Building an open source security project with 1M+ installations

Building an open source security project with 1M+ installations

Speakers: Fletcher Heisler, CEO, Authentic Security; Marcelo Elizeche Landó, Software Engineer, Authentic Security

Conference: BSides SF

YouTube: https://www.youtube.com/watch?v=iCH2nhRe13U

Overview

In this insightful BSides SF talk, Fletcher Heisler, CEO of Authentic Security, and Marcelo Elizeche Landó, Software Engineer, shared their journey and the "seven and a half-ish lessons" learned while scaling Authentik, an open-source identity provider (IDP), to over a million installations. The presentation offered a candid look into the challenges and triumphs of building, maintaining, and commercializing a critical security project in the open-source ecosystem. Their narrative provides invaluable guidance for anyone involved in open-source development, particularly those navigating the complexities of security-focused projects and the transition from a passion project to a full-fledged company.

Authentik serves as a self-hosted single sign-on (SSO) solution, enabling users to centralize access to their applications and infrastructure. While popular among home lab enthusiasts for organizing personal tech stacks, it also caters to larger groups and enterprises seeking robust identity and access management. The speakers underscored the unique pressures and opportunities that arise when developing a security product in the public eye, where transparency, community engagement, and a flexible technical approach are paramount.

The talk goes beyond mere technical implementation, delving into the strategic decisions around licensing, community management, and the intricate balance of an open-core business model. Heisler and Landó articulate how a strong foundation in open-source principles, coupled with a commitment to user needs and transparent security practices, can foster a thriving community and a sustainable commercial venture. Their experience with Authentik, which rapidly ascended to become a top-trending GitHub project, serves as a compelling case study for the contemporary landscape of open-source security innovation.

Background

▶ Watch: Introduction and overview of Authentic project (0:00)

Authentik's genesis lies in the personal frustrations of its founder and now CTO, Jens Langhammer, an infrastructure engineer at Yelp. Dissatisfied with existing identity solutions like Keycloak, Jens embarked on building Authentik as a side project in his free time, initially exploring identity and access management concepts with Python. This independent tinkering, which spanned two to three years, focused on developing core IDP functionalities, including the complex array of protocols and specifications required for a comprehensive identity provider. The speakers candidly admit that building an IDP from scratch is an ambitious undertaking, contrasting it with the more manageable scope of a "point tool" often found in open-source projects.

The project gained significant traction in 2022 when Jens shared Authentik on the self-hosted subreddit. The community's overwhelmingly positive response, coupled with interest from venture capital firms specializing in open-source commercialization, marked a turning point. This led to the formation of Authentic Security, an open-core company designed to support the open-source project. Jens transitioned to full-time development, securing funding by exchanging equity for assistance in establishing the company. A key early hire was a long-time home lab user and power community member, illustrating the project's deep roots in its user base.

The trajectory of Authentik's growth was anything but linear. After a period of steady ascent in GitHub stars, the project experienced a significant step function in mid-2024, becoming the number one trending GitHub project for several weeks. This surge rapidly expanded their user base from a core group of familiar experts to a broad, diverse, and rapidly growing community. This exponential growth necessitated quick adaptation for the small team, prompting them to re-evaluate their approaches to community management, technical architecture, and overall project sustainability. The core problem Authentik set out to solve remains the provision of a programmable, automatable, and API-first identity provider that offers users robust control over their self-hosted authentication infrastructure, differentiating itself from more traditional, wizard-driven UI approaches.

Key Findings

▶ Watch: Lesson 1: Your side project can become your full-time job (4:00)

The talk distilled the Authentik team's extensive experience into several critical lessons, offering a roadmap for successful open-source project development and commercialization in the security domain:

• Side Projects Can Become Full-Time Endeavors: Authentik’s journey from Jens Langhammer's personal frustration to a venture-funded company demonstrates that compelling open-source projects, particularly those addressing critical needs, can attract significant community interest and financial backing, enabling founders to commit full-time.
• Meet Your Community Where They Are: As Authentik scaled, the team learned the importance of diversifying communication channels. Beyond GitHub issues, they established a Discord server and actively engaged with the community-created subreddit. This multi-channel approach allows for different user needs, from basic installation support to in-depth technical discussions and contributions.
• Prioritize and Respond to Community Feedback: Regular backlog meetings are essential for triaging and prioritizing issues raised by the community. While acknowledging the challenge of managing low-quality, AI-generated bug reports or unrealistic "enterprise-level support for free" expectations, the speakers emphasized that consistent engagement fosters a loyal community, even leveraging user-driven feature requests (like Telegram social login) to shape the product roadmap.
• The Best Tech Stack Evolves: Authentik began as a pure Django project, leveraging Jens' proficiency for rapid development. However, performance bottlenecks, particularly with LDAP synchronization, necessitated partial rewrites in Go lang. The team is now even exploring Rust for further memory optimization, demonstrating a pragmatic approach to technology choice where the "right tool for the job" evolves with project scale and requirements. Simplifying the architecture by moving from Redis to PostgreSQL for most needs also proved beneficial for self-hosting users.
• Transparency in Security Builds Trust: Building a security product in the open creates a unique vulnerability but ultimately strengthens the project. Authentik actively conducts regular independent penetration tests and publishes the results, adhering to a responsible disclosure policy with clear timelines (e.g., usually 4 days prior to patch announcement) and assigning CVEs. This transparency, while initially counter-intuitive, fosters trust and demonstrates a mature approach to security vulnerabilities.
• Careful Licensing and Open-Core Strategy are Crucial: The shift from a GPL license to MIT reflects a deliberate choice to be "as open source as possible," despite the risk of others commercializing their code. As an open-core company, Authentik Security maintains 99% of its codebase as open source, with an enterprise folder containing proprietary, subscription-based features. Crucially, the company was formed as a Public Benefit Corporation (PBC), legally committing it to maintaining the open-source project for public benefit, a "poison pill" against potential "rug pulls."
• Commercial Benefits of Open Source Extend Beyond Direct Sales: The open-source model provides expert eyes on the code daily, enhancing security and quality through community feedback and contributions. It also serves as a powerful customer acquisition channel, with many commercial adopters being long-time home lab users already familiar with the product. Furthermore, an open-source project acts as an excellent recruiting tool, offering employees a public record of their contributions.
• Strategic Open Sourcing Decisions: The "half lesson" emphasizes the ongoing challenge of deciding which features belong in the open-source core versus the enterprise offering. The Authentik team generally prioritizes features that benefit home lab users or enhance security for the open-source project, even at the cost of short-term revenue. This approach, exemplified by open-sourcing remote access features, builds significant community goodwill.

Technical Deep Dive

▶ Watch: Authentic becomes #1 trending GitHub project (4:50)

Authentik's technical foundation reflects a pragmatic evolution driven by performance needs, architectural simplicity, and a commitment to developer-centric design. At its core, Authentik functions as an identity provider (IDP), offering single sign-on (SSO) capabilities. Its primary distinguishing feature is its API-first and programmable architecture, making it highly automatable and flexible for integration into diverse environments.

Initially, Authentik was developed as a pure Django project, leveraging the Python framework for rapid prototyping and feature development. This choice was strategic, capitalizing on founder Jens Langhammer's proficiency in Django, which allowed him to quickly ship core functionalities. However, as the project scaled and user bases grew, performance bottlenecks emerged, particularly in resource-intensive operations like LDAP synchronization. Python's Global Interpreter Lock (GIL) and general execution speed proved to be limitations for these specific tasks.

To address these performance challenges, the Authentik team undertook a partial rewrite of critical components in Go lang. Go's concurrency model and efficient execution were well-suited for improving the speed and scalability of operations like LDAP synchronization, significantly enhancing the project's overall performance. This demonstrates a willingness to adopt polyglot programming approaches when dictated by technical requirements, rather than adhering rigidly to a single language.

The evolution continues, with an ongoing exploration into rewriting certain Go components in Rust. Early numbers from this "coop" (community-driven PR) indicate substantial improvements, with observed memory consumption slashed by almost half in some parts. This move towards Rust underscores a continuous drive for extreme performance optimization and resource efficiency, which is particularly valuable for self-hosted applications where resource constraints might be a factor.

Beyond programming languages, Authentik's data persistence and caching strategy also underwent refinement. Initially, Redis was used for caching and session management. However, as the project matured and user diversity increased, Redis began to introduce more operational complexity than it solved. The team made a deliberate decision to "get rid of" Redis, consolidating most of their data needs into PostgreSQL. This simplification significantly reduced the architectural overhead, making Authentik easier to maintain and more appealing to the self-hosting community, who often prioritize simplicity and fewer dependencies.

For deployment, Authentik offers robust support for modern containerization and orchestration platforms. Official installation methods include Docker Compose and Kubernetes, catering to the prevalent deployment strategies in the self-hosted and infrastructure communities. Furthermore, an AWS CloudFormation template is available for cloud deployments, and the vibrant community maintains a Digital Ocean one-click app, showcasing the project's adaptability and broad appeal across different hosting preferences.

A core tenet of Authentik's design is its developer-forward approach. The entire system is built upon a Django API, meaning "every single action within Authentik" is exposed via an API. This enables extensive automation and custom integration. For complex, bespoke logic, users can embed expression policies using a Python-based syntax. This capability allows for highly granular control over authentication flows, access policies, and user management, providing a level of customization that differentiates Authentik from more rigid, off-the-shelf solutions. This API-first philosophy also empowers the community to develop a "massive catalog" of integrations, such as with Home Assistant, further extending Authentik's utility and ecosystem.

Demo / Proof of Concept

▶ Watch: Lesson 3: Prioritize and respond to your community (6:40)

The presentation by Fletcher Heisler and Marcelo Elizeche Landó focused primarily on the strategic and operational lessons learned from building and scaling the Authentik project. While the talk provided extensive technical details about Authentik's architecture and evolution, it did not include a live demonstration or a specific proof of concept of the Authentik software itself. The narrative centered on the journey, challenges, and solutions encountered by the team rather than showcasing the product's features in real-time.

Defensive Implications

▶ Watch: Challenges in managing an open-source community (7:40)

The Authentik team's approach to developing and sustaining an open-source security project offers several crucial defensive implications for organizations and security professionals.

Firstly, the emphasis on transparency in security is paramount. Authentik's commitment to conducting regular independent penetration tests and publicly publishing the results sets a high bar. For any organization evaluating an open-source security tool, this level of transparency should be a key criterion. It signals a mature security posture and a willingness to withstand scrutiny, fostering trust that is essential when deploying an identity provider—a critical component of an organization's security infrastructure. Defenders should actively seek out projects with similar transparent security practices, including clear responsible disclosure policies and a history of appropriately assigning CVEs for identified vulnerabilities. The speakers noted that the community generally understands that CVEs are a sign of a robust process, not necessarily a flaw in the product itself.

Secondly, for organizations considering a self-hosted IDP, Authentik's journey highlights the importance of choosing a solution that prioritizes architectural simplicity and maintainability. The shift from Redis to PostgreSQL for primary data storage, for instance, underscores how reducing complexity can enhance stability and ease of operation, which directly translates to improved defensive posture by minimizing potential attack surface and configuration errors. Ease of deployment via Docker Compose and Kubernetes also means faster, more consistent deployments, reducing the likelihood of misconfigurations that attackers could exploit.

Thirdly, the discussion on dependency management is a critical takeaway. The Authentik team's diligent monitoring of licenses and potential vulnerabilities in third-party packages is a practice all development teams, especially those building security products, must adopt. Proprietary or poorly secured dependencies can introduce significant risks down the supply chain. Defenders should ensure their internal development processes include rigorous dependency scanning, license compliance checks, and proactive patching strategies.

Finally, Authentik's API-first and programmable architecture presents both opportunities and challenges for defenders. While it allows for immense flexibility and automation, it also means that custom integrations and expression policies must be developed with security in mind. Improperly configured APIs or flawed custom logic can create new avenues for compromise. Organizations leveraging such powerful customization features must implement robust code review processes, secure coding guidelines, and thorough testing for all custom-built integrations and policies to ensure they do not inadvertently introduce vulnerabilities into the identity fabric. The capability to embed Python-based expression policies, while powerful, requires careful scrutiny to prevent injection flaws or unintended access grants.

In essence, Authentik's experience provides a practical framework for evaluating and implementing open-source security solutions, emphasizing that a project's technical merits must be coupled with strong, transparent security practices and a commitment to sustainable development.

Key Takeaways

• Open Source Projects Can Scale Dramatically: A compelling side project, coupled with community engagement and strategic funding, can evolve into a widely adopted, full-time endeavor with millions of installations.
• Community Engagement is Non-Negotiable: Actively meeting users on their preferred platforms (GitHub, Discord, Reddit), prioritizing their issues, and allowing community feedback to influence the product roadmap are vital for growth and sustainability.
• Technical Stacks Must Be Flexible and Evolve: While starting with familiar technologies is efficient, be prepared to adapt and partially rewrite components (e.g., Python to Go, Go to Rust) to address performance bottlenecks and optimize resource consumption as the project scales.
• Transparency Builds Trust in Security: Openly publishing penetration test results, maintaining a clear responsible disclosure policy, and assigning CVEs for vulnerabilities demonstrates a mature security posture and fosters community confidence, even for security-critical projects.
• Strategic Licensing and Open-Core Models Enable Sustainability: Careful consideration of licensing (e.g., MIT for maximum openness) and the adoption of an open-core business model, especially when backed by a Public Benefit Corporation charter, can create a sustainable path for open-source projects.
• Open Source Offers Significant Commercial Benefits: Beyond direct revenue, open-source projects benefit from "expert eyes" on the code, serve as a powerful customer acquisition channel for enterprise offerings, and act as an excellent recruiting tool by showcasing public contributions.
• Deliberate Feature Prioritization is Key: Continuously evaluate which features best serve the open-source community (e.g., home lab users, core security) versus those that are more suited for commercial enterprise offerings, often prioritizing community goodwill over short-term revenue.

About the Speaker(s)

Fletcher Heisler is the CEO of Authentic Security, the company that supports the open-source identity provider Authentik. His entrepreneurial background includes founding Thunder Two, which focuses on AppSec training for developers, and Real Python, a platform providing resources and a community for web developers. In his personal time, Heisler engages in "silly side projects," notably taser chess, which he showcases on his channel "Everything Is Stacked."

Marcelo Elizeche Landó serves as a Software Engineer at Authentic Security. He brings a rich background from the open-source world, having been involved in numerous open-source projects and civic tech initiatives. This experience grants him a unique perspective, having contributed to the open-source ecosystem as both a user and, now, as a maintainer of a significant project like Authentik.