One policy layer can protect several internal applications
Authelia sits beside a reverse proxy and decides whether a request may continue, needs authentication, or should be denied. Its rules can match domains, paths, methods, networks, users, and groups. Policies can require one or two factors. The same service also provides OpenID Connect for applications that support it directly, so a homelab or internal platform can cover older proxy-auth apps and newer OIDC clients.
Second-factor choices include TOTP, WebAuthn security keys, passkeys, and Duo push. User identities can come from a YAML file or LDAP. That breadth explains part of the repository's size: our checkout contained 2,690 files, about 230,200 lines of source, and 26 MB before dependencies. This is authentication infrastructure with a web portal, protocol code, storage, integrations, and deployment tooling.
HTTPS and correct proxy headers are mandatory
Authelia's get-started guide requires HTTPS even for testing. Proxy deployments must pass the documented scheme, host, path, and client-IP headers. A mistake here can misidentify the destination, break WebAuthn, or let untrusted forwarded values influence authorization. The project supplies guides for Nginx, Traefik, Caddy, Envoy, HAProxy, and Kubernetes ingress options, but operators still have to fit those examples to their network.
Initial configuration is static rather than GUI-driven. Administrators choose LDAP or file identities, configure SQL storage, define session cookies for protected domains, provide a notifier, and start with a deny-oriented access policy. For production, the guide recommends PostgreSQL over SQLite and Redis over in-memory sessions. It also tells operators to move secrets out of the configuration file and review the threat model before launch.
What happened when we ran it
Our sandbox installed 176 Go packages in 54 seconds. The build succeeded after 229 seconds, which proves commit 0386207 could produce its artifacts in a fresh Go 1.24 Debian container. The repository included a Dockerfile and 4 CI workflow files. At 3 CPUs and 8 GB of RAM, this was a substantial build, yet it completed without credentials or privileged access.
The tests ran for 510 seconds and ended with exit code 1. The harness counted 21 passed and 4 failed out of 25. In the visible log tail, TestShouldExecCommandOnAutheliaRootPath expected a true result and received false. A process then hit a 2-second timeout, was killed, and logged several retries after not ready. The tail does not identify one shared cause for all 4 failures.
That distinction matters for an authentication server. A passing 229-second build establishes compile health, while the 510-second failed suite leaves behavior unresolved on our exact host. Before upgrading a live instance, run the same release with the intended database, Redis, proxy, and configuration checks. Do not dismiss the result as a slow-container quirk because the supplied log is too limited to support that explanation.
High availability adds PostgreSQL, Redis, and secret management
A small trial can use SQLite, memory-backed sessions, file users, and file notifications. The README calls its Lite compose bundle unsuitable for scaling, and the production guidance points elsewhere. Multiple instances need shared SQL storage and stateless Redis sessions. Email through SMTP is recommended for registration and identity-verification messages. Backups must preserve the database and the encryption material needed to read protected values.
Several secrets control sessions, storage encryption, LDAP, SMTP, Redis, and OIDC signing. Authelia supports file-based secret injection and recommends it for containers. The storage encryption key protects selected database values, while the session secret protects Redis session data. Losing or exposing either can have consequences beyond one app, because one Authelia deployment may guard every service behind a domain.
OpenID is certified while the provider remains beta
Authelia is certified against several OpenID Connect profiles. Its roadmap still calls the provider beta and warns that occasional breaking changes may occur as more of the specifications are implemented. OIDC is disabled until the provider and clients are configured. Teams should test consent, redirects, claims, logout, and client policies against each relying application instead of treating certification as an integration test.
SAML is a clearer boundary. The roadmap places a SAML 2.0 provider in planning, so a current SAML requirement should send buyers to Keycloak, Authentik, or another provider that ships it. User and administrator dashboards are also roadmap work. Authelia's portal handles authentication, while configuration remains an infrastructure-as-code job.
Active maintenance includes security releases
GitHub showed 28,700 stars, a last push on August 26, 2026, and 124 open issues and pull requests. The latest release was v4.39.20, published May 26, 2026. It fixed two security advisories involving domain canonicalization in access rules and username canonicalization for LDAP basic authentication, along with storage, session, metrics, and configuration bugs.
Those fixes support the project's advice to pin a version and read every release note. The 124-item combined queue is not a count of confirmed defects, and the same-day push plus dependency and test pull requests show ongoing work. Authelia is suitable when a team wants transparent, self-hosted policy enforcement and accepts the operational duty. Our 4 failed test groups make pre-deployment verification part of that duty, not an optional polish step.