When home services reach five or six, every family member ends up with as many accounts and passwords to remember. Even more annoying is having to create, change and disable users in each application separately. A single sign-on (SSO) system solves both problems: one account per person, one place to enable the second factor, one place to revoke access. Two projects widely used at home are Authentik and Authelia.
Two ways to protect a service
Before choosing the tool, it helps to understand the two main mechanisms an identity provider uses to protect applications.
OpenID Connect (OIDC)
The application knows how to talk to an identity provider. When the user clicks «log in», they are sent to the identity provider's page, authenticate there and return to the application with a token that vouches for their identity. It is the cleanest method: the application genuinely knows the user and can grant the right permissions. Many popular home services, such as Nextcloud, Immich, Jellyfin through a plugin, Forgejo and Paperless-ngx, support OIDC directly or through extensions.
Forward auth
The application knows nothing about SSO. It is the reverse proxy that, before forwarding each request, asks the identity provider whether the user is authenticated. If not, it sends them to the login page. This is useful for protecting services with no login of their own, such as admin panels or dashboards. The limitation is that the application behind it cannot tell users apart, unless it reads the headers the proxy adds.
Authentik and Authelia compared
The two projects have different philosophies, and the choice depends mainly on how much you want to manage.
| Aspect | Authelia | Authentik |
|---|---|---|
| Configuration | YAML file | Web interface and configurable flows |
| Resources | Very lightweight | More components (server, worker, database, cache) |
| Forward auth | A core strength | Supported through outposts |
| OIDC | Supported | Supported, along with SAML and LDAP |
| User management | File or external LDAP | Built in, with invitations and enrolment |
Authelia is ideal for those who prefer a minimal text configuration that can be versioned, and who have few users. Authentik is better suited when you want to manage users and groups from an interface, offer password recovery by email or integrate services that only speak LDAP.
A typical home setup
A simple, robust architecture looks like this:
- The identity provider has its own address, for example
auth.home.example. - Applications that support OIDC are connected directly, each with its own client and secret.
- Services with no login are protected with forward auth at the reverse proxy level.
- Groups decide who sees what: for example, «family» can access photos and calendars, «admin» the technical panels as well.
A practical tip: connect one application at a time, checking login, logout and permissions straight away, rather than migrating everything in one evening.
The second factor, set up only once
One of the most concrete advantages of SSO is that the second factor is configured in a single place. Both projects support time-based codes (TOTP) and security keys or passkeys through WebAuthn. You can also define different rules by context: for example, requiring only the password from the home network and the second factor for access from outside.
Do not lock yourself out
Concentrating access in a single service carries an obvious risk: if the identity provider breaks, you can no longer get in anywhere. Some precautions:
- Local emergency accounts: in every important application I keep a local administrator with a strong password, stored in the password manager, to use only if SSO is not working.
- Back up the identity provider: its database and configuration must be included in the backup like any other critical service.
- Recovery methods: for your own administrator account, register at least two second-factor methods.
- Independent start-up: the identity provider should not depend on services that themselves require a login.
When you do not need it
For one person with three services, SSO can be more complicated than the problem it solves: a good password manager and access restricted to the private network are enough. The benefit grows with the number of users and services, and becomes obvious on the day a family member changes phone or someone has to lose access to everything with a single click.
In short
- SSO gives each person one account and one place for the second factor.
- OIDC truly integrates the application; forward auth also protects services with no login.
- Authelia is lightweight and text-based, Authentik more complete and managed through an interface.
- Migrate one application at a time, checking permissions.
- Emergency accounts and backups keep you from being locked out.
