Skip to content

ADR: Centralized Identity Provider for nonlocally.org

Status: Accepted Date: 2026-04-05 Deciders: Platform team Issue: #35

Context

The nonlocally.org platform runs multiple services (mit.nonlocally.org, llm.nonlocally.org, console.nonlocally.org) each with their own authentication. Users must log in separately to each service, and there is no unified identity across the platform. We need a centralized Identity Provider (IdP) that supports OIDC/OAuth2 SSO across all services.

Decision Drivers

  • Must run in Kubernetes (GKE) alongside existing workloads
  • OIDC support for OpenWebUI, Marimo, and future services
  • Lightweight enough for a small team to operate
  • Good admin UI for user management
  • Open-source with active community

Options Considered

1. Authentik

  • Python/Django-based, designed for self-hosting
  • Native Kubernetes deployment via Helm chart
  • Built-in OIDC/OAuth2/SAML provider
  • Clean admin and user-facing UI
  • Supports LDAP, social login, MFA
  • Lightweight: runs well on 512MB-1GB RAM
  • Active development and community

2. Keycloak

  • Java-based (Quarkus), mature and feature-rich
  • Industry standard for enterprise SSO
  • Extensive protocol support (OIDC, SAML, LDAP)
  • Heavy resource footprint: 1-2GB RAM minimum
  • Complex configuration, steep learning curve
  • Red Hat backed, very large community

3. Zitadel

  • Go-based, cloud-native design
  • Built-in multi-tenancy and project management
  • gRPC and REST APIs
  • Newer project, smaller community
  • Good Kubernetes support
  • Moderate resource requirements

Decision

Authentik is selected as the centralized IdP for nonlocally.org.

Rationale

  • Lightweight and K8s-native: Authentik runs comfortably in our existing GKE cluster without requiring significant additional resources, unlike keycloak which demands substantially more memory.
  • OIDC support: Native OIDC provider that integrates directly with OpenWebUI's existing OAuth configuration and can federate identity to all other services.
  • Good UI: Both the admin interface and user-facing login flows are clean and modern, reducing operational burden.
  • Python ecosystem: Aligns with our existing Python tooling and makes customization accessible to the team.
  • Active community: Regular releases, good documentation, responsive maintainers.

While zitadel is promising and keycloak is the enterprise standard, Authentik offers the best balance of capability and operational simplicity for our scale.

Consequences

Must do

  • Deploy Authentik to the GKE cluster via Helm chart
  • Migrate OpenWebUI OAuth configuration from direct GitHub OAuth to Authentik as the IdP
  • Configure OIDC federation for all nonlocally.org services
  • Set up user provisioning and group management in Authentik
  • Configure MFA policies

Risks

  • Single point of failure for all authentication -- mitigate with HA deployment
  • Migration requires coordinated cutover of existing OAuth flows
  • Team needs to learn Authentik administration

Follow-up

  • Issue for Authentik Helm deployment
  • Issue for OpenWebUI OIDC migration
  • Issue for Marimo editor OIDC integration