What is authelia-admin?

This control panel lets administrators manage an Authelia authentication server backed by LLDAP. It handles user and group administration, TOTP device configuration and history, and banned IP addresses. Role-based access control provides dedicated user_manager and password_manager roles with a protected-user mechanism to prevent privilege escalation. The service runs on port 9093 as a Node.js/SvelteKit application, configurable via YAML or AAD_-prefixed environment variables. It reads Authelia's storage (SQLite or PostgreSQL) and communicates with LLDAP over GraphQL and LDAP. Deployment uses Docker or Docker Compose alongside Authelia, LLDAP, and a reverse proxy such as Traefik. The codebase is MIT-licensed and has reached version 1.1.2 with PostgreSQL support and end-to-end tests.

Should you self-host authelia-admin?

authelia-admin scores 44/100 on selfhost.directory (how scoring works) and ranks #28 of 40 in Authentication. It has 204 GitHub stars.

It shipped 5 stable releases in the past year. The latest, v1.1.2, came out on 16 September 2026. New versions land roughly every 2 months.

Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is MIT-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is keycloak (86/100, 37 577 stars). It scores higher overall, so compare the two before you pick. See authelia-admin vs keycloak side by side.

Features

Banned IP Management
Group Management
Internationalization
Role-based Access Control
TOTP history
TOTP Management
User Management

How to configure authelia-admin

AAD_AUTHELIA_ALLOWED_USERS(empty = all users)Comma-separated list of allowed users
Comma-separated list of allowed users
AAD_AUTHELIA_CONFIG_PATH/config/configuration.ymlPath to Authelia's `configuration.yml` (optional when `AAD_DB_*` define the database)
Path to Authelia's `configuration.yml` (optional when `AAD_DB_*` define the database)
AAD_AUTHELIA_COOKIE_NAMEauthelia_sessionSession cookie name
Session cookie name
AAD_AUTHELIA_DOMAINauth.localhost.testAuthelia domain for authentication
Authelia domain for authentication
AAD_AUTHELIA_MIN_AUTH_LEVEL2Minimum auth level (1=password, 2=2FA)
Minimum auth level (1=password, 2=2FA)
AAD_CONFIG_PATH/opt/authelia-admin/config.ymlPath to config.yml
Path to config.yml
AAD_DB_PG_DATABASEautheliaDatabase name
Database name
AAD_DB_PG_HOSTlocalhostPostgreSQL host
PostgreSQL host
AAD_DB_PG_PASSWORD(empty)Password
Password
AAD_DB_PG_PASSWORD_FILEFile with the password, e.g. a Docker or Kubernetes secret. Must not be combined with `AAD_DB_PG_PASSWORD`
File with the password, e.g. a Docker or Kubernetes secret. Must not be combined with `AAD_DB_PG_PASSWORD`
AAD_DB_PG_POOL_MAX10Maximum connection pool size
Maximum connection pool size
AAD_DB_PG_PORT5432PostgreSQL port
PostgreSQL port
AAD_DB_PG_SCHEMApublicSchema
Schema
AAD_DB_PG_TIMEOUT_MS5000Connection timeout, milliseconds (`0` = no timeout)
Connection timeout, milliseconds (`0` = no timeout)
AAD_DB_PG_TLS_CA_FILEsystem trust storePEM file with trusted CA certificates
PEM file with trusted CA certificates
AAD_DB_PG_TLS_CERT_FILEPEM client certificate for mutual TLS
PEM client certificate for mutual TLS
AAD_DB_PG_TLS_KEY_FILEPEM client private key for mutual TLS
PEM client private key for mutual TLS
AAD_DB_PG_TLS_MAX_VERSIONTLS1.3`TLS1.2` or `TLS1.3`
`TLS1.2` or `TLS1.3`
AAD_DB_PG_TLS_MIN_VERSIONTLS1.2`TLS1.2` or `TLS1.3`
`TLS1.2` or `TLS1.3`
AAD_DB_PG_TLS_MODEdisable; verify-full when the file has a tls block`disable`, `require`, `verify-ca` or `verify-full`
`disable`, `require`, `verify-ca` or `verify-full`
AAD_DB_PG_TLS_SERVER_NAMEhostName verified in the server certificate instead of the host
Name verified in the server certificate instead of the host
AAD_DB_PG_USERNAMEautheliaUser name
User name
AAD_DB_SQLITE_BUSY_TIMEOUT_MS5000Wait time for SQLite locks, milliseconds
Wait time for SQLite locks, milliseconds
AAD_DB_SQLITE_PATH(required for SQLITE)Path to Authelia's SQLite database
Path to Authelia's SQLite database
AAD_DB_TYPEfrom Authelia file`PG` or `SQLITE`, case-insensitive
`PG` or `SQLITE`, case-insensitive
AAD_DIRECTORY_LLDAP_GRAPHQL_ENDPOINThttp://lldap:17170/api/graphqlLLDAP GraphQL API endpoint
LLDAP GraphQL API endpoint
AAD_DIRECTORY_LLDAP_GRAPHQL_LDAP_BASE_DN(required for password changes)LDAP base DN for user operations
LDAP base DN for user operations
AAD_DIRECTORY_LLDAP_GRAPHQL_LDAP_HOSTlldapLDAP host for password changes
LDAP host for password changes
AAD_DIRECTORY_LLDAP_GRAPHQL_LDAP_PORT3890LDAP port for password changes
LDAP port for password changes
AAD_DIRECTORY_LLDAP_GRAPHQL_PASSWORD(required)LLDAP admin password
LLDAP admin password
AAD_DIRECTORY_LLDAP_GRAPHQL_USERadminLLDAP admin username
LLDAP admin username
AAD_DIRECTORY_TYPElldap-graphqlDirectory service type
Directory service type
AAD_LOGLEVELWARNLogging level
Logging level
HOST0.0.0.0Server host
Server host
NODE_TLS_REJECT_UNAUTHORIZED(not set)Set to `0` for self-signed certificates
Set to `0` for self-signed certificates
PORT9093Server port
Server port
TRUSTED_ORIGINS(required for production)CSRF trusted origins
CSRF trusted origins