Free SSO in front of self-hosted n8n: Authelia without an Enterprise license

n8n's Community Edition has no SSO, no SAML, no built-in LDAP directory — those building blocks are reserved for paid plans, as detailed in our guide n8n free: what the license actually allows. In practice, a self-hosted instance relies on an email-and-password account managed by n8n itself, with no native second factor and no central identity provider. For a personal instance or a very small team, that's not a problem. For a growing team, or an instance exposed to the internet with sensitive credentials inside, it is. The fix isn't to wait for an Enterprise budget: it's to put a centralized authentication gate in front of n8n, at the reverse proxy level, using an open source tool like Authelia.

What the Community license doesn't cover — and why it matters

Without SSO, every team member has their own n8n password, chosen and remembered like any other password among the dozen or so everyone already juggles. That's exactly the terrain that worries security researchers: a study by Das, Bonneau, Caesar, Borisov and Wang, presented at the NDSS Symposium 2014, analyzed several hundred thousand passwords from real-world leaks and found that between 43% and 51% of users reuse the same password, or a predictable variant, across multiple sites — to the point where a cross-site guessing algorithm recovers 30% of transformed passwords in under a hundred attempts (Das et al., 2014, NDSS Symposium). An n8n instance exposed with a plain email/password pair inherits the same risk as any other web account belonging to that user: the breach doesn't necessarily start with n8n, it starts elsewhere and spreads via the recycled password.

n8n's owner/member roles (covered in our guide n8n self-hosted users and permissions) still apply, but nothing in the Community Edition enforces a strong password policy, a short session lifetime, or a second factor. That's precisely what an upstream authentication layer covers.

The principle: a gate, not an n8n module

Authelia is an open source authentication portal that sits between your reverse proxy (Nginx, Traefik, or Caddy) and your internal applications. The mechanism is called forward auth: every incoming request to n8n.yourdomain.com is first checked against Authelia, which verifies whether a valid session exists. Without a session, the user is redirected to the Authelia portal, enters their username, password, and — if you enable it — a TOTP code, before ever seeing n8n's own login screen.

An important point not to oversell: Authelia doesn't merge its identity with n8n's. The Community Edition can't read a Remote-User header forwarded by the proxy to open an application session automatically — that finer integration is exactly what Enterprise SSO adds on top. What you get with Authelia is a robust, centralized network lock upstream: without it, n8n's login screen isn't even reachable. For a small team, a single shared n8n account behind that lock is often enough; for individual accounts regardless, each person keeps their own classic n8n account, which Authelia protects with one extra layer before it's ever displayed.

Deploying Authelia in front of n8n with Docker Compose

If your instance already runs in Docker (see our n8n Docker installation guide) and behind Nginx or Traefik (see our Nginx reverse proxy and HTTPS with Traefik or Caddy guides), Authelia gets added as one more service in the same docker-compose.yml:

services:
  authelia:
    image: authelia/authelia:latest
    volumes:
      - ./authelia:/config
    environment:
      - TZ=Europe/Paris
    restart: unless-stopped

The configuration.yml file mounted into ./authelia defines the local identity provider (or an existing LDAP directory, if you already have one), the password policy, and above all the access control rules per domain:

access_control:
  default_policy: deny
  rules:
    - domain: n8n.yourdomain.com
      policy: two_factor
    - domain: n8n.yourdomain.com
      resources:
        - "^/webhook.*"
        - "^/webhook-test.*"
        - "^/form.*"
      policy: bypass

That last rule is the one people forget most often, and it breaks things silently when it's missing: the /webhook, /webhook-test, and /form paths must stay on bypass, with no Authelia authentication, otherwise Stripe, GitHub, or any legitimate external caller hits an HTML login page instead of reaching your workflow. Securing those routes stays n8n's own responsibility — Header Auth, HMAC signature verification — as detailed in our n8n webhook security guide.

On the Nginx side, the integration goes through an internal subrequest to Authelia's verification endpoint before letting the request through to n8n:

location /internal/authelia {
    internal;
    proxy_pass http://authelia:9091/api/verify;
    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
}

location / {
    auth_request /internal/authelia;
    error_page 401 = @errorauth;
    proxy_pass http://n8n:5678;
}

With Traefik, the same result comes from a forward-auth middleware declared in the n8n container's labels rather than a dedicated location block — the verification logic stays identical, only the syntax changes.

Turning on the second factor (TOTP)

Once the portal is in place, enabling TOTP (Google Authenticator, Aegis, or any compatible authenticator) takes just a few lines in configuration.yml, under identity_validation and the notification provider (SMTP is enough for sending the initial setup links). That's the most direct payoff of the whole exercise: even a guessed or reused password, as documented in the study cited above, is no longer enough to reach the instance without the second factor physically held by the legitimate user.

What this doesn't replace

This approach closes the front door, but it doesn't recreate everything n8n's Enterprise SSO offers: no automatic provisioning of distinct n8n accounts per SSO user, no fine-grained RBAC beyond the native owner/member pair, no integration with Git versioning or separate environments. If your organization needs that level of governance — fine-grained traceability of who changed which workflow, per-project roles — those remain legitimate arguments for a paid plan, worth weighing in our comparison n8n self-hosted vs. cloud. Authelia answers a more targeted, immediate need: keeping n8n from being reachable by anyone who guesses or steals a single password.

A concrete case

For a small organization — the typical five-to-ten-person team running the workflows from the Compliance & Audit Pack (€149) on its own self-hosted instance — the simplest setup remains a single shared (owner) n8n account, with the various tool credentials (Supabase, OpenAI) already scoped per workflow. Authelia protects access to that single account with one identifier per person, an individual password on the portal side, and mandatory TOTP: every login is individually authenticated and logged in Authelia's logs, even though everyone ends up on the same n8n account afterward. It's a pragmatic compromise, far less granular than true per-user RBAC, but infinitely better than an n8n instance protected by nothing more than the default password left unchanged since installation.

In summary

n8n Community offers no native SSO, and that isn't changing without an Enterprise license. An authentication portal like Authelia, placed in front of the instance at the reverse proxy level, doesn't replicate that feature identically — but it closes the real security gap: access protected by a single password, with no second factor, potentially reused elsewhere. A few dozen lines of Docker and Nginx (or Traefik) configuration are enough to put this layer in place, as long as you don't forget to exclude your webhook routes from the filter.