# Self-Hosting Authentik as an Identity Provider

> Octelium documentation. Canonical page: <https://octelium.com/docs/octelium/latest/management/guide/service/homelab/authentik-helm-self-host>.

This is a quick guide on how to deploy [Authentik](https://goauthentik.io/), an open source, self-hosted identity provider (IdP) on the same underlying Kubernetes cluster that is running the Octelium *Cluster* and use it as an OpenID Connect *IdentityProvider* (read more about *IdentityProviders* [here](https://octelium.com/docs/octelium/latest/management/core/identity-providers.md)) to be able to login to the *Cluster*.

In this guide we use [Helm](https://helm.sh/) to install Authentik. First, we need to create a `values.yaml` YAML file for the Authentik Helm chart (see the chart [here](https://github.com/goauthentik/helm/tree/main/charts/authentik)) as follows:

```yaml
authentik:
  secret_key: <SECRET_KEY>
  postgresql:
    password: <POSTGRES_PASSWORD>

global:
  env:
    - name: AUTHENTIK_BOOTSTRAP_PASSWORD
      value: <BOOTSTRAP_LOGIN_PASSWORD>
server:
  ingress:
    enabled: false
postgresql:
  enabled: true
  auth:
    password: <POSTGRES_PASSWORD>
redis:
  enabled: true
```

> **Note:**
>
> If you have Python installed, you can use it to create values for the passwords used above as follows:
>
> ```bash
> python -c "import random, string; print(''.join(random.choices(string.ascii_letters + string.digits, k=16)))"
> ```

Now deploy Authentik on the Kubernetes cluster using our `values.yaml` file as follows:

```bash
helm repo add authentik https://charts.goauthentik.io
helm repo update
helm upgrade --install authentik authentik/authentik --namespace authentik --create-namespace -f </PATH/TO/VALUES.YAML>
```

> **Note:**
>
> If you installed the *Cluster* via the quick installation guide, you can simply use the command `export KUBECONFIG="/etc/rancher/k3s/k3s.yaml"` in your *Cluster* VM/VPS before running the helm commands above.

Now create an Octelium *Service* for the Authentik web server as follows:

```yaml
kind: Service
metadata:
  name: idp
spec:
  mode: HTTP
  config:
    upstream:
      url: http://authentik-server.authentik.svc
    http:
      header:
        forwardedMode: TRANSPARENT
        host:
          preserve: true
  isPublic: true
  isAnonymous: true
```

Now you can apply the creation of the *Service* via the `octeliumctl apply` command (read more [here](https://octelium.com/docs/octelium/latest/management/core/overview.md)) as follows:

```bash
octeliumctl apply /PATH/TO/SERVICE.YAML
```

> **Note:**
>
> Notice that we created the *Service* as `isAnonymous` since we need to access it anonymously in order to login to the *Cluster*. You can read more about anonymous *Services* [here](https://octelium.com/docs/octelium/latest/management/core/service/anonymous-access.md).

Now we visit the *Service* via the web browser at the URL `https://idp.<DOMAIN>` and use the user `akadmin` and the password `<BOOTSTRAP_LOGIN_PASSWORD>` set in the Helm `values.yaml` set above to login.

Now that you are logged in and inside the Authentik dashboard, you can create an OpenID Connect client application and use it to create an *IdentityProvider* in Octelium as follows:

1. Go to **Applications** > **Applications** > **Create with Provider**.

2. Select **OAuth2/OpenID Provider** and press **Next**.

3. Set the application details as follows:
   1. Set a **Provider Name** (e.g. `octelium`)
   2. Set **Authorization Flow** to **default-provider-authorization-explicit-consent (Authorize Application)**
   3. Copy the application's client ID and client secret in order to be used in our *IdentityProvider* as shown below.
   4. Set **Redirect URIs/Origins** to **Strict** with the URL `https://<DOMAIN>/callback`

4. Now go back to the list in **Applications** > **Applications** and visit the page of the Application you just created.

5. Click on **Provider for `<YOUR_APP>` (OAuth2/OpenID Provider)**.

6. Copy the value **OpenID Configuration Issuer** as we are going to use it later to define our *IdentityProvider* in the `issuerURL` field as shown below.

Now create a *Secret* for the application's client secret as follows:

```bash
octeliumctl create secret authentik
```

Now create an OpenID Connect *IdentityProvider* using the application's client id, the client secret's *Secret* and the issuer URL as follows:

```yaml
kind: IdentityProvider
metadata:
  name: authentik
spec:
  displayName: Login with Authentik
  oidc:
    clientID: <CLIENT_ID>
    clientSecret:
      fromSecret: authentik
    issuerURL: <YOUR_OPENID_ISSUER_URL>
```

Now you can apply the creation of the *IdentityProvider* via the `octeliumctl apply` command as follows:

```bash
octeliumctl apply /PATH/TO/IDENTITY_PROVIDER.YAML
```