Skip to content

Index

import DocCardList from "@theme/DocCardList";

What is the authentik Agent?

The authentik Agent is a service that can be installed on Linux, macOS, and Windows devices. It provides the following capabilities:

authentik Agent components

The authentik Agent consists of several components:

Platform Component Description Dependencies
Linux, macOS, Windows authentik-cli Provides CLI commands for interacting with authentik-agent. authentik-agent
Linux, macOS, Windows authentik-agent Authentication within a users' context, for CLI tools. authentik-sysd
Linux, macOS, Windows authentik-sysd Responsible for handling device-level authentication and compliance checks. None
Linux only libpam-authentik PAM Module for token-based and interactive authentication via authentik. Used for SSH authentication and local device login. authentik-sysd
Linux only libnss-authentik NSS Module that makes Linux aware of authentik users. All authentik users are visible to Linux but cannot log in unless configured through device access groups. Provides a consistent uid and gid for users on all endpoint devices. authentik-sysd
Windows only Windows Credential Provider (WCP) Enables logging in to Windows devices using authentik credentials. authentik-sysd

Technical information

All authentik Agent components communicate via gRPC and Unix domain sockets/Windows named pipes.

Linux: /var/run/authentik/sys.sock and /var/run/authentik/sys-ctrl.sock macOS: /var/run/authentik-sysd.sock and /var/run/authentik-sysd-ctrl.sock Windows: \\.\pipe\authentik\sysd and \\.\pipe\authentik\sysd-ctrl

  • sys.sock/*sysd.sock for general communication
  • *-ctrl.sock for domain join

Important considerations

Sentry reporting is currently enabled by default and cannot be disabled. This will be configurable in a future release.

Report issues

Please report issues and bugs via the authentik Platform GitHub repository.

More information

For more information, refer to each of the topics below: