Why these three tools don't do the same thing
Authelia is an authentication proxy (forward auth, basic OIDC), not a full IAM. It doesn't manage a directory, doesn't speak SAML 2.0 natively, doesn't provision accounts. Authentik is a full IAM: OIDC, SAML 2.0, LDAP, SCIM, proxy. Keycloak is the historical JVM IAM: OIDC, SAML 2.0, LDAP, Kerberos, SCIM. The decision rests on the number of apps and the need for provisioning, not on the name.
What this informed choice concretely changes
- Authelia under 30 MB of RAM at rest — fits on a 2 vCPU / 2 GB VPS with its SQLite database.
- Authentik consolidates OIDC, SAML, LDAP and SCIM into a single component — what Keycloak + a separate SCIM manager sometimes do.
- Keycloak is only required for Kerberos or complex enterprise SAML federation — cases neither Authelia nor Authentik cover.
- The attack surface is proportional to scope — a lightweight proxy exposes fewer vectors than a full IAM.
- Fewer components to maintain — one well-chosen tool reduces the number of CVEs to track.
- VPS sizing follows directly from the choice — Authelia: 2 GB, Authentik: 4 GB, Keycloak: 8 GB minimum.
Quantified prerequisites per tool
Authelia starts under 30 MB of RAM and runs on a 2 vCPU / 2 GB VPS. Authentik mobilises 420 to 500 MB at rest across its four containers (server, worker, PostgreSQL 16, Redis) — a 2 vCPU / 4 GB VPS is the baseline. Keycloak requires at least 1 GB of JVM heap plus 300 MB off-heap, a floor of 1.3 GB dedicated before any load; the official documentation recommends 500 MB per 100,000 active sessions — a VPS below 8 GB is unsuitable for production. All three tools require: a resolved domain name, valid TLS (Let's Encrypt suffices), a reverse proxy (Traefik or nginx) and Docker + Compose.
Authelia vs Authentik: when to choose which
| Criterion | Authelia | Authentik |
|---|---|---|
| RAM at startup | < 30 MB | 420–500 MB (4 containers) |
| Protocols | Forward auth + basic OIDC | OIDC, SAML 2.0, LDAP, SCIM, proxy |
| SCIM provisioning | No | Yes |
| Recommended VPS | 2 vCPU / 2 GB | 2 vCPU / 4 GB |
| Admin interface | YAML + files | Full web UI |
| Learning curve | Low | Medium |
| Use case | Lightweight 2FA/SSO proxy (2–6 apps) | Full self-hosted IAM (> 5 apps, SAML) |
| Recent CVEs Aug 2026 | None announced | None announced |
Authelia: when to choose it
Choose Authelia for 2 to 6 internal apps to protect with 2FA or lightweight OIDC SSO, when RAM is constrained and SCIM provisioning is not needed. Standard solution for Gitea, Grafana, admin panels, monitoring, behind Traefik or nginx, on a VPS shared with other services. Authelia is not a fit if apps speak SAML 2.0 and refuse OIDC, or if LDAP synchronisation with account creation is required.
Deploy Authelia on VPS (Docker Compose)
Create the configuration structure
mkdir -p ~/authelia/config && cd ~/authelia — create config/configuration.yml with jwt_secret, default_redirection_url, session, storage (SQLite), authentication_backend (file).
Generate password hashes
docker run --rm authelia/authelia:latest authelia crypto hash generate argon2 --password 'YourPassword' — paste the hash into config/users_database.yml under users.<login>.password.
Write docker-compose.yml
Declare the Authelia service, mount ./config:/config, expose port 9091 internally only (never directly public), connect to the shared network with the reverse proxy.
Configure the reverse proxy
In Traefik: forwardAuth middleware pointing to http://authelia:9091/api/authz/forward-auth. In nginx: auth_request /authelia; and location /authelia blocks. The reverse proxy passes Remote-User, Remote-Groups, Remote-Email.
Start and verify
docker compose pull && docker compose up -d && docker compose logs -f authelia — verify the healthy status, test from a browser in private mode.
Authentik: when to choose it
Choose Authentik for more than five apps to federate, some speaking SAML 2.0 or using an LDAP directory, for automatic SCIM provisioning, or as a self-hosted replacement for Okta/Auth0/Azure AD. Full graphical administration interface to manage users, groups and policies without touching YAML. Authentik is available as a VPS template on the ServOrbit Marketplace: pre-configured stack (4 containers), up and running in minutes.
Deploy Authentik on VPS (official Docker Compose)
Download the official Compose file
wget https://goauthentik.io/docker-compose.yml — Authentik maintains a Compose file with 4 services: server, worker, postgresql, redis.
Generate secrets and populate .env
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env && echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env && echo "AUTHENTIK_ERROR_REPORTING__ENABLED=false" >> .envStart the stack
docker compose pull && docker compose up -d — the first start takes 1 to 2 minutes (PostgreSQL migrations).
Initialise via the wizard
Navigate to https://authentik.yourdomain.com/if/flow/initial-setup/ (port 9443 if no reverse proxy yet). Create the akadmin account. This wizard is accessible only once.
Configure your first OIDC provider
UI → Applications → Providers → Create → OAuth2/OIDC. Set the name, the Authorized redirect URI, note the Client ID and Client Secret. Link the provider to an application and assign an access group.
Keycloak: why it is rarely the right choice on VPS
Keycloak is proven in banking and enterprise environments: Kerberos, complex SAML federation, multi-node high availability. These capabilities have a direct cost. CVE-2026-15572 (CVSS 8.8) allows an attacker with client registration rights to escalate privileges to full realm administration via a mapper type-swap during an update — fixed in Keycloak 26.7.1. CVE-2026-4629 (CVSS 8.1) exploits a role mapper with hardened roles in clients managed by manage-clients, granting access to unauthorised privileges. On a VPS below 8 GB, JVM overhead consumes available resources before any load. Keycloak is relevant only if you have a proven Kerberos need or an enterprise SAML federation that neither Authelia nor Authentik covers.
If you maintain Keycloak: three immediate measures
Disable Dynamic Client Registration if unused (CVE-2026-15572 vector). Restrict /admin to an internal network or bastion — no direct admin access on the public interface. Configure Admin Events to redirect to syslog or a monitoring tool.
Troubleshooting: frequent errors
Authelia — 404 on /api/authz/forward-auth: since version 4.38, the canonical path is /api/authz/forward-auth (formerly /api/verify). Update the reverse proxy config.
Authelia — infinite redirect loop: the session.domain does not match the root domain. It must be yourdomain.com, not auth.yourdomain.com.
Authentik — worker crash loop: OOM killer on a 2 GB VPS with other services. Background tasks (emails, SCIM) stop silently while the login page continues. Add RAM or migrate the other services.
Authentik — 502 Bad Gateway after startup: PostgreSQL migrations not yet complete. Wait 1 to 2 minutes, check with docker compose logs server that migrations are marked OK.
Keycloak — OutOfMemoryError: adjust KC_JVM_HEAP_MIN and KC_JVM_HEAP_MAX; the official guideline is to allocate 70% of available RAM to the heap.
Which solution for your context
Authelia for 2-6 internal apps with lightweight 2FA/OIDC (2 GB RAM, YAML, minimal attack surface); Authentik for more than 5 apps, SAML 2.0, SCIM, Okta/Auth0 replacement (4 GB RAM, graphical UI); Keycloak only for Kerberos or complex enterprise SAML (8+ GB RAM). Authentik is available as a VPS template on the ServOrbit Marketplace.
