Auth
We use Authentik as our identity provider, running on Infrahorst. It handles SSO for most of our internal services.
Providers
Proxy providers use Authentik as a forward auth layer in front of apps that don't natively support SSO. The LDAP provider exposes Authentik as an LDAP directory.
| Provider | Type |
|---|---|
infrahorst-oidc |
Proxy |
k8s-oidc |
Proxy |
ldap |
LDAP |
Groups
Groups control access to individual services. A user must be a member of the relevant group to gain access.
| Group | Grants access to |
|---|---|
authentik Admins |
Full Authentik admin access (superusers) |
authentik Agent-Users |
Service account / agent access to Authentik |
authentik Read-only |
Read-only access to Authentik |
Ehrencluster Admins |
Admin access to the Kubernetes cluster |
Firewall Admins |
Admin access to the Firewall |
Grafana Admins |
Admin access to Grafana |
Grafana Users |
Regular user access to Grafana |
Infra Admins |
General infrastructure admin access |
Inventree Admins |
Admin access to Inventree |
OpenBao Admins |
Admin access to OpenBao |
PVE Admins |
Admin access to Proxmox on our hypervisors |
RustFS Users |
Access to RustFS |