A to Z: How to Install Authentik on AWS Quickly

Kelum Sampath

Aug 5, 2024 • 12 min read

What is SSO?

Single Sign-On (SSO) is a user authentication process that allows a user to access multiple applications with one set of login credentials. This eliminates the need for users to remember multiple usernames and passwords, streamlining the login process and enhancing security. SSO improves user experience and reduces the risk of password-related security breaches.

Why Open Source?

Open-source software offers numerous advantages, including:

Transparency: Users can inspect, modify, and enhance the code to suit their needs.
Cost-Effectiveness: Open-source solutions often have lower costs compared to proprietary software.
Community Support: A strong community of developers contributes to continuous improvements and provides support.
Flexibility: Open-source software can be customized to meet specific requirements, ensuring it fits seamlessly into various environments.

What is Authentik?

Authentik is an open-source identity provider that offers a flexible and versatile solution for managing user authentication and authorization. It supports various authentication protocols, including OAuth2, SAML, and OpenID Connect, making it suitable for a wide range of applications.

Benefits of Authentik

Flexibility: Authentik can be customized to meet the specific needs of different applications and organizations.
Versatility: It supports multiple authentication protocols and integrates with various identity providers.
Security: Authentik provides robust security features, including multi-factor authentication (MFA) and fine-grained access control.
Cost-Effective: Being open-source, it reduces licensing costs and allows for extensive customization without additional expenses.

Importance of Deploying Authentik on AWS

Deploying Authentik on AWS brings several benefits:

Scalability: AWS provides the infrastructure to scale Authentik according to the needs of your organization, ensuring high availability and performance.
Reliability: AWS's robust and secure infrastructure guarantees that Authentik will run smoothly, with minimal downtime.
Flexibility: AWS offers a range of services that can be integrated with Authentik, enhancing its capabilities and making it easier to manage.

Comprehensive Developer Guide by Meetrix

For detailed instructions and step-by-step guidance on setting up Authentik from the AWS Marketplace, refer to the comprehensive developer guide provided by Meetrix. This guide will help you navigate the installation process, configure Authentik according to your needs, and optimize its performance on AWS.

By following this guide, you will be able to leverage Authentik's capabilities to create a secure and robust authentication system for your applications, ensuring a seamless user experience and enhanced security.

Full Developer Guide with Images

Why Meetrix’s AWS Preconfigured AMI?

Simplified Deployment

Meetrix's AWS Preconfigured AMI for Authentik offers a streamlined and hassle-free deployment process. With the preconfigured AMI, you can quickly set up Authentik on AWS without the need for extensive manual configurations. This saves time and reduces the complexity associated with deploying an identity provider from scratch.

Optimized Configuration

The preconfigured AMI is optimized for performance and security. Meetrix has fine-tuned the configurations to ensure that Authentik runs efficiently on AWS, providing you with a reliable and robust identity management solution. This includes optimized instance settings, security configurations, and integration with AWS services.

Comprehensive Setup

Meetrix's preconfigured AMI comes with a comprehensive setup that includes all necessary components and dependencies required to run Authentik. This eliminates the need to manually install and configure additional software, allowing you to focus on integrating Authentik with your applications and managing your users.

Scalability and Flexibility

By using Meetrix’s preconfigured AMI, you leverage the scalability and flexibility of AWS. The AMI is designed to work seamlessly with AWS’s scalable infrastructure, enabling you to scale your Authentik deployment according to your needs. Whether you're running a small application or a large enterprise system, Meetrix's AMI ensures that Authentik can handle the load.

Expert Support and Documentation

Meetrix provides expert support and detailed documentation to assist you in the deployment and management of Authentik on AWS. The developer guide offers step-by-step instructions, best practices, and troubleshooting tips to ensure a smooth installation process. Additionally, you can reach out to Meetrix support for any specific issues or advanced configurations.

Cost-Effective Solution

Using Meetrix’s preconfigured AMI can be more cost-effective compared to manually configuring and maintaining an identity provider. The optimized configurations and expert support help reduce operational costs and minimize downtime, providing a high return on investment.

Key Benefits Summary

Simplified Deployment: Quick and easy setup with minimal manual intervention.
Optimized Configuration: Performance-tuned settings for efficient operation.
Comprehensive Setup: All necessary components included, eliminating additional setup steps.
Scalability: Seamless integration with AWS’s scalable infrastructure.
Expert Support: Access to detailed documentation and professional support.
Cost-Effective: Reduced operational costs and high return on investment.

By choosing Meetrix’s AWS Preconfigured AMI for Authentik, you ensure a smooth, efficient, and reliable deployment, allowing you to focus on building and managing your applications with confidence.

Video: Complete Authentik Installation Guide

How to Authentik install without Docker Set up

Prerequisites

Before getting started with the Authentik AMI, ensure you have the following prerequisites:

Active AWS Account with Necessary Permissions

Ensure you have an active AWS account with permissions to create and manage EC2 instances, CloudFormation stacks, and Route 53 hosted zones.

2. Basic Knowledge of AWS Services

Familiarity with AWS services such as EC2, CloudFormation, and Route 53 is essential for following this guide.

3. Ensure Sufficient vCPU Limit for Instance Creation

Verify that your AWS account has a sufficient vCPU limit to create the necessary instances. If needed, refer to the Meetrix blog on increasing AWS quota for detailed instructions on how to request a quota increase.

4. Domain Name Hosted on Route 53 (Optional but Recommended for SSL Setup)

For a smoother SSL setup, it is recommended to have a domain name hosted on AWS Route 53. This allows Authentik to automatically configure SSL certificates based on your domain. If your domain is not hosted on Route 53, you will need to set up SSL manually.

Launching the AMI

Step 1: Find and Select 'Authentik' AMI

1. Log in to AWS Management Console:

Navigate to the AWS Management Console and log in with your credentials.

2. Navigate to AWS Marketplace:

Search for “ Authentik “in the AWS Marketplace.

Select the Authentik AMI from the search results.

Step 2: Initial Setup and Configuration

Subscribe to Authentik AMI:

Click the "Continue to Subscribe" button.

Accept the terms and conditions by clicking "Accept Terms."

Wait for the processing to complete, then click "Continue to Configuration."

2. Configure the Software:

Select "CloudFormation script to deploy Authentik" as the fulfillment option.

Choose your preferred region on the "Configure this software" page.

Click "Continue to Launch."

3. Launch CloudFormation Template:

From the "Choose Action" dropdown menu on the "Launch this software" page, select "Launch CloudFormation" and click the "Launch" button.

Create CloudFormation Stack

Step 1: Create Stack

Prepare Template:

Ensure the "Template is ready" radio button is selected.

Click "Next."

Step 2: Specify Stack Options

Stack Name: Provide a unique name for the stack.
Admin Email: Enter the admin email for SSL generation.
Deployment Name: Choose a name for the deployment.
Domain Name: Provide a public domain name (hosted on Route 53) for SSL setup.
Instance Type: Choose an instance type (recommended: t3.small).
Key Name: Select your preferred key pair for SSH access.
S3 Bucket Name: Provide a name for the S3 bucket to store database backups.
SSH Location: Set the SSH location (e.g., 0.0.0.0/0 for all IP addresses).
Subnet CIDR Block: Keep as 10.0.0.0/24.
VPC CIDR Block:

Keep as 10.0.0.0/16.

Click "Next."

Step 3: Configure Stack Options

Stack Failure Options:

Choose "Roll back all stack resources" and "Delete all newly created resources."

Click "Next."

Step 4: Review and Submit

Review Details:

Verify the details you've entered.

2. Acknowledge IAM Resources:

Tick the box that says, "I acknowledge that AWS CloudFormation might create IAM resources with custom names."

3. Submit:

Click "Submit."

Wait for 5-10 minutes until the stack is successfully created.

Update DNS

Step 1: Copy IP Address

Get Public IP:

Copy the public IP labeled "PublicIp" in the "Outputs" tab of the CloudFormation stack.

Step 2: Update DNS

1. Navigate to Route 53:

Go to AWS Route 53 and navigate to "Hosted Zones."

2. Create Record:

Click on "Create record."

Add the record name and paste the copied "PublicIp" into the "value" textbox.

Click "Save."

Access Authentik

Setup Authentik:

Use the "DashboardUrl" or "DashboardUrlIp" provided in the "Outputs" tab to access Authentik.

2. Create Admin Account:

Follow the setup instructions to create an admin account.

Choose a strong password.

Generate SSL Manually

If Authentik is unable to automatically set up SSL:

Step 1: Copy IP Address

Update DNS:

Follow the instructions in the "Update DNS" section to copy the public IP.

Step 2: Log in to the Server

SSH into Server:

Open the terminal and navigate to the directory where your private key is located.

Execute the SSH command:

ssh -i <your key name> ubuntu@<Public IP address>

Type "yes" to log in to the server.

Step 3: Generate SSL

Run SSL Script:

Execute the following command:

sudo /root/certificate_generate_standalone.sh

Follow the instructions to generate SSL certificates.

Shutting Down Authentik

1. Access EC2 Instance:

Click the "Instance" link in the "Resources" tab to navigate to the Authentik instance in the EC2 dashboard.

2. Stop Instance:

Select the Authentik instance and click "Stop instance" from the "Instance state" dropdown menu.

Remove Authentik

Delete CloudFormation Stack:

Navigate to the CloudFormation Stacks section in the AWS Management Console.Select the Authentik stack and click "Delete" to remove all resources.

Authentik API

Starting with version 2021.3.5, every Authentik instance includes a built-in API browser, accessible at Authentik API Documentation. This API allows developers to interact with Authentik programmatically, supporting functionalities like user management, authentication, and system tasks.

Accessing the API

API Browser: Explore available endpoints at Authentik API v3.
OpenAPI Schema: Use the OpenAPI v3 schema at OpenAPI Schema to generate API clients.

API Authentication

Authentik supports several methods for API authentication:

Session-Based Authentication: Your browser session authenticates API requests during testing.
Token-Based Authentication:

API Token: Create tokens for authentication. Set the Authorization header to Bearer <token>.
JWT Token: OAuth2 clients can request the scope goauthentik.io/api to use their OAuth Access token for API authentication.

Common API Endpoints

Users: Manage users with endpoints for listing, creating, updating, and deleting users.
Applications: Handle applications with endpoints for CRUD operations and metrics.
Authenticators: Manage various authentication methods like Duo, SMS, TOTP, and WebAuthn.

Example: Fetching User Information with curl

curl -X GET "https://authentik.company/api/v3/core/users/" \
-H "Authorization: Bearer <your_api_token>"

For more detailed API documentation and examples, visit the Authentik API Documentation.

Authentik's API provides a comprehensive set of endpoints to manage and interact with your identity provider programmatically. Whether managing users, configuring authentication flows, or integrating with other systems, Authentik's API offers the flexibility and power needed to automate and streamline these processes. For further details, refer to the official API documentation.

Best Open-Source SSO Identity Providers

When it comes to open-source Single Sign-On (SSO) identity providers, several options stand out for their features, community support, and reliability. Here are some of the best open-source SSO identity providers:

1. Keycloak

Keycloak is a comprehensive open-source identity and access management solution. It offers SSO, social login, identity brokering, and user federation.

Features:

SAML, OpenID Connect, and OAuth2 support
Multi-factor authentication (MFA)
Centralized management of users, roles, and groups
Customizable login themes
LDAP and Active Directory integration

Best For: Enterprises and developers looking for a robust, flexible, and enterprise-ready solution.

2. Authentik

Description: Authentik is an open-source identity provider that focuses on simplicity, flexibility, and security. It is designed to handle both authentication and authorization, offering various features to manage and secure user identities.

Features:

SSO: Supports single sign-on with SAML, OAuth2, and OpenID Connect.
Multi-Factor Authentication (MFA): Provides MFA support to enhance security.
User Management: Offers user self-service capabilities, including registration, password recovery, and profile management.
Integrations: Seamlessly integrates with various applications and services.
Authorization: Supports role-based access control and policies for fine-grained authorization.
Customizable UI: Allows for customization of login pages and other user interfaces.
Extensible: Features an API-first approach, making it highly extensible and developer-friendly.

Key Advantages of Authentik

Simplicity: Authentik is designed to be easy to deploy and manage, making it suitable for both small and large-scale applications.
Flexibility: It provides extensive customization options for both UI and backend integrations.
Security: Built with security in mind, Authentik supports MFA and fine-grained access control policies.
Extensibility: Its API-first approach allows for seamless integration and extension, making it developer-friendly.

3. Auth0 (Open Source Community Edition)

Auth0 provides an open-source version for community use, offering a wide range of authentication and authorization features.

Features:

SSO with SAML, OAuth2, and OpenID Connect
MFA
User management with custom attributes
Role-based access control
Extensive documentation and community support

Best For: Developers and small to medium-sized businesses needing a powerful yet easy-to-implement identity solution.

4. Gluu

The Gluu Server is an open-source identity and access management (IAM) suite designed for high-performance SSO and strong authentication.

Features:

SSO using SAML, OAuth2, and OpenID Connect
Strong authentication with MFA support
Flexible user authentication and attribute management
Scalable and high-performance architecture

Best For: Large enterprises requiring a robust and scalable IAM solution.

5. FusionAuth

FusionAuth is a modern identity management solution that provides a flexible, developer-friendly approach to SSO and user authentication.

Features:

SSO and user management
OAuth2 and OpenID Connect support
Role-based access control
Customizable user interface and workflows
Comprehensive APIs for integration

Best For: Developers seeking an easy-to-integrate identity provider with extensive customization options.

6. Apache Syncope

Apache Syncope is an open-source system for managing digital identities in enterprise environments. It supports SSO, user provisioning, and more.

Features:

User provisioning and management
SSO support with SAML and OAuth2
Role-based access control
RESTful APIs for integration

Best For: Enterprises needing a comprehensive identity management and user provisioning system.

Comparison with Other Open-Source Providers

Feature/Provider	Keycloak	Auth0 (Community)	Gluu	FusionAuth	Apache Syncope	Authentik
SSO Support	Yes	Yes	Yes	Yes	Yes	Yes
Multi-Factor Authentication	Yes	Yes	Yes	Yes	No	Yes
Protocols Supported	SAML, OpenID Connect, OAuth2	SAML, OAuth2, OpenID Connect	SAML, OAuth2, OpenID Connect	OAuth2, OpenID Connect	SAML, OAuth2	SAML, OAuth2, OpenID Connect
User Federation	Yes	Yes	Yes	No	Yes	Yes
Role-Based Access Control	Yes	Yes	Yes	Yes	Yes	Yes
Customizable UI	Yes	Yes	No	Yes	No	Yes
Scalability	High	High	High	Medium	High	High
Best For	Enterprises and developers	Developers and small businesses	Large enterprises	Developers and medium businesses	Enterprises	Developers and enterprises

Use Cases

Small to Medium Enterprises: Authentik’s simplicity and flexibility make it ideal for small to medium-sized enterprises needing a robust identity management solution.
Developers: Developers looking for an easy-to-implement identity provider with extensive customization options will find Authentik a strong choice.
Enterprises: Enterprises requiring a secure and scalable SSO solution with support for multiple authentication protocols and fine-grained access control.

Authentik stands out as a modern, open-source identity provider offering a balance of simplicity, flexibility, and security, making it a compelling option for various use cases.

Advanced Configuration Options

Customizing Authentik Settings

Exploring how to customize Authentik settings can significantly enhance the user experience and align the identity provider with your organizational requirements. Here are some key customization options:

Themes:

Login Page Customization: Modify the login page to reflect your brand identity by changing logos, colors, and background images.

Custom CSS: Apply custom CSS to further personalize the appearance of the Authentik user interface.

2. Login Policies:

Password Policies: Define password strength requirements, including length, complexity, and expiration.

Account Lockout: Configure settings to lock accounts after a certain number of failed login attempts, enhancing security.

3. User Roles:

Role Management: Create and assign roles to users to control access to various applications and resources.

Permission Configuration: Set granular permissions for different roles to ensure users have appropriate access levels.

Integrating External Identity Providers

Integrating Authentik with external identity providers enables seamless SSO across multiple platforms. Here are instructions for common integrations:

Google:

OAuth2 Configuration: Set up OAuth2 integration with Google by creating a project in the Google Developer Console and obtaining client credentials.

Authentik Settings: In the Authentik admin panel, add Google as an OAuth2 provider, entering the client ID and secret.

2. GitHub:

OAuth2 Setup: Register your application on GitHub to get client credentials.

Provider Configuration: Add GitHub as an OAuth2 provider in Authentik, specifying the client ID and secret.

3. LDAP:

LDAP Integration: Connect Authentik to your LDAP server by configuring LDAP settings, including server address, bind DN, and search filters.

User Synchronization: Set up synchronization to import users and groups from LDAP into Authentik.

Setting Up Multi-Factor Authentication (MFA)

Enabling MFA adds an extra layer of security to your Authentik deployment. Here are the steps to configure MFA:

Enable MFA:

MFA Methods: Authentik supports various MFA methods such as TOTP (Time-based One-Time Password), SMS, and WebAuthn.

TOTP Configuration: In the Authentik admin panel, enable TOTP and provide users with QR codes to scan with their authenticator apps.

2. User Setup:

User Enrollment: Guide users through the process of enrolling their MFA devices. For TOTP, users can use apps like Google Authenticator or Authy.

Backup Codes: Generate and provide backup codes for users to use in case they lose access to their primary MFA device.

3. Enforcing MFA:

Policy Enforcement: Create policies to enforce MFA for all users or specific groups, ensuring that high-security areas are protected.

Login Flow: Integrate MFA into the login flow, requiring users to enter their second factor after providing their password.

By leveraging these advanced configuration options, you can tailor Authentik to meet your organization's specific needs, providing a secure and seamless authentication experience for your users.

Conclusion

Deploying Authentik on AWS using Meetrix's preconfigured AMI offers a streamlined, efficient, and scalable solution for your identity management needs. Authentik stands out as a flexible and versatile open-source identity provider, supporting various authentication protocols and advanced security features like multi-factor authentication.

By following the step-by-step guide provided, you can quickly set up and configure Authentik on AWS, ensuring a secure and robust authentication system for your applications. Leveraging AWS's reliable infrastructure ensures high availability and scalability, making it an ideal choice for both small and large enterprises.

Additionally, Authentik's comprehensive API provides powerful tools for managing users, configuring authentication flows, and integrating with other systems programmatically. This flexibility allows you to customize and extend your identity management solution to meet specific business requirements.

For more detailed instructions and advanced configurations, refer to the comprehensive Meetrix Authentik Developer Guide and the Authentik API Documentation.

With Authentik, you can confidently manage your user authentication and authorization needs, enhancing security and improving user experience across your applications.