authentik

Overview

authentik is an open-source identity provider and access platform. Its OAuth2/OpenID provider can authenticate Pomerium users through the standard OpenID Connect authorization code flow.

Using authentik as the identity provider gives protected applications one sign-in path. Each application does not need to implement the same external authentication flow. Pomerium can apply route policy from the authenticated identity and request context.

authentik sends authenticated identity data toward Pomerium. Pomerium uses that data with route policy. Pomerium then sends only approved application traffic toward the protected service.

How it works

Create an OAuth2/OpenID provider and application in authentik. Use the issuer mode that matches the deployment. Add the exact Pomerium redirect URI and map the email, profile, and group claims that policy needs.

Configure Pomerium with the exact issuer or provider URL, client ID, and client secret. Use the Pomerium callback URL as an exact redirect URI. Request only the scopes and claims that access policy needs.

Test discovery, signing-key rotation, the authorization code flow, logout, and required claim mappings before production use. Keep provider credentials outside source control.

Example

A team registers Pomerium as an OpenID Connect client in authentik. Users sign in through authentik. Pomerium validates the identity response and applies route policy before it sends an approved request to a private application.

Considerations

• Create an OpenID provider for Pomerium. An authentik OAuth source has the opposite direction and is not the same configuration.
• Current authentik releases can set email_verified to false unless the administrator has authoritative verification data.
• authentik remains responsible for authentication, user lifecycle, and the identity data that it issues.
• A standards-based OpenID Connect pattern is not evidence of a vendor-specific connector or partnership.