Authentik is an IdP (Identity Provider) and SSO (Single Sign-On) platform that centralizes authentication and authorization using standard protocols like OAuth 2.0, OpenID Connect, SAML, and LDAP.

Architecture

• Server container: Hosts the core application logic, handling API requests, executing authentication/SSO flows, and serving web assets. It also includes an embedded outpost that lets you use proxy providers without deploying a separate service.
  • Core: The main part of the server that runs the IAM logic, flow execution, and protocol providers (OIDC, OAuth2, SAML, etc.).
  • Embedded outpost: A built-in microservice inside the server container used mainly for proxy providers, so you don’t need a standalone outpost for basic proxy use cases.
• Worker container: Runs asynchronous tasks like sending email, handling notifications, and scheduled system jobs. It’s separate from the core server so background work doesn’t slow down user authentication.
• PostgreSQL: The primary relational database storing configuration, users, flows, policies, providers, and other persistent data (excluding uploaded media).
• The architecture separates synchronous request handling (server) from asynchronous work (worker) to improve responsiveness.
• https://docs.goauthentik.io/core/architecture/

Terminologies

• Application: Connects a provider with policies and access rules, representing an external service users log into through Authentik.
• Provider: Defines the authentication protocol and behavior used by applications, such as OAuth 2.0, OpenID Connect, SAML, Proxy, or LDAP.
• Source: External identity systems used to import or authenticate users, like LDAP directories or third-party IdPs.
• Policy: Logical access controls that evaluate conditions and return allow or deny decisions during authentication or authorization flows.
• Flow: A structured sequence that controls how authentication, enrollment, or authorization is processed end-to-end.
• Stage: An individual step within a flow, such as password validation, MFA checks, or consent prompts.
  • A Dynamic in-memory stage is a temporary flow stage that is added only when needed, exists solely in memory, and cannot be configured by administrators.
• Property Mapping: Transforms and exposes user attributes to applications, enabling claims, roles, and permissions mapping.
  • For example, if you want to log in to AWS with authentik, you'd use property mappings to set the user's roles in AWS based on their group memberships in Authentik.
• Outpost: A lightweight component deployed separately to integrate Authentik with infrastructure services like reverse proxies or LDAP endpoints.
• https://docs.goauthentik.io/terminology/