TL;DR

• Authentik predates the cluster and survived every migration: one identity provider, one user database, one place where access is decided.
• It speaks everything the estate needs - OIDC, SAML, LDAP, SCIM - so every app that supports a real auth protocol points at it. If an app doesn't, that's a mark against the app.
• It's a dedicated identity provider rather than a generalist: source of truth is a role that belongs to exactly one system, and Nextcloud wasn't built for it.
• MFA is tiered, with WebAuthn hardware keys for the sensitive profiles. And nobody lives as admin - least privilege applies to self-hosted apps exactly as much as to anything in a cloud.

Post 14 ended with a promise: now that the floor is mapped, we build on it. But you don't build the house first. The first thing any building gets, once the slab is poured, is a door. And on a cluster, the door is identity. Who is allowed in, through which entrance, with what proof, and what are they allowed to touch once inside.

That's the post. Authentik.

It predates the cluster

The thing about the keystone services is that the good ideas mostly survived the migrations. Authentik did. I had it running back in the Proxmox and docker-compose days, before any of this cluster existed, for the same reason I run it now: I was tired of every application keeping its own user list.

If you've run more than four self-hosted services, you know the shape of the problem. Nextcloud has users. Gitea has users. Jellyfin has users. Every app has a user database, a password policy, a password reset flow, and a notion of "admin" that means something slightly different from its neighbour's. Individually, each one is fine. Collectively, you're running a small federation of tiny identity providers that don't talk to each other, and you are the federation.

Authentik collapsed all of that into one place. One login. One place where accounts live, one place where passwords are reset, one place where "is this person allowed in" gets answered. And the reason it spread from the old estate to the new one is that it's a genuinely good fit for Kubernetes - the whole thing deploys as workloads, backed by the storage classes from last post, and it speaks every protocol the ecosystem expects. OIDC and SAML for the modern stuff. LDAP for the grumpy stuff. SCIM for provisioning, so accounts can be pushed out to things rather than pulled. Satellites, so to speak: the identity provider stays in one place and the endpoints reach out to it wherever they are.

The result is embarrassingly simple to describe: everything on the cluster that supports a real auth protocol points at Authentik. One way in. If an app doesn't support it, that's now a mark against the app, not a reason to stand up a second user database.

Why not let an app be the source of truth

The obvious alternative route: run Nextcloud, and let it be the user database. It has users, it has groups, it can share credentials around. Plenty of homelabs do exactly that and it works.

I didn't, on purpose. Nextcloud is a file platform that happens to know about users. Authentik is an identity provider, full stop. It exists to hold the user base, to federate it, to answer authentication questions, and nothing else. When something is designed for exactly one job, I've learned to give it that job instead of asking a generalist to do it badly. In a world where MS stands for MicroSlop and identity products exist mostly to make you buy more identity products, Authentik is the best I've used and the best I've tested. Open source, no upsell, and it does the one thing it promises.

There's a design principle hiding in there, the same one that shaped the storage map: source of truth is a role, and a role should belong to exactly one system. The user database lives in Authentik. Everything else - every app, every group mapping, every ACL - defers to it. The moment two systems both believe they hold the truth, you get drift, and drift in identity is how "who had access to what?" stops having an answer.

The keyring

Single sign-on would be enough of a reason, but the part I actually care about is what happens after the password. Authentik does MFA properly, including WebAuthn - real hardware-backed authentication, not an app that generates six digits.

So the policies are tiered. Regular access wants a second factor. The sensitive profiles - the ones where "someone guessed a password" would be a genuinely bad afternoon - want a hardware key. YubiKey-class devices. If the credential can't leave the fob, phishing gets a lot less interesting, because the attacker needs to steal the plastic along with the password.

And that policy is enforced by the identity provider, not by each app. This is the quiet payoff of centralisation: I write "this flow requires WebAuthn with a hardware token" once, and it applies everywhere the flow runs. Before, under the federation of tiny user databases, that sentence wasn't even writable.

Nobody logs in as admin

The last piece isn't a feature, it's a habit, and it applies to self-hosted software exactly as much as to anything I'd deploy at work: least privilege. Not as a compliance checkbox. As a daily operating mode.

The admin account in Authentik exists. It is not the account I live in. Day to day I'm a plain user, with the rights a plain user needs, and elevation is an event that happens when an event is needed. Same rule for the apps behind it: you don't get admin on Nextcloud because you have admin on the cluster, and I don't get admin anywhere just because I own the hardware.

It costs a little friction and it buys something real. When you spend your days as a regular user, the blast radius of a session hijack, a fat-fingered click, or a misbehaving app is what a regular user can touch. Which is, most days, nothing that matters. The cloud world figured this out years ago - nobody sensible runs production as root - and there's no reason a self-hosted cluster should run on a less serious model just because the hardware lives in the house.

What it buys, written down

• One identity provider, one user database, one place where access is decided.
• Protocols for everyone: OIDC, SAML, LDAP, SCIM. The apps that matter point at it.
• MFA and WebAuthn, tiered by profile, with hardware keys for the sensitive ones.
• Least privilege as a habit: nobody, including me, lives as admin.