Investigating SSO apps
As I'm growing my little constellation of services -- Forgejo for code versioning and repo storage, pipelines etc, Eleventy for SSG blogging and whatever, Azuracast for Radio, I find myself really wanting to simplify authentication and get into some SSO. I've used enterprise SSO tools like whatever the one is called at AWS, Okta, Jumpcloud, a few other ones too. But I don't have Enterprise income at this point yet, and also I just want to use something open source. That's my jam.
I attempted an install of Authentik, but it didn't go very well. I couldn't get any of my services integrated and eventually I just uninstalled it. So now I'm looking at Authelia, and possibly comparing to Keycloak. So here's a little table comparing the two.
Authelia vs. Keycloak Comparison
| Feature | Authelia | Keycloak |
|---|---|---|
| Type | Reverse-proxy-based access | Full OAuth2/OIDC/SAML Identity Provider |
| Ideal Use | Protecting apps behind a proxy | Central login for multiple apps using standard protocols |
| Complexity | Medium: config file-based | High: many options via web UI |
| User Interface | Minimal login portal | Full admin + user UI |
| User Store Options | YAML, LDAP, etc. | Built-in DB, LDAP, external IdPs |
| 2FA Support | TOTP only | TOTP, WebAuthn, Duo, etc. |
| OAuth2 / OIDC Provider | ❌ Not supported | ✅ Fully supported |
| SAML Support | ❌ No | ✅ Yes |
| SSO Experience | SSO via reverse proxy | True SSO via standard protocols |
| App Compatibility | Only apps behind a reverse proxy | Apps with OAuth2/OIDC/SAML (e.g., Forgejo, Nextcloud, Matrix, etc.) |
| Self-Service Features | ❌ None | ✅ Password reset, registration, profile edits |
| Access Rules | YAML-defined (per path/domain) | Role- and group-based |
| Docker Support | ✅ Official image + Compose setup | ✅ Official image but more setup required |
| Performance Footprint | 🟢 Lightweight (Go) | 🟡 Heavy (Java-based) |
| Learning Curve | 🟡 Medium (YAML-heavy) | 🔴 Steep (many moving parts) |
| Best For | Homelab, simple setups | Centralized identity, app integration, teams |
So I am kinda torn here, there's not a clear winner although Keycloak seems like it might have more of the features I'm looking for. We'll see how it pans out.