Connecting authentik to upstream identity providers and directories: Entra ID and Google as sources, SAML federation with Keycloak or Shibboleth, LDAP sync options and inbound SCIM.
Letting users sign in to authentik with their Entra ID accounts through an OAuth source, and syncing Entra users and groups inbound with SCIM: app registration, group claims and when to keep Entra as the master directory.
Using Google Workspace accounts to sign in to authentik and its applications: OAuth source setup, restricting to your domain, enrollment and linking to existing users.
Federating an existing Keycloak realm into authentik over SAML: exchanging signing certificates, the SAML source and Keycloak client settings, and running both during a phased move.
Letting users of a Shibboleth identity provider, common in universities, sign in to authentik over SAML: the SAML source, metadata exchange, attribute release and enrollment.
Connecting authentik to an Apereo CAS server through CAS's OpenID Connect module, since authentik has no native CAS protocol source: module requirements, endpoints and attribute mapping.
Importing users and groups from OpenLDAP, 389 Directory Server or another LDAP server with an LDAP source: sync scope, property mappings, password validation against LDAP and storing hashes locally.
Writing password changes made in authentik back to Active Directory or LDAP: the writeback option, the raw password requirement, one writeback source limit and why imported hashes are never written back.
Keeping directory group hierarchies intact in authentik with Sync Group Parents from 2026.8: how parent relationships are created, permission inheritance from ancestor groups and checking custom policies.
Letting an HR system or another IdP create and update authentik users and groups through the SCIM source: base URL and token, correlation with existing users and groups, and protecting the high-trust token.
Keeping JumpCloud as the directory while authentik handles application sign-in: LDAP source sync with JumpCloud passwords versus SCIM provisioning of directory data only.
Using an MIT Kerberos or Active Directory KDC behind authentik as a password backend or user directory, separate from browser SPNEGO single sign-on, and the preview status of the source.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.