What’s everyones recommendations for a self-hosted authentication system?

My requirements are basically something lightweight that can handle logins for both regular users and google. I only have 4-5 total users.

So far, I’ve looked at and tested:

  • Authentik - Seems okay, but also really slow for some reason. I’m also not a fan of the username on one page, password on the next screen flow
  • Keycloak - Looks like it might be lighter in resources these days, but definitely complicated to use
  • LLDAP - I’d be happy to use it for the ldap backend, but it doesn’t solve the whole problem
  • Authelia - No web ui, which is fine, but also doesn’t support social logins as far as I can tell. I think it would be my choice if it did support oidc
  • Zitadel - Sounds promising, but I spent a couple hours troubleshooting it just to get it working. I might go back to it, but I’ve had the most trouble with it so far and can’t even compare the actual config yet
    • JustEnoughDucks@feddit.nlEnglish
      3·
      2 年前

      OIDC does indeed work fine too.

      I use it on nextcloud and immich and a few others.

      You will be much more hard pressed to find apps that support SSO and oidc than oidc that authelia is broken on.

    • johntash@eviltoast.orgOPEnglish
      1·
      2 年前

      Hmm I thought authelia could only act as an oidc provider, I didn’t think it could allow logging in through a Google account for example?

      I’ll take a look at the docs again, thanks!

      • Unchanged3656English
        2·
        2 年前

        After looking deeper into the docs they do not support and do not plan to support the Relying Party role. So it probably won’t fit for this use case.

        • johntash@eviltoast.orgOPEnglish
          1·
          2 年前

          Thanks for confirming, I just saw that as well.

          I’m going to try some of the other solutions in this thread, but I might still come back to authelia and just ignore my requirement for having social login. I like the idea of sending someone a link and saying “Hey just log in with your google account” instead of having to create an actual user for them, but maybe I can use something else specifically for those cases.