Authelia

Authelia is an open-source authentication and authorization server that works as a companion to common reverse proxies. The proxy asks Authelia whether each request is allowed; Authelia shows its login portal when needed, enforces second factors and applies access policies by user, group, resource or domain. It is also an OpenID Certified OpenID Connect 1.0 provider, so apps with native OIDC support can log in through it directly.

It supports passkeys for passwordless login and second factors including one-time passwords, mobile push notifications and WebAuthn security keys. Users who have not set up a second factor must validate by email, passwords can be reset from the portal against LDAP or its internal user store, and brute-force regulation locks accounts after too many failed attempts.

The project is written in Go and React, ships as a container under 20 MB and usually uses under 30 MB of memory, and can run as multiple replicas on Kubernetes. It is free under the Apache 2.0 licence with community support. It is a tool for protecting self-hosted apps and internal services rather than a user sign-up system for a public product.