September 2026 Summaries

authentik, an open-source identity provider, reports that version 2026.8 has received OpenID Foundation certification for multiple OpenID Connect provider profiles and RP-Initiated, Front-Channel, and Back-Channel logout profiles. The certification process, pursued since 2023, used the Foundation’s conformance suite to identify minor specification gaps, including support for the required prompt=login behavior, while also highlighting the value of independently verified standards compliance for interoperability and debugging. Because certification applies only to a specific release, authentik runs the suite automatically on every pull request using its own browser automation and test instances, although these lengthy checks are currently non-blocking. The company also tests emerging features such as Shared Signals Framework, Dynamic Client Registration, token exchange, on-behalf-of flows, and key binding, some of which lack completed or available certification tests, and plans to expand its certified coverage as those programs mature.

authentik 2026.8 expands the open-source identity provider with enterprise privileged access management, delegated agent accounts for automation and AI services, browser-based account switching, scheduled user offboarding, customizable directory object attributes, and self-hosted event maps for restricted environments. The release also earns OpenID Certified status and adds substantial OAuth 2.0 and OpenID Connect capabilities, including token exchange, on-behalf-of delegation, dynamic client registration, and key-bound ID tokens. Other enhancements include nested LDAP group synchronization, expiring access bindings, PostgreSQL transaction-pooler support, Rust rewrites of the server entrypoint and proxy outpost, improved task reporting, a dashboard list view, expanded CAPTCHA support, and Microsoft 365 integration through WS-Federation. It introduces more than 40 application integration guides, while upgrade considerations include a safer interactive password-hashing command, removal of a WebAuthn duplicate-device setting, and deprecation of custom PostgreSQL connection options.