Skip to main content

Terminology

Synchronizes

LDAP Source

FreeIPA/
Active Directory

Twitter

OAuth/SAML Source

GitHub

authentik Database

Gitlab

Provider

Application
(Stores permissions and UI details)

Policy Engine

Applications that only
support LDAP (e.g. pfSense)

LDAP Outpost

Applications that don't
support any SSO (e.g. Plex)

Proxy Outpost

Outposts

Application​

An application links together Policies with a Provider, allowing you to control access. It also holds Information like UI Name, Icon and more.

See Applications.

Source​

Sources are locations from which users can be added to authentik. For example, an LDAP Connection to import Users from Active Directory, or an OAuth2 Connection to allow Social Logins.

See Sources.

Provider​

A Provider is a way for other applications to authenticate against authentik. Common Providers are OpenID Connect (OIDC) and SAML.

See Providers.

Policy​

At a base level a policy is a yes/no gate. It will either evaluate to True or False depending on the Policy type and settings. For example, a GeoIP Policy evaluates to True if the user's IP is geolocated in the specified country or False if not. This can be used to conditionally apply Stages, grant/deny access to various objects, and for other custom logic.

See Policies.

Flows & Stages​

Flows are an ordered sequence of stages. These flows can be used to define how a user authenticates, enrolls, etc.

A stage represents a single verification or logic step. They are used to authenticate users, enroll users, and more. These stages can optionally be applied to a flow via policies.

Dynamic in-memory stage​

Certain use cases within authentik add steps that are run as part of a flow. These steps are a special type of stage called the "Dynamic in-memory" stage, as they are added to flows dynamically when required, only exist in memory, and are thus not configurable by administrators.

See Flows.

Property Mappings​

Property Mappings allow you to make information available for external applications, and to modify how information from sources are stored in authentik. For example, if you want to log in to AWS with authentik, you'd use property mappings to set the user's roles in AWS based on their group memberships in authentik.

See Provider Property Mappings and Source Property Mappings.

Outpost​

An outpost is a separate component of authentik, which can be deployed anywhere, regardless of the authentik deployment. The outpost offers services that aren't implemented directly into the authentik core, e.g. Reverse Proxying.

See Outposts.