field=accessor sys/auth/oidc) ``` 4. Create a group alias that maps the authentik group name to the Vault group. ```bash vault write identity/group-alias \ name="vault-reader" \ mount_accessor="$OIDC_ACCESSOR" \ canonical_id="$VAULT_GROUP_ID" ``` ## Configuration verification To confirm that authentik is properly configured with HashiCorp Vault, open Vault and select **OIDC** from the authentication method list. Sign in through the OIDC flow and confirm that Vault redirects you to authentik for authentication and then back to Vault. You can also verify the CLI flow with the following command: ```bash vault login -method=oidc role="reader" ``` ## Resources - [HashiCorp Developer - Vault](https://developer.hashicorp.com/vault) - [HashiCorp Developer - Use JWT/OIDC authentication](https://developer.hashicorp.com/vault/docs/auth/jwt) - [HashiCorp Developer - JWT/OIDC auth method API](https://developer.hashicorp.com/vault/api-docs/auth/jwt) - [HashiCorp Developer - Identity group API](https://developer.hashicorp.com/vault/api-docs/secret/identity/group) - [HashiCorp Developer - Identity group alias API](https://developer.hashicorp.com/vault/api-docs/secret/identity/group-alias) --- ## Integrate with Infisical ## What is Infisical? > Infisical is an open source platform for managing secrets, certificates, and secure infrastructure access. > > \-- [https://infisical.com/](https://infisical.com/) ## Preparation The following placeholders are used in this guide: - `infisical.company` is the FQDN of the self-hosted Infisical installation. Infisical Cloud uses `app.infisical.com` for the US region and `eu.infisical.com` for the EU region. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. OIDC SSO requires an Infisical Cloud (SaaS) Pro plan or a license for a self-hosted Infisical installation. Infisical also requires you to verify your organization's email domain before configuring SSO; domain verification is outside the scope of this guide. For a self-hosted installation, ensure that `AUTH_SECRET` and `SITE_URL` are configured before setting up OIDC. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Infisical with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it is required later. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add the **Redirect URI** for your Infisical deployment with the type set to `Strict` `Authorization`: - Infisical Cloud US: `https://app.infisical.com/api/v1/sso/oidc/callback` - Infisical Cloud EU: `https://eu.infisical.com/api/v1/sso/oidc/callback` - Self-hosted Infisical: `https://infisical.company/api/v1/sso/oidc/callback` - Select any available signing key. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Infisical configuration 1. Log in to Infisical as an organization administrator. 2. Navigate to **SSO & Provisioning** and select the **SSO** tab. 3. Click **Add Provider**, select **OIDC**, and click **Continue**. 4. Configure the following settings: - **Discovery Document URL**: `https://authentik.company/application/o//.well-known/openid-configuration` - **Client ID**: enter the Client ID from authentik. - **Client Secret**: enter the Client Secret from authentik. 5. Click **Configure OIDC**. ## Configuration verification To confirm that authentik is properly configured with Infisical, log out and open Infisical. Click **Continue with OIDC**, enter an email address from the verified domain, and click **Continue with OIDC** again. Infisical should redirect you to authentik for authentication and then return you to Infisical. ## Resources - [Infisical documentation - General OIDC](https://infisical.com/docs/documentation/platform/sso/general-oidc/overview) - [Infisical documentation - SSO overview](https://infisical.com/docs/documentation/platform/sso/overview) - [Infisical documentation - Email domain verification](https://infisical.com/docs/documentation/platform/email-domain) - [Infisical documentation - Environment variables](https://infisical.com/docs/self-hosting/configuration/envars) --- ## Integrate with Knocknoc ## What is Knocknoc? > Knocknoc links your single sign-on experience to existing network access controls. It can dynamically orchestrate network access controls (e.g., managing firewall rules in real-time without exposing target machines) or function as an identity-aware gateway. > > \-- [https://knocknoc.io/](https://knocknoc.io/) ## Preparation The following placeholders are used in this guide: - `knocknoc.company` is the FQDN of the Knocknoc installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Knocknoc with authentik, create three SAML property mappings and an application/provider pair in authentik. ### Create property mappings in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create the following **SAML Provider Property Mapping** entries: - **Real name mapping**: - **Name**: `SAML to Knocknoc realName` - **SAML Attribute Name**: `realName` - **Expression**: ```python return user.name ``` - **Groups mapping**: - **Name**: `SAML to Knocknoc groups` - **SAML Attribute Name**: `groups` - **Expression**: ```python for group in user.groups.all(): yield group.name ``` - **Session duration mapping**: - **Name**: `SAML to Knocknoc session duration` - **SAML Attribute Name**: `sessionDuration` - **Expression**: ```python return 540 ``` Knocknoc users are created automatically after SAML login, but their group membership must match an existing Knocknoc group or Knoc definition before they receive access. Ensure the group names sent by authentik match the group names configured in Knocknoc. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - **Protocol settings**: - **ACS URL**: `https://knocknoc.company/api/saml/acs` - **Audience**: `https://knocknoc.company/api/saml/metadata` - **Advanced protocol settings**: - Select any available **Signing Certificate**. - Add the three property mappings you created in the previous section to **Selected User Property Mappings**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Username`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Copy the metadata URL of the Knocknoc provider 1. Navigate to **Applications** > **Providers** and click the name of the Knocknoc provider (e.g. `Provider for Knocknoc`). 2. In the **Related objects** section, under **Metadata**, click **Copy download URL**. This SAML metadata URL is required in the Knocknoc configuration. ## Knocknoc configuration 1. Log in to the Knocknoc admin interface and navigate to **Settings**. 2. Configure the following settings: - **Public URL**: `https://knocknoc.company` - **Metadata URL**: paste the metadata URL copied from authentik. 3. Click **Generate new keypair**. 4. Click **Save**. If you want to generate the Knocknoc keypair manually instead, run the following command on a Linux host and upload the generated certificate and key files in Knocknoc. ```shell openssl req -new -x509 -days 3650 -nodes -subj /CN=Knocknoc/ -out .crt -keyout .key ``` ## Configuration verification To confirm that authentik is properly configured with Knocknoc, log out and open Knocknoc. Click **SSO Login** and authenticate with authentik. ## Resources - [Knocknoc Docs - SAML](https://docs.knocknoc.io/books/admin-guide/page/saml) - [Knocknoc Docs - SAML with Authentik](https://docs.knocknoc.io/books/admin-guide/page/saml-with-authentik) - [Knocknoc Docs - Settings](https://docs.knocknoc.io/books/admin-guide/page/settings) --- ## Integrate with KnowBe4 ## What is KnowBe4? > KnowBe4 is a security awareness and phishing simulation platform that helps organizations train employees to recognize and respond to social engineering attacks. > > \-- [https://knowbe4.com/](https://knowbe4.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of KnowBe4 with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** to `https://temp.temp` - Under **Advanced protocol settings**: - Set the **Signing Certificate** to any available certificate. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Set **Default NameID Policy** to `Email address`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Get certificate fingerprint 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **System** > **Certificates** and expand the certificate that you selected in the previous section. 3. Take note of the **Certificate Fingerprint (SHA256)**. This value will be required in the next section. ## KnowBe4 configuration 1. Log in to the KnowBe4 Security Awareness Training console as an account administrator. 2. Click your email address in the upper-right corner and select **Account Settings**. 3. Navigate to **Account Integrations** > **SAML** and expand the **SAML Settings** box. 4. Take note of the **Entity ID** and **SSO Callback (ACS) URL**. They will be required in the next section. 5. Set the following required configurations: - Enable **Enable SAML SSO**. - **IdP SSO Target URL**: `https://authentik.company/application/saml//` - **IdP Cert Fingerprint**: select **SHA-256** and enter the **Certificate Fingerprint (SHA256)** value from authentik. 6. Review the optional SAML settings before saving: - Enable **Allow Account Creation from SAML Login** if you want KnowBe4 to create users the first time they sign in with SAML. - After you verify that SSO works, decide whether to enable **Disable non-SAML Logins for All Users**. If you enable it, decide whether to also enable **Allow Admins with MFA to Bypass SAML Login** so MFA-protected administrators can use KnowBe4's bypass URL to recover from an SSO misconfiguration. 7. Click **Save SAML Settings**. ## Reconfigure authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the **Edit** icon of the KnowBe4 provider. 3. Set the following required configurations: - Under **Protocol settings**, set **ACS URL** to the **SSO Callback (ACS) URL** from KnowBe4. - Under **Protocol settings**, set **Audience** to the **Entity ID** from KnowBe4. 4. Click **Update**. ## Configuration verification To confirm that authentik is properly configured with KnowBe4, log out of KnowBe4 and then open the KnowBe4 login page in a private or incognito browser window. Enter an email address that uses SSO and confirm that you are redirected to authentik for authentication and then back to the KnowBe4 console. ## Resources - [KnowBe4 Knowledge Base - Set Up SAML Single Sign-on (SSO) for the Security Awareness Training Console](https://support.knowbe4.com/hc/en-us/articles/360041935913-Set-Up-SAML-Single-Sign-on-SSO-for-the-Security-Awareness-Training-Console) - [KnowBe4 Knowledge Base - KnowBe4 Console Account Settings: Account Integrations](https://support.knowbe4.com/hc/en-us/articles/12769050560403-KnowBe4-Console-Account-Settings-Account-Integrations) - [KnowBe4 Knowledge Base - SAML Integration Overview](https://support.knowbe4.com/hc/en-us/articles/206293387-SAML-Integration-Overview) --- ## Integrate with macmon NAC ## What is macmon NAC? > macmon NAC is a network access control platform that provides visibility, policy enforcement, and automated responses for devices connecting to your network. > > \-- [macmon Network Access Control (NAC)](https://www.belden.com/products/industrial-networking-cybersecurity/software-solutions/macmon-network-access-control-software#sort=%40catalogitemwebdisplaypriority%20ascending\&numberOfResults=25) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `macmon.company` is the FQDN of your macmon NAC environment. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of macmon NAC with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the **Slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://macmon.company/login/?acs`. - Set the **Audience** to `https://macmon.company/login/?acs`. - Set the **Service Provider Binding** to `Post`. - Under **Advanced protocol settings**: - Set **Signing Certificate** to an available certificate. - Enable **Sign Responses**. - Set **NameID Property Mapping** to `authentik default SAML Mapping: Email`. - Set **Default NameID Policy** to **Email address**. You can optionally add mappings for additional claims such as `firstName`, `surName`, `memberOf`, or `description` if macmon NAC will use them. - **Configure Bindings** *(optional)*: create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to control which users see the macmon NAC application on the **Application Dashboard** page. 3. Click **Submit**. ### Download the signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the newly created macmon NAC provider. 3. Click **Download** under **Download signing certificate**. The contents of this certificate will be required in the next section. ## macmon configuration 1. Log in to the macmon NAC administrative console. 2. Navigate to **Settings** > **Identity Stores** and click **Create**. 3. Configure the following settings: - **Name**: `authentik` (or another descriptive label). - **SP Host name**: `macmon.company`. - **SP Entity ID**: `https://macmon.company/login/?acs`. - **IdP Issuer (Entity ID)**: `https://authentik.company/application/saml//metadata/`. - **IdP certificate**: paste the contents of the authentik signing certificate, removing the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines. - **IdP SSO URL**: `https://authentik.company/application/saml//init/`. - **Name ID format**: `E-mail address`. 4. Save the identity store configuration. macmon NAC provisions new users automatically when they authenticate through SSO. Newly created accounts have no policies by default, so they cannot access resources until an administrator assigns groups/permissions or you configure automated policy assignments. Designing those policies is outside the scope of this guide. You can review these accounts in macmon NAC under **Users** > **User Accounts** > **External user accounts** and filter by the identity store name you configured earlier. ## Configuration verification To confirm that authentik is properly configured with macmon NAC, log out of macmon NAC. On the macmon NAC portal select **Single Sign-On**. You should be redirected to authentik to log in, and if successful, you should then be redirected to the macmon NAC interface. ## Resources - [Belden - macmon Network Access Control (NAC)](https://www.belden.com/products/industrial-networking-cybersecurity/software-solutions/macmon-network-access-control-software) --- ## Integrate with Push Security ## What is Push Security? > Push Security is a browser-based identity security platform that hardens and monitors your identity attack surface. Security teams can monitor and secure their entire identity attack surface (ISPM) and detect and block identity-based attacks (ITDR) such as advanced phishing techniques. > > \-- [https://pushsecurity.com/](https://pushsecurity.com/) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. SAML login for the Push Security admin console is available for administrators. Push Security requires a default admin role for administrators who join through SAML. SP-initiated login from the Push Security login screen must be enabled by Push Security support. ## authentik configuration To support the integration of Push Security, you need to create property mappings and an application/provider pair in authentik. ### Create property mappings in authentik Push Security expects the SAML assertion to include `email`, `given_name`, `family_name`, and `name` attributes. Because authentik stores a user's full name as a single string, create SAML provider property mappings that send the email address, split the full name into first and last names, and send the full display name. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. 3. Select **SAML Provider Property Mapping** as the property mapping type and click **Next**. 4. Create a property mapping with the following values: - **Name**: `Push Security email` - **SAML Attribute Name**: `email` - **Expression**: ```python return request.user.email ``` 5. Click **Finish** to save the property mapping. 6. Repeat steps 2-5 to create the following additional SAML provider property mappings: - **Name**: `Push Security given_name` - **SAML Attribute Name**: `given_name` - **Expression**: ```python return request.user.name.split(" ", 1)[0] if request.user.name else request.user.username ``` - **Name**: `Push Security family_name` - **SAML Attribute Name**: `family_name` - **Expression**: ```python return request.user.name.rsplit(" ", 1)[-1] if " " in request.user.name else "" ``` - **Name**: `Push Security name` - **SAML Attribute Name**: `name` - **Expression**: ```python return request.user.name or request.user.username ``` ### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively, you can first create a provider separately, then create the application and connect it with the provider.) - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - Take note of the **slug** value because it will be required later. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** and **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**: - Set **Signing Certificate** to any available certificate. - Set **NameID Property Mapping** to `Push Security email`. - Remove the managed mappings from **Selected User Property Mappings**, then add the `Push Security email`, `Push Security given_name`, `Push Security family_name`, and `Push Security name` property mappings. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Download the signing certificate 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the newly created Push Security provider. 3. Under **Related objects** > **Download signing certificate**, click **Download**. This certificate will be required in the next section. ## Push Security configuration 1. Log in to the [Push Security administrator console](https://pushsecurity.com). 2. Go to **Settings** > **Organization**, then under **SAML Configuration**, click **Setup**. 3. Click **Get Started**, select **Custom SAML**, and click **Next**. 4. Copy both the **Single Sign-On URL** and the **Service Provider Entity URL**. These values will be required in the next section. 5. Click **Next**. 6. Choose **Manual**, and enter the following as the **Single Sign-On Login URL**: `https://authentik.company/application/saml//` 7. Click **Upload signing certificate**, and upload the certificate downloaded from authentik. 8. *(Optional but recommended)* Under **Advanced Settings**, enable **Sign request**. Then download the verification certificate. This certificate will need to be imported into authentik. Refer to the [authentik certificate documentation](/docs/sys-mgmt/certificates#external-certificates) for guidance. 9. Click **Next**. 10. On the **Attribute Mapping** page, confirm that the Push Security attributes are mapped to the following SAML attributes: - **Email**: `email` - **Given name**: `given_name` - **Family name**: `family_name` - **Name**: `name` 11. Click **Next**. 12. Select the default admin role that Push Security should use for new administrators who join through SAML. 13. Leave the **Test SSO** page open. You will return to it after completing the next section. ## Reconfigure authentik provider 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers**, then find the newly created Push Security provider and click its **Edit** icon. 3. Under **Protocol settings**, set the following required configurations: - **ACS URL**: set to the **Single Sign-On URL** copied from the previous section (e.g., `https://login.pushsecurity.com/login/callback?connection=saml-aaa...`). - **Audience**: set to the **Service Provider Entity URL** copied from the previous section (e.g., `urn:auth0:production-pushsecurity:saml-aaa...`). - *(Optional but recommended)* Under **Advanced protocol settings**, set **Verification Certificate** to the verification certificate downloaded from Push Security. 4. Click **Update**. ## Verify Push Security configuration 1. Return to the Push Security **Test SSO** page. 2. Click **Test Connection**. You should be redirected to authentik. 3. Log in with authentik. 4. After a successful login, you will be redirected to Push Security and see a **Testing complete!** message. 5. On the **Test SSO** page, click **Enable Connection**. Push Security supports IdP-initiated login after SAML is enabled. To allow administrators to enter their email on the Push Security login screen and be redirected to authentik, contact Push Security support. ## Configuration verification To confirm that authentik is properly configured with Push Security, open the Push Security application from the authentik Application Dashboard. You should be redirected to the Push Security admin console. ## Resources - [Push Security SAML SSO Documentation](https://pushsecurity.com/help/10123#start) --- ## Integrate with Semgrep ## What is Semgrep? > Semgrep AppSec Platform helps teams find, triage, and manage code, dependency, and secrets findings across repositories and developer workflows. > > \-- [https://semgrep.dev](https://semgrep.dev) ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. - `some.company` is the email domain used by users who sign in to Semgrep. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration To support the integration of Semgrep with authentik, you need to create several property mappings and an application/provider pair in authentik. ### Create property mappings 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create the following **SAML Provider Property Mapping**s: - **ID Mapping:** - **Name**: `semgrep-id` - **SAML Attribute Name**: `id` - **Expression**: `return request.user.email` - **Email Mapping:** - **Name**: `semgrep-email` - **SAML Attribute Name**: `email` - **Expression**: `return request.user.email` - **Name Mapping:** - **Name**: `semgrep-name` - **SAML Attribute Name**: `name` - **Expression**: `return request.user.name` - **First Name Mapping:** - **Name**: `semgrep-first-name` - **SAML Attribute Name**: `firstName` - **Expression**: `return request.user.name.split(" ", 1)[0] if request.user.name else request.user.username` - **Last Name Mapping:** - **Name**: `semgrep-last-name` - **SAML Attribute Name**: `lastName` - **Expression**: `return request.user.name.rsplit(" ", 1)[-1] if " " in request.user.name else ""` ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations: - Set the **ACS URL** to `https://temp.temp`. - Set the **Audience** to `https://temp.temp`. - Under **Advanced protocol settings**: - Select an available **Signing Certificate**. - Add the five **Property mappings** that you created in the previous section. - Set **NameID Property Mapping** to `semgrep-email`. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Create Application** to save the new application and provider. ## Semgrep configuration 1. Log in to [Semgrep AppSec Platform](https://semgrep.dev/login) as an administrator. 2. Navigate to **Settings** > **Access** > **Login methods**. 3. In the **Single sign-on (SSO)** section, set **Email domain** to `some.company` and click **Initialize**. 4. In the **Configure Single Sign-On** dialog, select **Custom SAML**. 5. When Semgrep shows the service provider values, copy the following values and keep this window open: - **SSO URL** - **Audience URL (SP Entity ID)** ## Configure the remaining information in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click the provider that you created in the previous step. 3. Click **Edit**. 4. Under **Protocol settings**, set the value of the **ACS URL** to the **SSO URL** value from Semgrep. Then, set the value of the **Audience** to the **Audience URL (SP Entity ID)** value from Semgrep. 5. Click **Update**. ## Enable SSO in Semgrep 1. In Semgrep AppSec Platform, continue through the **Configure Single Sign-On** dialog. 2. When prompted for authentik's identity provider details, enter the following values: - **IdP SSO URL**: `https://authentik.company/application/saml//` - **IdP Issuer ID**: `https://authentik.company/application/saml//metadata/` - **Upload/paste certificate**: from the authentik SAML provider page, under **Related objects** > **Download signing certificate**, click **Download** and upload the downloaded certificate. 3. Follow Semgrep's prompts to test the SAML sign-in flow. 4. After the test succeeds, close the test page, confirm the connection details, and finish the setup. 5. Confirm that the connection status is active under **Settings** > **Access** > **Login methods**. ## Configuration verification To confirm that authentik is properly configured with Semgrep, log out of Semgrep and open the Semgrep login page in a private or incognito browser window. Start the SSO sign-in flow, enter an email address for the domain you configured, and confirm that you are redirected to authentik for authentication and then back to Semgrep. ## Resources - [Semgrep Docs - SSO authentication](https://semgrep.dev/docs/deployment/sso) - [Semgrep Docs - SAML SSO with Google Workspace](https://semgrep.dev/docs/kb/semgrep-appsec-platform/saml-google-workspace) --- ## Integrate with Skyhigh Security ## What is Skyhigh Security? > Skyhigh Security Service Edge (SSE) combines Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Private Access (ZTNA), Data Loss Prevention (DLP), and Remote Browser Isolation (RBI) in the Skyhigh Cloud Platform. > > \-- [https://www.skyhighsecurity.com/products/security-service-edge.html](https://www.skyhighsecurity.com/products/security-service-edge.html) ## Preparation Skyhigh Security has multiple SAML integration points: - Dashboard administrator login, to manage the Skyhigh Security dashboard. - Secure Web Gateway and Private Access, to authenticate users for web and private application access. For dashboard administrator login, the Skyhigh Security administrator users must already exist in Skyhigh Security with attributes that match the users who authenticate with authentik. Automatic user creation and SCIM provisioning are not supported for this integration. The following placeholder is used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. Keep at least one Skyhigh Security administrator account excluded from SSO so that you can still access Skyhigh Security if the SAML configuration is incorrect. ## Integration configuration To support the integration of Skyhigh Security with authentik, create one application/provider pair for each Skyhigh Security SAML integration point that you want to use. ### authentik configuration To support dashboard administrator login, create an application/provider pair in authentik. #### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Temporarily set the **ACS URL** to `https://temp.temp`. - Temporarily set the **Audience** to `https://temp.temp`. - Select a **Signing Certificate**. - Select **authentik default SAML Mapping: Email** as the **NameID Property Mapping**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Open the provider that you created, and note the **EntityID/Issuer** and **SAML Endpoint** values. 5. Download the signing certificate from the provider's **Related objects** section. ### Skyhigh Security configuration 1. Log in to the Skyhigh Security IAM login page with an administrator account that can manage SSO. 2. In the top-right **Primary User (Admin)** menu, click **Identity Provider**. 3. In the **Identity Provider** section, configure the following settings: - **Issuer**: enter the **EntityID/Issuer** value from authentik. - **Certificate**: upload the signing certificate that you downloaded from authentik. - **Login URL**: enter the **SAML Endpoint** value from authentik. - **Signature Algorithm**: select **SHA-256**. - **Request Binding**: select **HTTP-POST**. 4. In the **User List** section, exclude at least one administrator account from SSO. 5. Click **Save Changes**. 6. In the **Service Provider (Skyhigh CASB)** section, note the **Audience** and **Assertion Consumer Service URL** values. 7. Return to the authentik provider that you created earlier. 8. Under **Protocol settings**, update the following settings: - **ACS URL**: enter the **Assertion Consumer Service URL** value from Skyhigh Security. - **Audience**: enter the **Audience** value from Skyhigh Security. 9. Click **Save Changes**. ### Configuration verification To confirm that authentik is properly configured with Skyhigh Security, open the Skyhigh Security integration that you configured from the authentik application dashboard. You should be redirected to authentik and returned to Skyhigh Security after authentication. ### authentik configuration To support Secure Web Gateway and Private Access, create an application/provider pair in authentik. #### Create an application and provider in authentik authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the **Issuer** value to: `https://authentik.company/application/saml//metadata/` Older versions of authentik set this value to `authentik` by default. If you're running an older version, please set **Issuer** to `https://authentik.company/application/saml//metadata/`, where `` is the **slug** that you selected for the application. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **SAML Provider** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Set the **ACS URL** to `https://saml.wgcs.skyhigh.cloud/saml`. - Set the **Audience** to `https://saml.wgcs.skyhigh.cloud/saml`. - Select a **Signing Certificate**. - Select **authentik default SAML Mapping: Email** and **authentik default SAML Mapping: Groups** as **Property mappings**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. 4. Open the provider that you created, and note the **EntityID/Issuer** and **SAML Endpoint** values. 5. Download the signing certificate from the provider's **Related objects** section. ### Skyhigh Security configuration 1. Log in to the Skyhigh Security dashboard as an administrator. 2. Click the configuration gear and navigate to **Infrastructure** > **Web Gateway Setup**. 3. Under **Set Up SAML**, click **New SAML**. 4. Configure the SAML provider as follows: - **SAML Configuration Name**: enter a descriptive name. - **Service Provider's Entity ID**: `https://saml.wgcs.skyhigh.cloud/saml` - **URL of SAML Identity Provider**: enter the **SAML Endpoint** value from authentik. - **Identity Provider Must Sign SAML Assertion**: enable this option. - **Identity Provider's Entity ID**: enter the **EntityID/Issuer** value from authentik. - **User ID attribute in SAML response**: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` - **Group ID attribute in SAML response**: `http://schemas.xmlsoap.org/claims/Group` - **Identity Provider Certificate**: upload the signing certificate that you downloaded from authentik. 5. Add the domain names that should authenticate with authentik. 6. Click **Save**. 7. Publish the web policy. Skyhigh Security policy design, domain ownership, and application access policies are outside the scope of this guide. Ensure that your web and private access policies grant access to users authenticated through authentik. ### Configuration verification To confirm that authentik is properly configured with Skyhigh Security, open the Skyhigh Security integration that you configured and sign in with SSO. You should be redirected to authentik and returned to Skyhigh Security after authentication. ## Resources - [Skyhigh Security - Security Service Edge SSE Solution](https://www.skyhighsecurity.com/products/security-service-edge.html) - [Skyhigh Security - Primary User - Identity Provider](https://success.skyhighsecurity.com/Skyhigh_CASB/03_Skyhigh_RBAC_and_User_Management/Primary_User/Primary_User_-_Identity_Provider) - [Skyhigh Security - Configure SAML and SSO for Skyhigh Cloud Administrators](https://success.skyhighsecurity.com/Skyhigh_CASB/Skyhigh_CASB_Settings/SAML_Configuration/Configure_Skyhigh_CASB_Login_for_SAML_and_SSO) - [Skyhigh Security - Configure SAML Authentication for Secure Web Gateway](https://success.skyhighsecurity.com/Skyhigh_Secure_Web_Gateway_%28Cloud%29/Secure_Web_Gateway_Setup/Configuring_SAML_Authentication/Configure_SAML_Authentication_for_Secure_Web_Gateway) - [Skyhigh Security - Configure SAML Authentication for Private Access](https://success.skyhighsecurity.com/Skyhigh_Private_Access/SAML_Authentication/Configure_SAML_Authentication_for_Private_Access) --- ## Integrate with Vaultwarden ## What is Vaultwarden? > Vaultwarden is an alternative server implementation of the Bitwarden Client API, written in Rust and compatible with official Bitwarden clients, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal. > > \-- [https://github.com/dani-garcia/vaultwarden](https://github.com/dani-garcia/vaultwarden) ## Preparation The following placeholders are used in this guide: - `vaultwarden.company` is the FQDN of the Vaultwarden installation. - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of Vaultwarden with authentik, you need to create an application/provider pair in authentik. ### Create custom scope mapping Vaultwarden requires the email scope to return either `email_verified: True` or no `email_verified` value. Because the default authentik email scope mapping returns `email_verified: False`, create a custom scope mapping for Vaultwarden. 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Customization** > **Property Mappings** and click **Create**. - **Select type**: select **Scope Mapping**. - **Configure the Scope Mapping**: Provide a descriptive name (e.g. `Vaultwarden Email Scope`), and an optional description. - **Scope name**: `email` - **Expression**: ```python showLineNumbers return { "email": request.user.email, "email_verified": True } ``` 3. Click **Finish** to save the property mapping. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://vaultwarden.company/identity/connect/oidc-signin`. - Select any available signing key. - Under **Advanced protocol settings**: - Set **Access token validity** to more than 5 minutes. - Ensure the `offline_access` scope mapping is available by adding `authentik default OAuth Mapping: OpenID 'offline_access'` to the selected scopes. - Remove the `authentik default OAuth Mapping: OpenID 'email'` scope, and add the custom scope mapping you created above. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ## Vaultwarden configuration To configure Vaultwarden to use authentik, add the following environment variables to your Vaultwarden deployment: ```yaml title="Vaultwarden environment variables" DOMAIN=https://vaultwarden.company SSO_ENABLED=true SSO_AUTHORITY=https://authentik.company/application/o// SSO_CLIENT_ID= SSO_CLIENT_SECRET= SSO_SCOPES=email profile offline_access SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION=false SSO_CLIENT_CACHE_EXPIRATION=0 SSO_ONLY=false # Set to true to disable email and master password login and require SSO SSO_SIGNUPS_MATCH_EMAIL=true # Match first SSO login to an existing account by email ``` Then restart Vaultwarden to apply the changes. ## Configuration verification To confirm that authentik is properly configured with Vaultwarden, log out of Vaultwarden, then open Vaultwarden. Enter a verified email address and click **Use single sign-on**. You should be redirected to authentik to log in, then redirected back to Vaultwarden. ## Resources - [Vaultwarden Wiki - SSO using OpenID Connect](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) --- ## Integrate with XCreds ## What is XCreds? > XCreds is an open source project for synchronizing IdP passwords with macOS login passwords. XCreds replaces the macOS login window to provide authentication to the cloud provider; a user enters their cloud password for authentication and XCreds keeps the local Mac password synchronized with the cloud password. > > \-- [https://twocanoes.com/products/mac/xcreds/](https://twocanoes.com/products/mac/xcreds/) This guide covers OIDC login for XCreds using an XCreds configuration profile. Device deployment, licensing, password synchronization behavior, and other XCreds management settings are outside the scope of this integration guide. ## Preparation The following placeholders are used in this guide: - `authentik.company` is the FQDN of the authentik installation. This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. ## authentik configuration In authentik versions earlier than 2026.5, all **Redirect URIs** are automatically treated as `Authorization` type. If you are using one of these older authentik versions, add only the `Authorization` URL to your **Redirect URIs** and do not configure a `Post Logout` URI. To support the integration of XCreds with authentik, you need to create an application/provider pair in authentik. ### Create an application and provider in authentik 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. - **Application**: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. - **Choose a Provider type**: select **OAuth2/OpenID Connect** as the provider type. - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. - Note the **Client ID** and **Client Secret** values because they will be required later. - Add a **Redirect URI** of type `Strict` `Authorization` as `https://127.0.0.1/xcreds`. - Select any available signing key. - Under **Advanced protocol settings**, add `authentik default OAuth Mapping: OpenID 'offline_access'` to **Selected Scopes**. - **Configure Bindings** *(optional)*: you can create a [binding](/docs/add-secure-apps/bindings-overview/) (policy, group, or user) to manage the listing and access to applications on a user's **Application Dashboard** page. 3. Click **Submit** to save the new application and provider. ### Copy OpenID configuration URL 1. Log in to authentik as an administrator and open the authentik Admin interface. 2. Navigate to **Applications** > **Providers** and click on the name of the newly created XCreds provider. 3. Copy the **OpenID Configuration URL**. This will be required to configure XCreds in the next section. ## XCreds configuration After XCreds is installed on a target Mac, configure it by creating, installing, and applying a configuration profile. For more information, refer to the [XCreds Admin Guide](https://twocanoes.com/knowledge-base/xcreds-admin-guide/). ### ProfileCreator [ProfileCreator](https://github.com/ProfileCreator/ProfileCreator) is an open source macOS application used to create configuration profiles. It can create a configuration profile for XCreds. 1. Open the **ProfileCreator** application and click on the `+` icon in the top-left corner to create a new configuration profile: - Under **General** provide a descriptive Payload Display Name, Payload Description, and Payload Organization. 2. Click the **Application Managed Preferences** icon in the left-hand column that looks like an `A`. 3. Select XCreds in the list and click the **Add** button in the top-right corner of the screen. 4. Under **Disabled Keys**, click the `+` icon next to the following keys and set the required configurations: - **Client ID**: the Client ID from authentik - **Client Secret**: the Client Secret from authentik - **Discovery URL**: the OpenID Configuration URL from authentik - **Redirect URI**: `https://127.0.0.1/xcreds` 5. Click on the **Export Profile** icon at the top-left corner of the screen and set the following required configurations: - **Platform**: `macOS` - **Scope**: `System` - **Payload Content Type**: `Profile` 6. Click **Save**. ### Install the profile to the target Mac Next, you need to install the created profile on the target Mac. 1. Log in to the Mac and navigate to **System Settings** > **General** > **Device Management**. 2. Under **Device**, click the `+` icon. 3. Select the profile that was created in the previous section. 4. Click **Continue**, **Install** and enter the device password. ## Configuration verification To confirm that authentik is properly configured with XCreds on the target Mac, log out, open the XCreds login window, and log back in via authentik. If you need to log in to a local account on the Mac, you can click on the **Mac Login Window** button. ## Resources - [XCreds Admin Guide](https://twocanoes.com/knowledge-base/xcreds-admin-guide/) - [XCreds Identity Provider Integration Guide](https://twocanoes.com/knowledge-base/xcreds-identity-provider-integration-guide/) - [ProfileCreator](https://github.com/ProfileCreator/ProfileCreator) - [XCreds source code](https://github.com/twocanoes/xcreds)