authentik vs Locke Gateway

authentik is an open-source, self-hostable identity and access management product for workforce single sign-on, customer identity, zero-trust security, legacy application integration and API security. It supports OAuth2/OpenID Connect, SAML2, LDAP, RADIUS, SCIM and Kerberos, as well as WS-Federation. MFA options include TOTP, WebAuthn/passkeys, email, SMS, Duo and static tokens. Access policies can consider factors such as user attributes, time and location. Security features include audit logging, session binding, GeoIP and impossible-travel detection, and client certificate authentication with mTLS. It can run on customer infrastructure, including Docker and Kubernetes; the pricing FAQ says there is no hosted version currently. The authentik Agent integrates with Windows, macOS and Linux for local device login and CLI authentication. A free open-source plan includes community Discord support but no product support. Enterprise costs $5 a month, billed annually, at $5 per user per month; external users are $0.02 per month and service accounts have no cost.

Locke Gateway has no write-up on Specifiction yet; its figures are above.