authentik

Authentik Security | Security Engineer | US | REMOTE (anywhere) | Full-time Authentik Security (https://goauthentik.io) is the company behind authentik (https://github.com/goauthentik/authentik), an open source identity provider with 1M+ unique installations. Help us replace Okta/Auth0, Ping Identity, and Microsoft Entra with modern, secure identity for all! We are a small remote team, looking to scale up with experienced software engineers, primarily with a backend security focus. Bonus points if you have significant experience with identity/SSO standards and/or Django/Python. To apply, please use: https://forms.gle/NYXH4E19LUohbpmJA

Authentik Security | Senior Engineer | US | REMOTE (anywhere) | Full-time Authentik Security (https://goauthentik.io) is the company behind authentik (https://github.com/goauthentik/authentik), an open source identity provider with 1M+ unique installations. Help us replace Okta/Auth0, Ping Identity, and Microsoft Entra with modern, secure identity for all! We are a small remote team, looking to scale up with experienced software engineers, primarily with a backend focus. Bonus points if you have significant experience with identity/SSO standards and/or Django/Python. There is also the opportunity to be "forward deployed" spending 20%+ of time with enterprise customers (remotely) on configuration best practices and rollout strategies, _if_ that is of interest to the right candidate. To apply, please use: https://forms.gle/NYXH4E19LUohbpmJA

Those guys are also opening "ad" issues on unrelated repositories[0]. Adding that to what others mentioned, it really doesn't inspire confidence in the software https://github.com/goauthentik/authentik/issues/13521

Authentik Security | Engineer | US | REMOTE (anywhere) | Full-time Authentik Security (https://goauthentik.io) is the company behind authentik (https://github.com/goauthentik/authentik), an open source identity provider with over 250k+ unique installations and 12M+ downloads. Help us replace Okta/Auth0, Ping Identity, and Microsoft Entra with modern, secure identity for all! We are a small remote team, looking to scale up with a couple experienced software engineers, primarily with a backend focus. Bonus points if you have significant experience with identity/SSO standards and/or Django/Python. There is also the opportunity to be "forward deployed" spending 15-20% of time with enterprise customers (remotely) on configuration best practices and rollout strategies, _if_ that is of interest to the right candidate. To apply, please use: https

Hey, for authentik this is actually something we're actively working on: https://github.com/goauthentik/authentik/pull/8330, and this will be included in our next feature release in April! (Disclaimer, I am founder and CTO of authentik)

See here for the fix, which both implements the workaround suggested in the issue and also a much more standard-compliant method: https://github.com/goauthentik/authentik/pull/8471

authentik CTO here; we’ll fix this in the next release (match-april), it should be possible in a non backwards incompatible way using the suggestion in this comment https://github.com/goauthentik/authentik/issues/6139#issueco... (which does call that solution a hack but I wouldn’t necessarily agree)

Authentik has completely messed up their implementation of the oauth client credentials grant. It is not fixable without breaking changes and does not work with many tools using the cc grant. After seeing this they were completely off the table for me. https://github.com/goauthentik/authentik/issues/6139

For anyone, considering authentik, I want to warn you by saying "here be dragons." To start, I have protected 10+ services at any given time. Both in docker and k8s. Unless you enjoy configuring protection for each service independently, you'll have a bad time in authentik. Authentik suffers from a debilitating bug[0] where when using a single config to protect all services on subdomains (i.e. app1.example.com, app2.example.com, etc.) your users will be randomly redirected to a different service when reauthenticating after the session expires. [0]: https://github.com/goauthentik/authentik/issues/6886

The link "Changed to GPL v3" was actually "change to Enterprise Edition license. So that's a bizarre comment to make in the blog post. https://github.com/goauthentik/authentik/commit/4671d4afb4d3...

We used keycloak for openid identity provider as well. It is fine to setup keycloak once. But it is painful share the setup with other engineers. For local development, we end up using dex (https://dexidp.io). When we need support group/role, we use dex and glauth(https://glauth.github.io). Both dex and glauth can be configured with yaml files. We just created a few yaml files and a docker compose file, every engineer can be brought up the whole environment in a few seconds. Also https://www.authelia.com and https://github.com/goauthentik/authentik look pretty promising, if you need more advanced features from them.