Skip to content

0055. Migrate paperless-ngx to allauth OIDC with Authentik

  • Status: proposed (auto-drafted by adr-suggester)
  • Date: 2026-07-27
  • Deciders: lusoris
  • Related: PR #3216

Context

The PR changes the authentication mechanism of paperless-ngx from using a remote user header proxy to a native allauth OpenID Connect setup with Authentik. This involves removing existing proxy configurations, updating application settings, and introducing new configurations for Authentik.

Decision

Replace the remote user header-based authentication with native allauth OIDC integration, updating both application and Authentik configurations to support secure, group-aware SSO.

Alternatives considered

TBD — fill in before flipping Status to Accepted.

Consequences

TBD — fill in before flipping Status to Accepted.

References

  • PR #3216 — fix(paperless): allauth OIDC login via Authentik (BUG-23)