Skip to main content

​
Overview

Tierity connects to authentik with an API token, syncs every 6 hours, and raises findings such as superusers without MFA, terminated users who are still active and dormant accounts. It works with authentik Cloud and self-hosted instances. See Identity providers for everything that’s synced and checked.

​
Prerequisites

  • An authentik superuser, or a service account allowed to view users, authenticator devices, applications and events
  • Manage access (or higher) in Tierity
  • If you self-host authentik, it must be reachable from Tierity

​
Credentials required

​
Setup

1

Create an API token

In the authentik admin interface, go to Directory → Tokens and App passwords and create a token with the API intent for a superuser or service account that can view users, authenticator devices, applications and events. Copy the key.
2

Connect in Tierity

Go to Config → Integrations → authentik, enter your authentik URL and the token, and click Test connection. The first sync starts straight away.

​
What authentik adds

  • MFA strength from each user’s authenticator devices, with WebAuthn as phishing-resistant and TOTP as app-based
  • Superusers, treated as admins
  • Applications each user can access
  • Failed logins from authentik’s event log

​
Disconnecting

Go to Config → Integrations → authentik and click Disconnect, then delete the token in authentik.