Migrating to authentik

Moving users, applications and directories into authentik from other identity providers, legacy SSO servers, LDAP directories and earlier authentik deployments.

Migrate from Keycloak to authentik

Moving realms and clients from Keycloak to authentik: recreating OIDC and SAML clients as providers, federating Keycloak as a SAML source during cutover, users and password options, and roles to groups.

Migrate from Auth0 to authentik

Moving applications from Auth0 to self-hosted authentik: Auth0 as a SAML or OIDC source while apps cut over, user export and password options, rules and actions rebuilt as flows and policies.

Migrate from Apereo CAS to authentik

Replacing a CAS server, common in education, with authentik: chaining CAS through its OIDC module during cutover, moving CAS-protocol applications to OIDC or SAML, and attribute release.

Migrate from Shibboleth IdP to authentik

Moving SAML service providers off a Shibboleth identity provider onto authentik: federating Shibboleth as a source during cutover, metadata and entity IDs, attribute release policies as property mappings.

Importing password hashes into authentik

Moving users without forcing password resets: Django-format hash imports added in 2026.5, blueprints and the password-hash API, which hash formats need conversion, and why imports are not written back to LDAP or Kerberos.

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.
Book a callhello@deployopen.com