#Authentik as SAML proxy

1 messages · Page 1 of 1 (latest)

rough jasper
#

Hello, we are trying to understand if Authentik is right tool for our purpose and looking out maybe someone can share some starting point blogs, hands on guides... so we are looking for tool to do:

  1. it will act like a APP portal, you login with Azure SAML to it and then you get portal where you can choose different apps from dashboard and login to them
  2. some of those apps in the portal may have their own Azure SAML authentication. Here Authentik will need to pass SAML login details to the target app/service
  3. some of those apps could be not direclty accessible from user network, for those authentik server will need to do proxying. Like user talks to authentik and authentik talks to target service/app.
  4. it should not require creating local users in authentik, like we setup Azure SAML login to authentik, define roles/permissions based on groups if needed and it should be it without requiring creating local users in authentik then mapping them and so on, also when client connects to any app throught auhentik portal , authentik should relay all SAML metadata to the target app so our group based permissions works fine...

so it looks like Authentik is tool which can do above and many more, can anyone please verify it? if it is yes then we find it quite complex process to understand and setup, maybe there is any top to bottom guide, tutorial or something? Thank you for your attention

wise bane
#

because otherwise I think Entra could handle all of that anyway

rough jasper
#

so you really just want Authentik for the dashboard?
yes, we want a open source, well maintained tool and Authentik seems perfect fit. The only thing I started to doubt is 2nd requirement from above description. Looks like Authentik can't do it? like it will require we configure all our services to use Authentik as SAML provider but not Azure?

Generally yes, we are looking for something just like "Azure App proxy" where we would have SAML protected dashboard, which will do proxying for us and do SAML passthrough.

rough jasper
#

Thanks, just to be clear, it will still require us to use "Authentik" as SAML IDP in taget applications? or target apps can have Azure Entra ID as their SAML auth

wise bane