Authentik

Workflow

1. Confirm identity architecture, trust boundaries, and app risk profile.
2. Model tenants, applications, and OAuth2/OIDC providers.
3. Configure redirect URI policy and client type correctly.
4. Define scopes, claims/property mappings, and subject strategy.
5. Set token/session lifetimes aligned with threat model.
6. Validate metadata, login/logout flows, and key rotation behavior.
7. Operationalize monitoring, audit logs, and recovery runbooks.

Preflight (Ask / Check First)

• Authentik version and deployment mode.
• Public vs confidential client usage.
• Required claims and group/role mapping expectations.
• Session and token lifetime requirements.
• TLS, reverse-proxy, and domain model.