Authelia
Identity providerauthelia
Self-hosted authentication and authorization portal for reverse proxies, deny by default.
- Provider
- default
- Category
- Security
| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| authorizationModel | enum | none | rbac | abac | rebac | no | rbac | ▸ abac |
| centralised | boolean | — | no | true | ▸ true |
| defaultPolicy | enum | deny | bypass | one-factor | two-factor | no | deny | inherited |
| managed | boolean | — | no | true | ▸ false |
| mfa | boolean | — | no | false | ▸ false |
| protocol | enum | oidc | saml | oauth2 | iam | custom | no | oidc | ▸ oidc |
| sessionStorage | enum | memory | redis | no | memory | inherited |
| userStorage | enum | file | ldap | no | file | inherited |
Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.
No rule reads this kind yet. That is a gap, not a guarantee.
nodes:
- { id: "authelia", component: "authelia" }Resource Access Managementalibaba-ramAmazon Cognitoaws-cognitoAmazon Cognito identity poolaws-cognito-identity-poolAWS Directory Serviceaws-directory-serviceAWS IAMaws-iamAWS IAM Identity Centeraws-iam-identity-centerAWS IAM Roles Anywhereaws-iam-roles-anywhereAWS Directory Service Simple ADaws-simple-adMicrosoft Azure Attestationazure-attestationMicrosoft Entra Domain Servicesazure-entra-domain-servicesMicrosoft Entra External IDazure-entra-external-idMicrosoft Entra IDazure-entra-idMicrosoft Entra Verified IDazure-entra-verified-idAzure IoT Hub Device Provisioning Serviceazure-iot-dpsManaged identities for Azure resourcesazure-managed-identityCloudflare One identity providercloudflare-one-identity-providerActive Directory Domain Servicesactive-directoryAthenzathenzAuth0auth0authentikauthentikClerkclerkDexdexFreeIPAfreeipaGeneric identity provideridentity-providerKeycloakkeycloakOAuth2 Proxyoauth2-proxyOktaoktaOpenFGAopenfgaOpenLDAPopenldapOryoryPing Identity Platformping-identitySpiceDBspicedbSPIREspireStytchstytchWorkOSworkosZitadelzitadelCloud Identitygoogle-cloud-identityFirebase Authenticationgoogle-firebase-authGoogle Identity Platformgoogle-identity-platformManaged Service for Microsoft Active Directorygoogle-managed-microsoft-ad
and 7 more → Identity provider page# yaml-language-server: $schema=../../schema/component.schema.json # Authelia: self-hosted authentication and authorization portal, usually behind a reverse proxy. # "Access Control": the default_policy is deny and rules raise a request to one_factor or # two_factor, so two-factor is not the standing policy. It can also act as an OpenID Connect provider. schemaVersion: "1" type: "component" id: "authelia" kind: "identity-provider" provider: "default" docs: "https://www.authelia.com/configuration/security/access-control/" defaults: protocol: "oidc" authorizationModel: "abac" centralised: true managed: false mfa: false properties: defaultPolicy: type: "enum" values: ["deny", "bypass", "one-factor", "two-factor"] default: "deny" userStorage: type: "enum" values: ["file", "ldap"] default: "file" sessionStorage: type: "enum" values: ["memory", "redis"] default: "memory"