One sign-in, from your own directory.
Authentik is the one place people sign in, for every app in the estate. If you run Active Directory, it joins Authentik as a source: people and groups sync in, and your directory still checks every password. This runs today in two organisations.
What it holds
| Authentik server | the one sign-in for every app |
|---|---|
| Authentik worker | runs the directory sync |
| Active Directory | yours: people, groups and passwords stay there |
| LDAP source | reads users and groups with a read-only account |
| OpenID Connect clients | one per app, carrying the person’s groups |
What it promises
Passwords stay with your directory
Authentik does not copy password hashes from Active Directory. At each login it asks your directory to check the password.
Groups decide roles
When a person signs in, the app receives their groups and matches a group name to a role. Membership is managed where it already is.
Leavers are stopped at the door
Disable or delete an account in Active Directory and the next sign-in fails, because the password check goes to your directory.
Proved with a real sign-in
A rollout is done when the groups that grant roles are confirmed one by one and a real directory user signs in with the right role. Totals alone are not trusted.
What people ask
Will people need a new password?
No. They sign in with their Active Directory username and password. Authentik keeps no copy of the password.
How soon does a change in the directory show up?
On the next sync. Authentik sets no sync schedule by default, so one is set in the source or the sync is run when the directory changes. A new group’s members fill in on the sync after the group arrives.
Do we need Active Directory?
No. Authentik is the sign-in either way. If you have a directory it joins as a source; if not, accounts live in Authentik itself.