authentik

Domain-level forward auth works with the embedded outpost but external proxy outposts return 400 with a session mismatch, while app-level forward auth works.

Affects: Multi-server docker-compose and Traefik user

After updating, logging in with a YubiKey repeatedly reopens the Windows Hello prompt. Rolling back to the previous version fixes it, and a second site on the same version still works.

Affects: User signing in with a hardware security key

After moving from 2025.12.1 to 2025.12.2 the outpost reports unhealthy and applications behind Nginx Proxy Manager fail with 500. Downgrading to the earlier version fixes it.

Affects: Docker user with Nginx Proxy Manager

After updating with the official compose file, the interface warns that no workers are connected and background tasks will not run, though worker logs keep flowing. Rolling back to 2025.10.0 fixes it.

Affects: Docker compose user

The invitation guide provides a ready-made enrollment flow lacking an invitation stage, so no invite link is available until the user adds the stage manually.

Affects: Admin enrolling users by invitation

The forward-auth docs list Nginx, Caddy, Envoy and Traefik but not HAProxy. A prospective user cannot adopt authentik without a HAProxy guide and points to a competitor that has one.

Affects: HAProxy user evaluating authentik

The offline_access scope always shows a consent prompt, awkward when the app creates users through the API. No API endpoint was found to set consent programmatically.

Affects: Developers creating users via the API

User wants to back up all authentik config and restore it to a new instance. Blueprint export is confusing and the UI only exports flows, not stages or other objects.

Affects: Self-hosting admin

A team organizes its directory as a DAG of groups; authentik only allows one parent per group. They currently manage the DAG externally and want to leave that setup, since binding central groups directly loses nested-group benefits.

Affects: Teams moving from AWS SSO with shared central groups

Apps protected by authentik can no longer be embedded in a page such as Nextcloud external sites, even with a frame-ancestors header set. The user must open them in a new tab.

Affects: Nextcloud users embedding protected services

A homelab user found that adding a single application required configuring several linked pieces (flows, stages, providers, outposts) and clicked through defaults. They switched back to Zitadel for simpler app creation.

Affects: Solo self-hoster running one login for several services