Skip to content

Authentik & SSO — FAQ

Login help for auth.saxobroko.com and SSO-protected apps (docs, dashboard). Passwords in Vaultwarden — not here.

Auth stack (how login actually works)

Most private sites pass through two gates: Cloudflare Access, then Authentik OIDC.

flowchart LR
  USER[You] --> ACCESS[Cloudflare Access]
  ACCESS --> AUTH[Authentik auth.saxobroko.com]
  AUTH --> APP[docs dash vault etc.]
  VLT[Vaultwarden passwords] -.-> USER
Symptom Usually means Start here
Infinite redirect loop OIDC callback / Access policy clash AUTH-010+, Auth stack
Access page, never Authentik Email OTP / session issue Auth stack — Access
Authentik works, app blank App-specific OIDC config authentik.md
docs login fails Special case — Pages + Access Auth stack — docs

Integrated runbooks: Auth stack troubleshooting · Authentik · WAF / Access

42 entries — IDs AUTH-001 through AUTH-042.

AUTH-001 — What is Authentik?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Single sign-on at auth.saxobroko.com — one login for many private sites.
  2. Credentials in Vaultwarden — search Authentik. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-002 — Docs sends me to Cloudflare Access first — normal?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Yes — Access then Authentik then docs.
  2. See Authentik. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-003 — Which username and password?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Unlock vault first.
  2. Search Authentik — copy, don't guess. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-004 — Wrong password at Authentik?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Check Caps Lock.
  2. Copy from vault.
  3. Try incognito.
  4. Stop after 3 tries — ask Ryan. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-005 — Redirect loop on docs?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Clear cookies for docs, cloudflareaccess, auth.
  2. Private window → log in again.
  3. Ryan checks Access callback if still broken. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-006 — Authentik OK but Access denied?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. User needs email on Authentik profile.
  2. Ryan adds you to Access policy. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-007 — Same login for dash.saxobroko.com?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Yes — dash uses same Authentik SSO. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-008 — Authentik on phone?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Open docs/dash in browser — same credentials.
  2. Use Bitwarden app to copy password. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-009 — Same as Vaultwarden master password?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. No — separate login stored inside vault. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-010 — Where does Authentik run?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Docker on TrueNAS 192.168.2.203 via Cloudflare Tunnel. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-011 — Add new family user?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Ryan: Add Authentik user + Cloudflare Access. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-012 — Forgot Authentik password?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Admin resets in Directory → Users, or ask Ryan.
  2. Save new password to vault. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-013 — Admin panel won't load?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Check internet and NAS power.
  2. Ryan tries LAN http://192.168.2.203:30140. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-014 — Cloudflare Access vs Authentik?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Access = gate at edge. Authentik = username/password check. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-015 — YubiKey needed for Authentik?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Usually no — see YubiKey FAQs for other services. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-016 — Session keeps expiring?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Normal after long idle — re-login from vault.
  2. Avoid private browsing for daily use. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-017 — Stay logged in on shared PC?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Only if you trust everyone — docs are private.
  2. Log out when done. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-018 — SSL warning on auth URL?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Do not proceed — check clock, try another network, Ryan checks SSL. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-019 — Overseas can't reach auth?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Tunnel may be geo-blocked — VPN to AU or wait for home access. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-020 — Need to know OAuth?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. No for daily use — Ryan handles cloudflare-access provider config. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-021 — What else uses Authentik?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Any site redirecting to auth.saxobroko.com — not banks. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-022 — Blank page after login?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Hard refresh, incognito, check status.saxobroko.com. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-023 — Change Authentik username?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Admin only — ask Ryan. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-024 — Two people logged in together?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Fine — each should have own account. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-025 — Missing email on user?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Required for Access — admin adds email in Directory. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-026 — How to log out?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Sign out on auth or clear auth/cloudflareaccess cookies. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-027 — Recovery email exists?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Check vault and physical handover — no public reset by default. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-028 — Login works but docs look old?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Build/deploy issue — check GitHub Actions, not auth. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-029 — Ryan — API token location?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Vaultwarden — never in git. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-030 — Client ID/Secret for Cloudflare?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Zero Trust → Authentik IdP — rotate and copy once to vault. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-031 — Edit WAF skip rules?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. No — Ryan only if bot loops appear. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-032 — Home internet down — Authentik?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Public auth needs NAS+tunnel — LAN port for emergency admin only. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-033 — LDAP or OIDC?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. OIDC (cloudflare-access) — not LDAP for family. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-034 — Login page looks different — scam?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Check URL is auth.saxobroko.com with padlock. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-035 — Wait between failed tries?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. 30 seconds — verify from vault first. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-036 — Kids get Authentik accounts?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Ryan decides — docs have adult content. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-037 — Homepage login loop?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Same cookie fix as docs — see Homepage. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-038 — Authentik for Vaultwarden?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. No — vault has its own master password. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-039 — After Saxon died — still works?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Yes with vault+YubiKey+user account — see First 24 hours. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-040 — Delete Authentik after death?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. No — needed for docs during handover. Ryan keeps per will. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-041 — 502 on auth.saxobroko.com?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Restart Authentik app + cloudflared on TrueNAS. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site
AUTH-042 — More help?

Stack context: Authentik · Cloudflare Access · OIDC Integrated runbooks: Auth stack · authentik

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Access guides, Login troubleshooting, Ctrl+K search. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Open docs site