[{"data":1,"prerenderedAt":198},["ShallowReactive",2],{"seo-verification":3,"blog-authentik-authelia-or-keycloak-choosing-your-sso-on-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":146,"ctaBody":147,"ctaButton":148,"ctaUrl":149,"relatedPosts":150},272,"authentik-authelia-or-keycloak-choosing-your-sso-on-vps",{"fr":10,"en":8,"ar":11},"authentik-vs-authelia-keycloak-sso-vps-2026","authentik-أو-authelia-أو-keycloak-اختيار-sso-على-vps","Authentik, Authelia or Keycloak: Choosing Your SSO on VPS","Authentik, Authelia or Keycloak on VPS: compare real memory footprint, covered protocols and Keycloak 26.7.1 CVEs to choose the right self-hosted SSO.",10,0,false,"2026-08-16T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fauthentik-vs-authelia-keycloak-sso-vps-2026-poster.svg",{"categorySlug":30,"appSlug":31},"cybersecurity-bastion","authentik","Authelia, Authentik and Keycloak come up whenever you search for a self-hosted SSO. Yet their scope differs radically, and picking the wrong tool costs you RAM, operational time and potentially security. Two CVEs disclosed in Keycloak 26.7.1 have reignited comparative questions. This guide answers one: which one fits your VPS context.",[34,38,48,51,90,93,112,115,133,136,140,143],{"type":35,"title":36,"body":37},"h2","Why these three tools don't do the same thing","Authelia is an authentication proxy (forward auth, basic OIDC), not a full IAM. It doesn't manage a directory, doesn't speak SAML 2.0 natively, doesn't provision accounts. Authentik is a full IAM: OIDC, SAML 2.0, LDAP, SCIM, proxy. Keycloak is the historical JVM IAM: OIDC, SAML 2.0, LDAP, Kerberos, SCIM. The decision rests on the number of apps and the need for provisioning, not on the name.",{"type":39,"title":40,"items":41},"ul","What this informed choice concretely changes",[42,43,44,45,46,47],"**Authelia under 30 MB of RAM at rest** — fits on a 2 vCPU \u002F 2 GB VPS with its SQLite database.","**Authentik consolidates OIDC, SAML, LDAP and SCIM into a single component** — what Keycloak + a separate SCIM manager sometimes do.","**Keycloak is only required for Kerberos or complex enterprise SAML federation** — cases neither Authelia nor Authentik cover.","**The attack surface is proportional to scope** — a lightweight proxy exposes fewer vectors than a full IAM.","**Fewer components to maintain** — one well-chosen tool reduces the number of CVEs to track.","**VPS sizing follows directly from the choice** — Authelia: 2 GB, Authentik: 4 GB, Keycloak: 8 GB minimum.",{"type":35,"title":49,"body":50},"Quantified prerequisites per tool","Authelia starts under 30 MB of RAM and runs on a 2 vCPU \u002F 2 GB VPS. Authentik mobilises 420 to 500 MB at rest across its four containers (server, worker, PostgreSQL 16, Redis) — a 2 vCPU \u002F 4 GB VPS is the baseline. Keycloak requires at least 1 GB of JVM heap plus 300 MB off-heap, a floor of 1.3 GB dedicated before any load; the official documentation recommends 500 MB per 100,000 active sessions — a VPS below 8 GB is unsuitable for production. All three tools require: a resolved domain name, valid TLS (Let's Encrypt suffices), a reverse proxy (Traefik or nginx) and Docker + Compose.",{"type":52,"title":53,"headers":54,"rows":58},"comparison","Authelia vs Authentik: when to choose which",[55,56,57],"Criterion","Authelia","Authentik",[59,63,67,71,75,79,83,87],[60,61,62],"RAM at startup","\u003C 30 MB","420–500 MB (4 containers)",[64,65,66],"Protocols","Forward auth + basic OIDC","OIDC, SAML 2.0, LDAP, SCIM, proxy",[68,69,70],"SCIM provisioning","No","Yes",[72,73,74],"Recommended VPS","2 vCPU \u002F 2 GB","2 vCPU \u002F 4 GB",[76,77,78],"Admin interface","YAML + files","Full web UI",[80,81,82],"Learning curve","Low","Medium",[84,85,86],"Use case","Lightweight 2FA\u002FSSO proxy (2–6 apps)","Full self-hosted IAM (> 5 apps, SAML)",[88,89,89],"Recent CVEs Aug 2026","None announced",{"type":35,"title":91,"body":92},"Authelia: when to choose it","Choose Authelia for 2 to 6 internal apps to protect with 2FA or lightweight OIDC SSO, when RAM is constrained and SCIM provisioning is not needed. Standard solution for Gitea, Grafana, admin panels, monitoring, behind Traefik or nginx, on a VPS shared with other services. Authelia is not a fit if apps speak SAML 2.0 and refuse OIDC, or if LDAP synchronisation with account creation is required.",{"type":94,"title":95,"steps":96},"steps","Deploy Authelia on VPS (Docker Compose)",[97,100,103,106,109],{"title":98,"body":99},"Create the configuration structure","`mkdir -p ~\u002Fauthelia\u002Fconfig && cd ~\u002Fauthelia` — create `config\u002Fconfiguration.yml` with `jwt_secret`, `default_redirection_url`, `session`, `storage` (SQLite), `authentication_backend` (file).",{"title":101,"body":102},"Generate password hashes","`docker run --rm authelia\u002Fauthelia:latest authelia crypto hash generate argon2 --password 'YourPassword'` — paste the hash into `config\u002Fusers_database.yml` under `users.\u003Clogin>.password`.",{"title":104,"body":105},"Write docker-compose.yml","Declare the Authelia service, mount `.\u002Fconfig:\u002Fconfig`, expose port `9091` internally only (never directly public), connect to the shared network with the reverse proxy.",{"title":107,"body":108},"Configure the reverse proxy","In Traefik: `forwardAuth` middleware pointing to `http:\u002F\u002Fauthelia:9091\u002Fapi\u002Fauthz\u002Fforward-auth`. In nginx: `auth_request \u002Fauthelia;` and `location \u002Fauthelia` blocks. The reverse proxy passes `Remote-User`, `Remote-Groups`, `Remote-Email`.",{"title":110,"body":111},"Start and verify","`docker compose pull && docker compose up -d && docker compose logs -f authelia` — verify the `healthy` status, test from a browser in private mode.",{"type":35,"title":113,"body":114},"Authentik: when to choose it","Choose Authentik for more than five apps to federate, some speaking SAML 2.0 or using an LDAP directory, for automatic SCIM provisioning, or as a self-hosted replacement for Okta\u002FAuth0\u002FAzure AD. Full graphical administration interface to manage users, groups and policies without touching YAML. Authentik is available as a VPS template on the ServOrbit Marketplace: pre-configured stack (4 containers), up and running in minutes.",{"type":94,"title":116,"steps":117},"Deploy Authentik on VPS (official Docker Compose)",[118,121,124,127,130],{"title":119,"body":120},"Download the official Compose file","`wget https:\u002F\u002Fgoauthentik.io\u002Fdocker-compose.yml` — Authentik maintains a Compose file with 4 services: server, worker, postgresql, redis.",{"title":122,"body":123},"Generate secrets and populate .env","```bash\necho \"PG_PASS=$(openssl rand -base64 36 | tr -d '\\n')\" >> .env && echo \"AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\\n')\" >> .env && echo \"AUTHENTIK_ERROR_REPORTING__ENABLED=false\" >> .env\n```",{"title":125,"body":126},"Start the stack","`docker compose pull && docker compose up -d` — the first start takes 1 to 2 minutes (PostgreSQL migrations).",{"title":128,"body":129},"Initialise via the wizard","Navigate to `https:\u002F\u002Fauthentik.yourdomain.com\u002Fif\u002Fflow\u002Finitial-setup\u002F` (port `9443` if no reverse proxy yet). Create the `akadmin` account. This wizard is accessible only once.",{"title":131,"body":132},"Configure your first OIDC provider","UI → Applications → Providers → Create → OAuth2\u002FOIDC. Set the name, the `Authorized redirect URI`, note the `Client ID` and `Client Secret`. Link the provider to an application and assign an access group.",{"type":35,"title":134,"body":135},"Keycloak: why it is rarely the right choice on VPS","Keycloak is proven in banking and enterprise environments: Kerberos, complex SAML federation, multi-node high availability. These capabilities have a direct cost. CVE-2026-15572 (CVSS 8.8) allows an attacker with client registration rights to escalate privileges to full realm administration via a mapper type-swap during an update — fixed in Keycloak 26.7.1. CVE-2026-4629 (CVSS 8.1) exploits a role mapper with hardened roles in clients managed by `manage-clients`, granting access to unauthorised privileges. On a VPS below 8 GB, JVM overhead consumes available resources before any load. Keycloak is relevant only if you have a proven Kerberos need or an enterprise SAML federation that neither Authelia nor Authentik covers.",{"type":137,"title":138,"body":139},"tip","If you maintain Keycloak: three immediate measures","Disable Dynamic Client Registration if unused (CVE-2026-15572 vector). Restrict `\u002Fadmin` to an internal network or bastion — no direct admin access on the public interface. Configure Admin Events to redirect to syslog or a monitoring tool.",{"type":35,"title":141,"body":142},"Troubleshooting: frequent errors","**Authelia — 404 on `\u002Fapi\u002Fauthz\u002Fforward-auth`**: since version 4.38, the canonical path is `\u002Fapi\u002Fauthz\u002Fforward-auth` (formerly `\u002Fapi\u002Fverify`). Update the reverse proxy config.\n\n**Authelia — infinite redirect loop**: the `session.domain` does not match the root domain. It must be `yourdomain.com`, not `auth.yourdomain.com`.\n\n**Authentik — worker crash loop**: OOM killer on a 2 GB VPS with other services. Background tasks (emails, SCIM) stop silently while the login page continues. Add RAM or migrate the other services.\n\n**Authentik — 502 Bad Gateway after startup**: PostgreSQL migrations not yet complete. Wait 1 to 2 minutes, check with `docker compose logs server` that migrations are marked OK.\n\n**Keycloak — OutOfMemoryError**: adjust `KC_JVM_HEAP_MIN` and `KC_JVM_HEAP_MAX`; the official guideline is to allocate 70% of available RAM to the heap.",{"type":35,"title":144,"body":145},"Which solution for your context","Authelia for 2-6 internal apps with lightweight 2FA\u002FOIDC (2 GB RAM, YAML, minimal attack surface); Authentik for more than 5 apps, SAML 2.0, SCIM, Okta\u002FAuth0 replacement (4 GB RAM, graphical UI); Keycloak only for Kerberos or complex enterprise SAML (8+ GB RAM). Authentik is available as a VPS template on the ServOrbit Marketplace.","Deploy Authentik on Your VPS","Authentik is available as a VPS template on the ServOrbit Marketplace. The environment is pre-built, the containers are pre-configured — your IAM platform is operational in minutes.","Deploy Authentik","\u002Fmarketplace\u002Fcybersecurity-bastion\u002Fauthentik",[151,167,184],{"id":152,"slug":153,"slugs":154,"title":157,"excerpt":158,"readTime":159,"views":15,"isPinned":16,"publishedAt":160,"category":161,"categories":162,"featuredImage":26,"bgImage":27,"posterImage":164,"relatedSolution":165},111,"centralizing-authentication-with-authentik-on-vps",{"fr":155,"en":153,"ar":156},"sso-authentik-vps","مركزة-المصادقة-باستخدام-authentik-على-خادم-vps","Centralizing authentication with Authentik on VPS","Centralize the authentication of all your apps with self-hosted Authentik on a VPS: SSO, MFA and forward auth in Docker Compose.",3,"2026-03-01T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[163],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fsso-authentik-vps-poster.svg",{"categorySlug":166,"appSlug":31},"securite",{"id":168,"slug":169,"slugs":170,"title":173,"excerpt":174,"readTime":175,"views":176,"isPinned":16,"publishedAt":177,"category":178,"categories":179,"featuredImage":26,"bgImage":27,"posterImage":181,"relatedSolution":182},162,"self-host-authelia-on-a-vps-mfa-and-sso-for-your-whole-stack",{"fr":171,"en":169,"ar":172},"self-host-authelia-vps","استضافة-authelia-على-vps-مصادقة-ثنائية-ودخول-موحد-لمنظومتك","Self-Host Authelia on a VPS: MFA and SSO for Your Whole Stack","Deploy Authelia on your VPS to add MFA, SSO and fine-grained access control in front of any self-hosted app — no code changes, one configuration file.",5,2,"2026-07-04T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[180],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fself-host-authelia-vps-poster.svg",{"categorySlug":23,"appSlug":183},"authelia",{"id":185,"slug":186,"slugs":187,"title":190,"excerpt":191,"readTime":192,"views":15,"isPinned":16,"publishedAt":193,"category":194,"categories":195,"featuredImage":26,"bgImage":27,"posterImage":197,"relatedSolution":26},112,"deploy-keycloak-for-sso-on-your-vps",{"fr":188,"en":186,"ar":189},"keycloak-sso-vps","نشر-keycloak-لتسجيل-الدخول-الموحد-sso-على-خادمك-vps","Deploy Keycloak for SSO on Your VPS","Deploy Keycloak on your VPS for enterprise-grade SSO: OIDC, SAML, realms and federation. A complete Docker guide and comparison.",4,"2026-02-28T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[196],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fkeycloak-sso-vps-poster.svg",1787580992139]