Over 10 years we help companies reach their financial and branding goals. Engitech is a values-driven technology agency dedicated.

Gallery

Contacts

411 University St, Seattle, USA

[email protected]

+1 -800-456-478-23

Twitter Facebook-f Pinterest-p Instagram

How to install authentik with RAC Remote Desktop

This guide installs authentik on Debian 13 using Docker Compose and configures authentik RAC (Remote Access Control) for browser-based Remote Desktop access to Windows servers.

The installation follows authentik's official Docker Compose documentation.

authentik RAC supports:

RDP    Windows Remote Desktop
SSH    Linux / Unix
VNC    Windows / Linux / macOS

RAC uses Apache Guacamole internally to establish these remote connections.

Architecture

A typical deployment looks like:

                         Internet / LAN
                              │
                              ▼
                    https://auth.example.com
                              │
                              ▼
                     ┌─────────────────┐
                     │ Reverse Proxy   │
                     │ Nginx / Caddy   │
                     │ Cloudflare      │
                     └────────┬────────┘
                              │
                              ▼
                     ┌─────────────────┐
                     │    authentik    │
                     │                 │
                     │ Server          │
                     │ Worker          │
                     │ PostgreSQL      │
                     └────────┬────────┘
                              │
                        WebSocket/API
                              │
                              ▼
                     ┌─────────────────┐
                     │   RAC Outpost   │
                     │                 │
                     │ Apache          │
                     │ Guacamole       │
                     └────────┬────────┘
                              │
                   ┌──────────┼──────────┐
                   │          │          │
                   ▼          ▼          ▼
                  RDP        SSH        VNC
                :3389       :22        :5900
                   │
                   ▼
             Windows Server

The user's browser does not need direct access to TCP 3389.

The RAC outpost needs network connectivity to the RDP server instead. authentik then carries the remote session back to the browser through WebSockets.

Important: RAC Is Browser-Based RDP

RAC does not replace the Windows RDP authentication mechanism used by:

mstsc.exe

Instead, users access:

authentik
    ↓
Application Dashboard
    ↓
Remote Access
    ↓
Windows Server

and the Windows desktop appears directly in the browser.

This is different from authentik's Windows Credential Provider functionality; authentik's current device-login documentation states that native RDP login through that Credential Provider is not yet supported.

System Requirements

authentik's Docker Compose installation is intended for testing and small-scale production deployments.

Official minimum requirements are:

CPU:      2 cores
Memory:   2 GB RAM
Runtime:  Docker Compose v2 or Podman

For a production instance that will also run RAC, I recommend:

CPU:      4 cores+
Memory:   4-8 GB+
Storage:  30 GB+ SSD
Network:  Gigabit Ethernet
OS:       Debian 13

RAC remote desktop sessions also consume CPU, memory, and network bandwidth, so size according to concurrent sessions.

Requirements

Install:

Debian 13
Docker Engine
Docker Compose v2
OpenSSL
curl or wget

Verify Docker:

docker --version
docker compose version

1. Create authentik Directory

sudo mkdir -p /opt/authentik
sudo chown $USER:$USER /opt/authentik

cd /opt/authentik

2. Download Official Compose File

authentik recommends downloading its current Compose definition directly from its documentation site.

wget https://docs.goauthentik.io/compose.yml

Or:

curl -O https://docs.goauthentik.io/compose.yml

Check:

ls -la

You should have:

compose.yml

3. Generate PostgreSQL Password

Generate a random PostgreSQL password:

echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env

authentik specifically recommends generating a random PostgreSQL password for a new installation.

4. Generate authentik Secret Key

echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env

The secret key is critical to the authentik installation.

Do not change it after authentik has been deployed unless you understand the consequences.

Check:

cat .env

Example:

PG_PASS=<generated-password>
AUTHENTIK_SECRET_KEY=<generated-secret>

Protect the file:

chmod 600 .env

5. Optional Error Reporting

To enable authentik error reporting:

echo "AUTHENTIK_ERROR_REPORTING__ENABLED=true" >> .env

This option is documented by authentik as part of the Docker Compose installation process.

6. Start authentik

Pull container images:

docker compose pull

Start:

docker compose up -d

These are the official installation/start commands.

Check:

docker compose ps

7. Check Logs

docker compose logs

Follow:

docker compose logs -f

Server only:

docker compose logs -f server

Worker:

docker compose logs -f worker

8. Open authentik

By default authentik exposes:

HTTP:   9000
HTTPS:  9443

Open:

http://SERVER_IP:9000

For example:

http://10.10.10.20:9000

The initial setup asks you to configure the password for:

akadmin

authentik documents port 9000 as the default initial setup endpoint.

Optional Custom Ports

The official Compose configuration supports:

COMPOSE_PORT_HTTP=80
COMPOSE_PORT_HTTPS=443

For example:

cat >> .env <<'EOF'
COMPOSE_PORT_HTTP=80
COMPOSE_PORT_HTTPS=443
EOF

Then recreate:

docker compose up -d

However, for production I recommend keeping authentik behind a reverse proxy instead.

Recommended Production Architecture

Internet
    │
    ▼
TCP 443
    │
    ▼
Nginx / Caddy / Nginx Proxy Manager
    │
    ▼
authentik:9000

For example:

https://auth.example.com
          │
          ▼
http://10.10.10.20:9000

This makes it easier to manage:

TLS certificates
DNS
HTTP redirects
Access logs
Firewall rules

Important Docker Socket Note

The official authentik Compose configuration mounts:

/var/run/docker.sock

into the authentik worker by default.

authentik uses this to automatically create and manage Outposts, including the RAC outpost.

The mount looks similar to:

- /var/run/docker.sock:/var/run/docker.sock

This gives the worker powerful control over Docker.

authentik specifically notes the security implications and suggests a Docker Socket Proxy or manual outpost deployment if you do not want to expose the raw Docker socket.

RAC Remote Access

Now configure browser-based Remote Desktop.

The official RAC workflow is:

1. Create RAC Application + Provider
2. Configure credentials/property mappings
3. Create RDP endpoints
4. Deploy RAC Outpost
5. Assign users/policies
6. Connect through authentik

RAC Network Design

Example:

authentik
10.10.10.20
     │
     │
     ▼
RAC Outpost
Docker
     │
     │ TCP 3389
     ▼
Windows Server
10.10.10.50

The RAC outpost must be able to reach:

10.10.10.50:3389

Test from the authentik host:

nc -vz 10.10.10.50 3389

Expected:

Connection to 10.10.10.50 3389 port [tcp/ms-wbt-server] succeeded

Configure Windows Server for RDP

On the Windows machine, enable:

Settings
    → System
    → Remote Desktop
    → Enable Remote Desktop

Or on Windows Server:

Server Manager
    → Local Server
    → Remote Desktop
    → Enabled

Check the port:

Get-NetTCPConnection -LocalPort 3389

Windows Firewall

Normally Windows creates an appropriate Remote Desktop firewall rule automatically when RDP is enabled.

Verify:

Get-NetFirewallRule `
    -DisplayGroup "Remote Desktop"

For additional security, restrict RDP so that it is only reachable from the RAC host/network.

Example architecture:

RAC Outpost
10.10.10.20
      │
      │ allowed
      ▼
Windows :3389

Other LAN clients
      │
      X blocked

This is preferable to exposing RDP publicly.

Do Not Expose RDP to the Internet

You do not need:

Internet
    ↓
3389
    ↓
Windows Server

Instead use:

Internet
    ↓
HTTPS 443
    ↓
authentik
    ↓
RAC
    ↓
RDP 3389 internally
    ↓
Windows

So only authentik needs to be Internet accessible.

1. Create RAC Application and Provider

Log into authentik Admin.

Navigate to:

Applications
    → Applications
    → New Application

The official RAC workflow recommends creating the application and provider together through this wizard.

Example:

Name:
Remote Desktop

Slug:
remote-desktop

Click:

Next

Provider type:

RAC

Configure the Remote Access Provider.

Example:

Name:
Remote Desktop Provider

Submit.

You now have:

Application
    Remote Desktop

Provider
    Remote Desktop Provider

RAC Endpoint Model

Unlike many authentik providers, you don't need one application for every RDP server.

One RAC application can contain multiple endpoints.

For example:

Remote Desktop
│
├── ERP Server
│     10.10.10.50:3389
│
├── Accounting Server
│     10.10.10.51:3389
│
├── Development VM
│     10.10.10.60:3389
│
└── Domain Controller
      10.10.10.10:3389

Policies can then restrict which users can access each endpoint.

RDP Credential Options

There are two main approaches.

Option A — Store Credentials

authentik RAC property mappings can contain:

Username
Password
Domain
Connection options

This allows one-click RDP access.

However, I do not recommend storing shared Windows administrator credentials unless there is a specific reason.

Option B — Prompt for RDP Credentials

For Windows Remote Desktop, this is the recommended approach in many environments.

Flow:

User logs into authentik
        │
        ▼
MFA / authentik policy
        │
        ▼
Select Windows server
        │
        ▼
Enter Windows username/password
        │
        ▼
RAC passes credentials to RDP
        │
        ▼
Windows desktop

authentik specifically documents credential prompting as useful for modern Windows RDP systems and notes that this avoids storing static credentials in the provider or endpoint.

Create RDP Credential Prompt Flow

Navigate to:

Flows and Stages
    → Flows
    → New Flow

Example:

Name:
RDP Credentials

Title:
Enter Remote Desktop Credentials

Slug:
rdp-credentials

Designation:
Authorization

Authentication:
Require authentication

The flow must use:

Designation: Authorization
Authentication: Require authentication

according to authentik's RAC credential prompt documentation.

Create Username Prompt

Navigate:

Flows and Stages
    → Prompts
    → New Prompt

Configure:

Name:
RDP Username

Field Key:
connection_settings.username

Label:
Username

Type:
Text

Required:
Yes

Order:
0

The important field is:

connection_settings.username

Create Password Prompt

Create another prompt:

Name:
RDP Password

Field Key:
connection_settings.password

Label:
Password

Type:
Password

Required:
Yes

Order:
1

The important field is:

connection_settings.password

Optional Windows Domain Prompt

For Active Directory environments, you can add:

Name:
Windows Domain

Field Key:
connection_settings.domain

Label:
Domain

Type:
Text

authentik explicitly documents connection_settings.domain as an optional useful prompt for Windows RDP environments.

Example:

Domain:
XEON

Then users could enter:

Username: user
Password: ********
Domain:   XEON

Create Prompt Stage

Open:

Flows and Stages
    → Flows
    → RDP Credentials

Then:

Stage Bindings
    → Create or bind
    → New Stage

Type:

Prompt Stage

Example name:

RDP Credentials Stage

Add fields:

RDP Username
RDP Password
Windows Domain   (optional)

Remove unnecessary default validation policies unless you intentionally need them.

Finish the binding.

This follows authentik's documented RAC credentials-prompt workflow.

Assign Authorization Flow to RAC Provider

Navigate:

Applications
    → Providers
    → Remote Desktop Provider

Set:

Authorization Flow:
RDP Credentials

Save.

Now users will be prompted for their Windows credentials when starting an RDP session.

Create Windows RDP Endpoint

Navigate:

Applications
    → Providers
    → Remote Desktop Provider
    → Endpoints
    → New RAC Endpoint

Example:

Name:
ERP Windows Server

Protocol:
RDP

Host:
10.10.10.50

You can optionally include the port:

10.10.10.50:3389

Set:

Maximum concurrent connections:
-1

for no RAC-side connection limit, or specify a suitable limit.

authentik's endpoint configuration supports host/IP, protocol, concurrency limit, property mappings, and advanced connection settings.

RDP Security Setting

Modern Windows systems may require the RAC RDP connection security setting to be explicitly configured.

authentik's current credentials-prompt guide recommends trying:

security: tls

for systems where the default negotiation doesn't work.

Navigate:

Application
    → Providers
    → Remote Desktop Provider
    → Endpoint
    → Advanced Settings

Set:

security: tls

Other supported Guacamole security modes documented by authentik include:

any
nla
nla-ext
tls
vmconnect
rdp

Do not change this unless required.

For many domain-joined Windows deployments using NLA, you may need to test the appropriate setting for your environment.

Optional RDP Settings

authentik RAC supports Apache Guacamole RDP connection settings such as:

username
password
domain
security
enable-audio

and additional Guacamole options.

RAC currently supports features including:

Bi-directional clipboard
Audio redirection from remote machine
Dynamic resizing

Create RAC Outpost

RAC requires its own RAC Outpost.

Navigate:

Applications
    → Outposts
    → Create

Configure:

Name:
RAC Outpost

Type:
RAC

Integration:
Docker

Applications:
Remote Desktop

Click:

Create

If the authentik worker has access to:

/var/run/docker.sock

authentik can automatically deploy the RAC outpost through Docker.

Check RAC Outpost Container

On the server:

docker ps

You should see the normal authentik containers plus a RAC outpost.

For example:

authentik-server
authentik-worker
postgres
rac-outpost

The exact container name is generated by authentik.

Manual RAC Outpost

If you do not want authentik to control Docker automatically, RAC can be manually deployed.

authentik's official RAC outpost image is:

ghcr.io/goauthentik/rac

The documented Compose structure is:

services:

  rac_outpost:
    image: ghcr.io/goauthentik/rac

    environment:
      AUTHENTIK_HOST: https://auth.example.com
      AUTHENTIK_INSECURE: "false"
      AUTHENTIK_TOKEN: token-generated-by-authentik

The token must be the token generated for that outpost.

Do not invent or reuse arbitrary API tokens.

RAC Outpost Location

The RAC outpost does not necessarily have to run on the authentik server.

For example:

Internet

    │
    ▼

auth.example.com
authentik
Public DMZ

    │
    │ authenticated connection
    ▼

RAC Outpost
Internal Network
10.10.10.5

    │
    ├── RDP → 10.10.10.50
    ├── RDP → 10.10.10.51
    └── SSH → 10.10.10.60

This can be very useful when authentik is publicly hosted but the RDP machines are inside a private network.

The manually deployed RAC outpost needs connectivity to authentik and to its remote endpoints.

Firewall Design

A secure network design is:

Internet
    │
    │ HTTPS 443
    ▼
authentik
    │
    │ WebSocket/API
    ▼
RAC Outpost
    │
    │ TCP 3389
    ▼
Windows Server

Allow:

Internet → authentik
TCP 443

Allow:

RAC Outpost → Windows
TCP 3389

Do not allow:

Internet → Windows
TCP 3389

Example Windows Firewall Restriction

Suppose:

RAC Outpost:   10.10.10.20
Windows:       10.10.10.50

On Windows PowerShell as administrator:

New-NetFirewallRule `
    -DisplayName "RDP from authentik RAC" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 3389 `
    -RemoteAddress 10.10.10.20 `
    -Action Allow

Then make sure broader RDP rules do not unintentionally expose the server to untrusted networks.

Endpoint Access Policies

RAC endpoints support policy bindings.

This means:

Remote Desktop Application
│
├── ERP Server
│      └── ERP Administrators
│
├── Accounting Server
│      └── Accounts Team
│
└── Development Server
       └── Developers

A user needs permission both for the RAC application and the endpoint itself.

This is strongly recommended instead of giving every authentik user access to every remote machine.

Add MFA

One of the main benefits of putting RDP behind authentik is that authentik can enforce:

Username/password
        +
TOTP / WebAuthn / Passkey
        +
Policy
        ↓
RAC
        ↓
RDP

A good administrative remote-access policy is:

authentik Login
      │
      ├── Password
      │
      └── MFA
            │
            ▼
      Endpoint policy
            │
            ▼
     RDP credential prompt
            │
            ▼
      Windows Server

User Connection Flow

Once configured:

1. User opens https://auth.example.com

2. User signs into authentik

3. User completes MFA

4. User opens Remote Desktop

5. User selects:
   ERP Windows Server

6. authentik asks:
   Windows Username
   Windows Password
   Domain (optional)

7. RAC Outpost connects to:
   10.10.10.50:3389

8. Windows desktop appears in browser

authentik documents that starting the RAC application from the user's Application Dashboard opens the remote connection directly in the browser.

Multiple Windows Servers

One RAC application can provide:

Remote Desktop
│
├── ERP Production
├── ERP Development
├── SQL Server
├── Domain Controller
├── Accounting VM
├── HR Server
└── Management Server

You do not need a separate RAC provider for every Windows server. RAC's Endpoint model is specifically designed for this scenario.

Session Management

Every time an endpoint is opened, authentik creates a RAC connection.

The connection terminates when:

authentik session expires

and the RAC provider can also have its own connection expiration time.

Administrators can terminate connections manually through the provider's:

Connections

tab.

Security Requirement — Keep authentik Updated

This is particularly important when using RAC.

authentik disclosed a RAC security vulnerability affecting endpoint authorization and stored credentials. It is fixed in:

2026.5.5

and:

2026.2.6

for the corresponding supported branches.

Therefore, do not deploy an affected older RAC version.

For a fresh installation, use the current official compose.yml:

wget https://docs.goauthentik.io/compose.yml

and keep authentik updated.

Also prefer credential prompting over storing privileged RDP passwords wherever practical.

Upgrade authentik

For modern authentik releases, download the Compose file corresponding to the newer release and recreate the stack.

A typical upgrade flow is:

cd /opt/authentik

cp compose.yml compose.yml.backup

wget -O compose.yml https://goauthentik.io/version/2026.5/lifecycle/container/compose.yml

docker compose pull
docker compose up -d

authentik's release documentation uses this model of downloading the updated Compose definition and running docker compose up -d.

Use the current supported release rather than blindly pinning the example 2026.5 version forever.

Backup

At minimum, back up:

PostgreSQL database
.env
Custom certificates
Custom templates/media
compose.yml

The most important authentik state resides in PostgreSQL.

Treat:

AUTHENTIK_SECRET_KEY

as a critical secret and include it in secure backups.

Useful Docker Commands

Check containers:

docker compose ps

Logs:

docker compose logs -f

Restart:

docker compose restart

Stop:

docker compose down

Start:

docker compose up -d

Pull images:

docker compose pull

RAC Troubleshooting

Application Appears but RDP Does Not Connect

Check the RAC outpost:

docker ps

Then check its logs:

docker logs <rac-container>

Verify RDP connectivity:

nc -vz 10.10.10.50 3389

Authentication Fails

Test the same Windows credentials using normal RDP from an internal machine.

Check:

Username
Password
Domain
Windows account permissions
Remote Desktop Users membership
NLA/security mode

For domain accounts:

XEON\user

or use:

Username: user
Domain:   XEON

depending on your RAC configuration.

Black Screen / Immediate Disconnect

Check:

Windows RDP service
Windows event logs
RAC outpost logs
RDP security setting
NLA requirements
Certificate/security negotiation

authentik notes that modern Windows servers may require:

security: tls

in the endpoint configuration.

Reverse Proxy WebSocket Support

RAC relies on WebSockets between the browser, authentik, and RAC infrastructure.

If authentication works but the actual desktop connection fails behind a reverse proxy, verify that the proxy supports and forwards WebSocket upgrades correctly.

Architecture:

Browser
   │
   │ WebSocket
   ▼
Reverse Proxy
   │
   │ WebSocket
   ▼
authentik
   │
   ▼
RAC Outpost

Recommended Final Deployment

                        Internet
                           │
                           ▼
                    HTTPS :443
                           │
                           ▼
                ┌──────────────────┐
                │ Reverse Proxy    │
                │ auth.example.com │
                └────────┬─────────┘
                         │
                         ▼
                ┌──────────────────┐
                │ authentik        │
                │                  │
                │ Docker Compose   │
                │                  │
                │ Server           │
                │ Worker           │
                │ PostgreSQL       │
                └────────┬─────────┘
                         │
                         ▼
                ┌──────────────────┐
                │ RAC Outpost      │
                │                  │
                │ Guacamole        │
                └────────┬─────────┘
                         │
                  Internal Network
                         │
          ┌──────────────┼──────────────┐
          │              │              │
          ▼              ▼              ▼
     ERP Server      SQL Server     Dev Server
   10.10.10.50     10.10.10.51   10.10.10.60
      :3389            :3389          :3389

Public firewall:

443 TCP    → Reverse Proxy/authentik

Internal firewall:

RAC Outpost → Windows Servers :3389

Do not expose:

3389

to the Internet.

Quick Installation

Install authentik

sudo mkdir -p /opt/authentik
sudo chown $USER:$USER /opt/authentik
cd /opt/authentik

wget https://docs.goauthentik.io/compose.yml

echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env

echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env

chmod 600 .env

docker compose pull
docker compose up -d

Open:

http://SERVER_IP:9000

Configure:

akadmin

Quick RAC Setup

In authentik:

Applications
    → Applications
    → New Application

Name:
Remote Desktop

Provider:
RAC

Then create:

Authorization Flow
    ↓
connection_settings.username
connection_settings.password
connection_settings.domain (optional)

Create endpoint:

Name:
ERP Server

Protocol:
RDP

Host:
10.10.10.50:3389

Create outpost:

Applications
    → Outposts
    → Create

Type:
RAC

Integration:
Docker

Application:
Remote Desktop

Then users access:

authentik
   ↓
Remote Desktop
   ↓
ERP Server
   ↓
RDP credentials
   ↓
Windows desktop in browser

Recommended Security Checklist

  • [ ] Use HTTPS for authentik.
  • [ ] Enable MFA for remote-access users.
  • [ ] Do not expose Windows RDP 3389 publicly.
  • [ ] Allow RDP only from the RAC outpost where possible.
  • [ ] Use endpoint policies to restrict server access.
  • [ ] Prefer RAC credential prompts instead of stored administrator passwords.
  • [ ] Protect .env and AUTHENTIK_SECRET_KEY.
  • [ ] Back up PostgreSQL.
  • [ ] Keep authentik and the RAC outpost updated.
  • [ ] Ensure RAC is at least on a version containing the 2026 RAC security fixes.
  • [ ] Verify WebSocket support on your reverse proxy.
  • [ ] Use separate Windows administrator accounts instead of shared credentials where possible.

References

authentik's official Docker Compose installation requires at least 2 CPU cores and 2 GB RAM, supports Docker Compose v2 or Podman, and uses the official compose.yml, .env PostgreSQL password, and authentik secret key installation workflow.

The official RAC documentation describes browser-based access to Windows, Linux, and macOS systems over RDP, SSH, and VNC using an RAC application, endpoints, an RAC outpost, and Apache Guacamole.

The official RAC setup workflow covers creating the application/provider pair, property mappings, individual endpoints, and the RAC outpost.

authentik documents a credential-prompt workflow specifically useful for modern Windows RDP connections, including connection_settings.username, connection_settings.password, optional connection_settings.domain, and RDP security configuration.

For RAC deployments, ensure the installation contains the current security fixes; authentik's advisory identifies 2026.5.5 and 2026.2.6 as patched versions for the affected branches.

Leave a comment

Your email address will not be published. Required fields are marked *