Single Sign-On with Authelia: One Login for Everything

One of the first things new self-hosters notice: every application has its own login page. Nextcloud asks for a password. EspoCRM asks for a password. Uptime Kuma asks for a password. For a team of 10 people using 6 applications, that is 60 sets of credentials to create, remember, and manage. When someone leaves, you have to revoke access in 6 different places.

This is the problem Authelia solves.

How It Works

Authelia sits in front of all your applications as an authentication gateway. When someone tries to access any app, Authelia intercepts the request and checks: are they logged in? If not, they see one login page. After entering their credentials (and optionally a second factor), they are authenticated for every application behind Authelia.

Think of it like a security checkpoint at the entrance of a building. Once you pass through, you can enter any office. Without it, every office has its own locked door with a different key.

What You Get

• One set of credentials per user. Your team remembers one password instead of six.
• Two-factor authentication. Every login can require a TOTP code from an authenticator app. Even if a password is compromised, the account stays secure.
• Access control per user. Not everyone needs access to every application. You can define groups and policies: accounting sees the ERP, sales sees the CRM, management sees everything.
• Clean onboarding and offboarding. Add a user once and they get access to everything they need. Remove them once and they lose access to everything, instantly.
• Brute-force protection. Authelia rate-limits login attempts and can ban IPs after repeated failures.

What It Integrates With

Authelia supports multiple backends for user storage:

• LDAP (including OpenLDAP, Active Directory, FreeIPA)
• File-based users stored in a simple YAML configuration file (fine for small teams)

For two-factor authentication, it supports TOTP (Google Authenticator, Authy, etc.), WebAuthn (hardware security keys like YubiKey), and Duo push notifications.

Is It Right for Your Team?

If your team uses 3 or more self-hosted applications, Authelia is worth deploying. The setup takes a few hours and the payoff is immediate: fewer password resets, cleaner onboarding, and a significant security upgrade. VPS1 deploys Authelia as a standard component in every multi-application setup.

Ask us about SSO for your self-hosted stack.