authentik forward auth with Traefik
Putting authentik in front of applications behind Traefik with the forwardAuth middleware: Docker Compose labels, Kubernetes ingress routes, response headers and single-application versus domain-level mode.
authentik outposts and forward auth
Protecting applications that cannot speak OIDC or SAML with authentik's proxy outpost behind a specific reverse proxy, and deploying and running outposts on Docker or Kubernetes.
authentik forward auth with NGINX auth_request
Protecting applications served by NGINX with authentik through auth_request: the outpost location, headers passed upstream, redirects to login and Kubernetes ingress-nginx annotations.
authentik forward auth with Caddy
Using Caddy's forward_auth directive with the authentik outpost: the outpost path, copying identity headers to the upstream application and TLS handled by Caddy.
authentik with Envoy or Istio external authorization
Checking requests against authentik from Envoy or an Istio mesh with external authorization: the outpost as ext_authz service, which paths go to authentik and per-application policies.
authentik forward auth with HAProxy
Protecting applications behind HAProxy with the authentik outpost: request routing for the outpost path, authentication checks and headers to the backend.
Single-application versus domain-level forward auth in authentik
Choosing between one provider per application and one provider for a whole parent domain: per-application policies, cookie domains, authorization prompts and the trade-off in access control.
Header-based authentication to legacy apps with the authentik proxy
Passing the signed-in user to applications that trust HTTP headers: user and application headers the proxy outpost sets, additionalHeaders on users and groups, custom dynamic headers and keeping the app unreachable except through the proxy.
Deploying authentik outposts on Kubernetes
Running proxy, LDAP, RADIUS and RAC outposts in Kubernetes: the built-in Kubernetes integration that authentik manages, replicas, namespaces and ingress settings, or manual deployments with your own manifests.
Deploying authentik outposts with Docker
Running authentik outposts next to applications on Docker hosts: the Docker integration that creates containers automatically, manual Compose deployments with an outpost token, networks and image sources.
The authentik embedded outpost: when to use it and when to disable it
Understanding the outpost built into the authentik server: what it serves, shared metrics, when a standalone proxy outpost is better, and the hardening advice to disable it if unused.
Linux host login with authentik LDAP and SSSD
Letting users log in to Linux servers with authentik credentials through SSSD and the LDAP outpost: service account and search group, LDAPS, and what is not supported such as sudo rules, automount and Kerberos.
