July 2025 Summaries

Authentik is an open-source identity provider seeking to replace other platforms like Okta and Keycloak by integrating functionalities into a single platform. The blog post discusses the author's journey of implementing the Extensible Authentication Protocol (EAP) from scratch, highlighting challenges and learning experiences over multiple attempts. The motivation for this endeavor was to integrate EAP with authentik, which has an existing RADIUS server known for its basic, yet insecure, PAP authentication. The author elaborates on the intricacies of RADIUS and EAP protocols, the challenges faced in making them secure, and the quest to implement EAP-TLS, PEAP, and MSCHAPv2 protocols using Go, often addressing protocol nuances and limitations. The narrative includes personal insights into handling protocol parsing, testing with tools like Wireshark, and overcoming hurdles related to data encryption and multi-protocol negotiation. Despite the complexities and initially steep learning curve, the project was driven by a combination of professional curiosity and the aspiration to extend authentik’s functionality, culminating in the development of a standalone library for broader use.