privacyIDEA

Last reviewed Sep 13, 2026 · 845 words

privacyIDEA is not an identity provider, and the most common mistake I see is people installing it to get single sign-on. It does not do logins. It does the second step: given a user your existing directory already knows, it checks a TOTP code, a WebAuthn key, a push notification or a Yubikey, and says yes or no. If you want an SSO portal with 2FA built in, Authentik does both and you should start there. privacyIDEA is for the case where the login already exists, in Active Directory, a VPN, a RADIUS-speaking firewall or a Keycloak realm, and you need to bolt a strong second factor onto it without replacing anything.

The job is token management, and the token list is long

privacyIDEA is AGPL-3.0, Python, first released in 2014, with 1,771 GitHub stars at the time of writing, and it is developed by NetKnights in Germany with a paid enterprise support tier. The core object is a token attached to a user: TOTP and HOTP apps, WebAuthn and passkeys, Yubikey in OTP mode, push tokens through the project's own authenticator app, email and SMS codes, paper TAN lists for the person who lost their phone, and a registration token that lets a user enrol their own. One user can have several, and policies decide which are accepted where.

Users come from resolvers: LDAP and Active Directory, SQL tables, SCIM, or a flat file. privacyIDEA never stores passwords for those users; it stores tokens and asks the resolver who the user is. That is also why a small directory like LLDAP pairs well with it: LLDAP holds the users, privacyIDEA holds the factors.

Where the second factor plugs in

The integration list is the reason enterprises run it, and it is where a homelab decides whether the tool is worth having. The main routes are:

The RADIUS plugin turns FreeRADIUS into a 2FA gateway, which covers OpenVPN, WireGuard front-ends that speak RADIUS, most enterprise firewalls and Wi-Fi 802.1X. The PAM module adds a second factor to SSH and console logins. The Keycloak plugin inserts privacyIDEA as an authentication step in a Keycloak flow, so every application behind Keycloak gets hardware keys and push without changes. There are also plugins for SimpleSAMLphp, Shibboleth, ADFS, and a Windows credential provider in the enterprise tier.

The pattern is always the same: something else authenticates the password, then calls privacyIDEA's REST API with the username and a second-factor value. If nothing in your stack speaks RADIUS, PAM or Keycloak flows, you have no place to plug it in, and that is the honest test for whether you need it.

Policies are the real configuration surface

Setup is Medium difficulty, and the difficulty is not the install. The Docker image or a pip install on a VM with MariaDB or PostgreSQL behind it takes 30 minutes and runs in 512 MB. The work is the policy engine: scope-based rules that say which realms may enrol which token types, whether users can self-enrol, how many failed attempts lock a token, which admins may see which realm, and what happens when a user has no token at all (deny, or pass through, which is the migration setting). Get the policies wrong and you either lock out the CEO or silently let everyone through. Write them down before you click, and test with a throwaway user in every realm.

What Authentik and Keycloak already cover

Both Authentik and Keycloak ship TOTP and WebAuthn out of the box, and for an application you access through a browser behind one of them, that is enough. The Authentik versus Authelia writeup covers that whole tier. privacyIDEA becomes worth its own service when at least one of these is true: you need RADIUS-based 2FA for a VPN or Wi-Fi; you need push or Yubikey tokens managed centrally across several different login systems; you have an audit requirement to see every token, its enrolment date and every use; or you are replacing Duo and want feature parity rather than a subset. The identity category has the rest of the stack.

What I'd do

If my only need were 2FA on web apps, I would run Authentik and stop. If I had a VPN or a firewall that speaks RADIUS, or several unrelated login systems that all need the same hardware keys, I would run privacyIDEA on a small VM with PostgreSQL, point it at LLDAP or AD, write the policies before enrolling anyone, and put FreeRADIUS in front. It is a specialist, it is well maintained, and it is the closest thing to a self-hosted Duo that exists. Just do not install it looking for a login page.