authentik passkeys and WebAuthn
Rolling out passkeys and FIDO2 security keys in authentik: enrollment stage settings, user verification, discoverable credentials for passwordless login, passkey autofill, and restricting allowed authenticator models.
authentik features
Pages on authentik capabilities buyers evaluate separately from basic SSO: passkeys and remote access.
authentik remote access with RAC
Giving users browser-based RDP, SSH and VNC access to internal machines through the authentik RAC provider and outpost: endpoints, per-endpoint policies, session expiry and where it fits against a VPN or bastion.
authentik access requests and privileged access management
Letting users request time-limited access to applications or entitlements with approvals in authentik 2026.8: request rules, reviewer groups and minimum counts, expiry, revocation and the audit trail.
authentik Account Lockdown for compromised accounts
Cutting off a compromised account in one action: what Account Lockdown deactivates and revokes, admin and self-service triggers, the packaged blueprint, and how it fits an incident response runbook.
authentik access reviews with Object Lifecycle Management
Scheduling periodic reviews of applications, groups and roles for audits: lifecycle rules per object or type, reviewers and minimum counts, overdue tracking and the preview status of the feature.
Scheduled user offboarding in authentik
Deactivating or deleting leavers on a set date with session and token revocation: scheduling from HR dates, review and cancellation, retries and event log evidence for joiner, mover and leaver controls.
authentik Shared Signals Framework provider
Sending security events such as logouts, revoked sessions, MFA device changes and credential changes to subscribed applications with SSF: the backchannel provider model, Apple Business Manager, signing keys and event retention.
authentik WS-Federation provider for SharePoint and Windows applications
Serving WS-Federation relying parties such as SharePoint from authentik: the Enterprise requirement, SAML2 token type only, passive browser sign-in, and replacing AD FS for these applications.
authentik Endpoint Devices: SSH, local login and CLI authentication
Using the authentik Agent for SSH to Linux hosts, local device login and kubectl or AWS CLI authentication with authentik credentials: Enterprise and preview status, platform support and when to wait.
Device compliance and conditional access in authentik
Allowing access only from compliant devices: the Fleet connector with an mTLS stage, the Chrome Enterprise Device Trust connector, device facts in expression policies, and Enterprise licensing.
Smart card and client certificate login with authentik
Authenticating or enrolling users with client certificates from devices, smart cards, PIV cards or hardware tokens through the Mutual TLS stage: Enterprise licensing, CA trust and reverse proxy certificate forwarding.
OAuth 2.0 token exchange in authentik
Letting services act on a user's behalf without sharing the original token: token exchange and on-behalf-of in authentik 2026.8, trusted providers and sources, grant type settings, and key-bound ID tokens.
Single logout with authentik SAML and OIDC providers
Ending sessions across applications when a user signs out: back-channel and front-channel logout for SAML, front-channel and back-channel logout for OIDC, post-logout redirect URIs and testing with real apps.
authentik agent accounts for automation
Giving scripts and AI agents delegated API access tied to a real user in authentik 2026.8: inherited policy access, expiry rules, API management and audit events, compared with plain service accounts.
