authentik vs Shibboleth
authentik
goauthentik.ioShibboleth
shibboleth.netSide by side
| Figure | authentik | Shibboleth |
|---|---|---|
| Price from | $5/mo | $279.50/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 4 | 10 |
| Spec score · Single Sign-On Software | 8.6 (#6) | 7.8 (#21) |
| Authentication | It supports multi-factor authentication with TOTP and WebAuthn/passkeys, including hardware or software authenticators. | The Identity Provider has built-in support for a range of authentication systems and customizable authentication and data manipulation features. |
| Support | The open-source plan lists community Discord and no support; paid support is offered as part of enterprise software subscriptions, with ticket support for Enterprise subscriptions over $1k. | General users can use Wiki documentation, community forums and mailing lists, while Consortium members receive developer Q&A and members-only Slack support. |
Plans
authentik
- FreeFree
- Enterprise$5 a month
- Open SourceFree
- Enterprise Plus$20,000 a year
Shibboleth
- Shibboleth softwareFree
- Academic/Non-Profit Small$3,354 a year
- Academic/Non-Profit Medium$6,707 a year
- Commercial Small$6,707 a year
- Academic/Non-Profit Large$10,061 a year
- Commercial Medium$13,415 a year
- NREN/Federation Small$15,244 a year
- Commercial Large$26,829 a year
- NREN/Federation Medium$30,488 a year
- NREN/Federation Large$60,976 a year
In their own words
authentik
authentik is an open-source, self-hostable identity and access management product for workforce single sign-on, customer identity, zero-trust security, legacy application integration and API security. It supports OAuth2/OpenID Connect, SAML2, LDAP, RADIUS, SCIM and Kerberos, as well as WS-Federation. MFA options include TOTP, WebAuthn/passkeys, email, SMS, Duo and static tokens. Access policies can consider factors such as user attributes, time and location. Security features include audit logging, session binding, GeoIP and impossible-travel detection, and client certificate authentication with mTLS. It can run on customer infrastructure, including Docker and Kubernetes; the pricing FAQ says there is no hosted version currently. The authentik Agent integrates with Windows, macOS and Linux for local device login and CLI authentication. A free open-source plan includes community Discord support but no product support. Enterprise costs $5 a month, billed annually, at $5 per user per month; external users are $0.02 per month and service accounts have no cost.
Shibboleth
Shibboleth is open-source identity management software for individual organizations and multi-site federations. Its Identity Provider offers single sign-on for complex identity needs, supports multiple authentication systems, and can handle millions of authentication requests per day. Authentication and data handling features are customizable. The Service Provider works with a wide range of web applications, integrates with popular web servers, and provides policy-oriented authorization features. An Embedded Discovery Service helps users choose an Identity Provider from a shorter list and supports screen readers. The Metadata Aggregator verifies signed metadata, filters selected elements, and provides a web service for querying processed metadata. Shibboleth supports SAML 1.1, SAML 2.0, OpenID Connect, and CAS, along with LDAP and Kerberos directory integrations. Built-in MFA and adaptive access are listed, while lifecycle provisioning is not included. The software is free to download and use, with Linux, macOS, Windows, and self-hosted platforms listed. General users can consult wiki documentation, forums, and mailing lists; Consortium members also receive developer Q&A and members-only Slack support. The project recommends Identity Provider version 5.2.2 or later for a May 2026 XML parsing vulnerability.