Enforcing MFA for every authentik user
Making MFA mandatory instead of optional: the authenticator validation stage's not-configured action, forcing enrollment at next login, allowed device classes, and handling users who lose their device.
authentik MFA and passwordless
Choosing and enforcing authentik's second factors, from TOTP, Duo, SMS and email codes to hardware keys, and making MFA work for LDAP and RADIUS clients too.
TOTP authenticator apps with authentik
Setting up time-based one-time passwords with Google Authenticator, Microsoft Authenticator or similar apps: enrollment flow, validation, throttling of repeated guesses and recovery when a phone is replaced.
Duo MFA with authentik
Using Duo push and passcodes as an authentik authenticator: Auth API and Admin API credentials, importing existing Duo users, the Duo license needed for automatic import, and requiring Duo at login.
SMS one-time codes with authentik via Twilio or a generic gateway
Sending SMS codes from authentik through Twilio or any HTTP SMS gateway: provider settings, verify-only mode that stores a hash instead of the number, failed-send behavior and restricting accepted numbers.
Email one-time codes as a second factor in authentik
Using emailed one-time codes as an MFA method: the email authenticator stage added in 2025.2, SMTP settings, token expiry, throttling and when email codes are acceptable for your risk level.
Recovery codes and static tokens in authentik
Giving users backup codes for when their authenticator is lost: the static authenticator stage, how codes are validated, throttling, and administrator recovery without weakening MFA.
Restricting authentik WebAuthn to approved hardware keys
Allowing only specific security key models, such as a company-issued FIDO2 key, with WebAuthn device type restrictions: allowlists at login and enrollment, re-enrolling older devices and user verification.
MFA for LDAP and RADIUS clients in authentik
Adding a second factor to applications that bind over LDAP or RADIUS: code-based authenticators appended to the password, Duo push, unsupported SMS, and bind flow design.
Skipping repeat MFA prompts with the last validation threshold
Balancing security and friction with the authenticator validation stage's last validation threshold and remember-device settings: sensible values, limits for code-based methods and hardening advice.
Brute-force protection for authentik MFA codes
Slowing guessing attacks on one-time codes: 2FA attempt throttling for email and SMS added in 2026.5, existing protection for TOTP and static codes, reputation policies and alerting on failed logins.
