Skip to main content

Nauthilus 4.0 is here: see what's new

One central policy engine
for authentication and authorization.

Mail servers, web applications, identity flows and APIs no longer decide alone. Nauthilus collects the facts behind every request (identity, network, reputation, brute-force history, MFA state) and returns one consistent decision, with the obligations to enforce it.

Get started ▶ Watch the 76-second tour

Nauthilus in 76 seconds

Who decides?

Today every service decides alone: different lockouts, different MFA rules, different blind spots. Here is what changes when one engine makes the call.

How it works

Facts in. Decision out.

Declarative policies evaluate the facts at each checkpoint of a request and answer with a clear verdict and the obligations that go with it. Try new rules in observe mode first, then enforce them once you trust them.

user@corp.example
IP · geo · ASN
brute-force history
blocklists (RBL)
LDAP attributes
MFA state

Policy engine

DecisionALLOW+ step-up MFA · audit
DecisionDENY+ rate-limit source · audit
DecisionTEMPFAIL+ retry later · backend degraded

Same rules. Every service. Every time.

Read the policy configuration guide →

Integrations

One engine. Every entry point.

IMAP · POP3 · SMTP

Mail authentication

Dovecot, Postfix and Nginx mail proxies ask Nauthilus before a session starts, so every mail login follows the same rules.

OIDC · SAML 2.0 · WebAuthn

Native identity provider

Browser sign-in, consent and MFA for your web applications, with the policy engine deciding on every step.

REST · gRPC · Policy API

HTTP services & APIs

Reverse proxies and web apps authenticate over HTTP or gRPC, and any other service can ask the generic Policy API for a decision.

gRPC identity proxy

Distributed edges

Edge instances forward identity and policy questions to a central authority, so remote sites decide like headquarters.

Why Nauthilus

Observable. Safe to change live. Open source.

Built for hostile traffic

Brute-force protection, realtime blocklists, reputation and password-leak checks feed the decision as facts, so attacks are stopped consistently on every protocol instead of service by service.

Policies you can trust

Declarative rules per checkpoint, explicit allow, deny and tempfail outcomes, and obligations such as step-up MFA. Observe mode shows what a rule would do before it is allowed to enforce.

Identity and MFA built in

A native OIDC and SAML 2.0 identity provider with consent, dynamic client registration, TOTP, WebAuthn and recovery codes, all governed by the same policy engine.

Facts from your infrastructure

LDAP and Active Directory, Lua and remote backends supply identities and attributes. Redis-backed caches for positive password checks and identity lookups keep the directory load low.

Extend it your way

Native Go plugins and an extensive Lua API add your own facts, checks and actions without forking the server. Plugin configuration reloads on SIGHUP.

Observable and ready to scale

Prometheus metrics, OpenTelemetry tracing and Grafana dashboards show every decision. Redis, Sentinel and Cluster support plus Docker and Kubernetes images make it run anywhere.

Running it in production?

Enterprise support. Directly from the maintainer.

Architecture
Integration
Customization
Troubleshooting

support@nauthilus.com Source code on GitHub

Nauthilus is open source under the GPLv3, written in Go. You can also sponsor its development.