// the take
authentik is a self-hosted identity provider that speaks SAML, OAuth2/OIDC, LDAP, and RADIUS, aimed at teams who want to replace Okta/Auth0/Entra with something they run themselves. It's for platform and infra engineers who need a real IdP in front of internal and external apps, not a toy auth demo.
Protocol coverage is unusually wide for a single open-source IdP — SAML IdP/SP, OAuth2/OIDC provider and client, LDAP, and RADIUS all live in one deployment instead of bolting together three separate tools. The blueprint system (YAML-based, exportable/importable config) gives you GitOps-style, declarative provisioning of flows and policies instead of clicking through an admin UI every time. 26k stars, active CI across core/outpost/web builds, and a steady release cadence point to a project that's actually maintained, not abandoned after a launch spike. The 'outpost' architecture (separate proxy/LDAP/RADIUS workers talking back to the core) is a sane way to scale auth protocols independently of the main app.
It's a Python/Django monolith plus a growing Rust component (outposts) plus a separate web frontend — operationally this is Postgres + Redis + the core server + however many outposts you need, which is a real stack to run and keep patched, not a single binary. Some meaningful capabilities (advanced enterprise SSO scenarios, certain compliance features) are gated behind the paid Enterprise tier, so 'open-source alternative to Okta' has an asterisk once you need those. As an identity provider it is a high-value target: a misconfiguration here doesn't just break a feature, it can leak access across every app wired into it, so you inherit the full operational burden of securing and patching an IdP yourself. Upgrades between versions have historically required care around blueprint/migration compatibility — this isn't a service you can blindly auto-update in production.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →