Skip to main content
← Back to Insights
Security 10 min read

Setting Up SSO for Small Teams: A Practical Guide

Single Sign-On is not just for enterprises anymore. Learn how to implement SSO for your small business or startup using self-hosted solutions that will not break the bank.

TI
Tom Isgren

Your team has grown to 15 people. Everyone has accounts on Slack, GitHub, your project management tool, the company wiki, email, and half a dozen other services. Each with its own password. Each password either forgotten weekly or written on a sticky note.

Single Sign-On solves this. One login, one password, access to everything. And contrary to what enterprise software vendors want you to believe, you don't need a six-figure budget to implement it.

Why SSO Matters for Small Businesses and Startups

SSO isn't just about convenience (though that's nice). It solves real security and operational problems that hit small teams harder than you'd expect.

Offboarding in Minutes

When someone leaves, disable one account and they lose access to everything. No more hunting through 20 different services hoping you didn't miss one.

Consistent Security Policies

Enforce password complexity, multi-factor authentication, and session timeouts from one place. No more hoping everyone enabled MFA on each individual service.

Fewer Password Resets

One password to remember means fewer "forgot password" emails and less time spent on IT support. Your team can actually focus on work.

Audit Trail

See who accessed what and when, all in one log. Essential for compliance, useful for troubleshooting, and good to have if something goes wrong.

Self-Hosted SSO Options

Enterprise SSO providers like Okta or Azure AD charge per user per month. For a 20-person team, you're looking at $2,000-5,000 annually before you even start. Self-hosted alternatives give you the same functionality for the cost of a small server.

Authentik

Our go-to recommendation for small teams. Authentik is a modern identity provider that supports SAML, OAuth2/OIDC, and LDAP. The interface is clean, documentation is solid, and it runs well on modest hardware.

SAML 2.0 OAuth2/OIDC LDAP SCIM WebAuthn/FIDO2

Keycloak

The most mature open-source option, backed by Red Hat. More complex to configure than Authentik, but extremely powerful. Better suited if you have Java expertise on your team or need advanced federation features.

Enterprise-grade Identity brokering User federation Fine-grained auth

Authelia

Lightweight option focused on protecting web applications behind a reverse proxy. Great for adding SSO to apps that don't natively support it. Less feature-rich but simpler to deploy.

Lightweight Proxy-based TOTP/WebAuthn Simple setup

Setting Up Authentik: Step by Step

Let's walk through setting up Authentik, since it offers the best balance of features and simplicity for small teams.

1

Deploy with Docker Compose

Authentik provides an official Docker Compose file. You'll need a server with at least 2GB RAM and Docker installed. 

# Download the docker-compose.yml
wget https://goauthentik.io/docker-compose.yml

# Create a .env file with secrets
echo "PG_PASS=$(openssl rand -base64 36)" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 36)" >> .env
echo "AUTHENTIK_BOOTSTRAP_PASSWORD=changeme" >> .env
echo "AUTHENTIK_BOOTSTRAP_EMAIL=admin@example.com" >> .env

# Start Authentik
docker compose up -d
2

Configure Your Domain

Point a subdomain like auth.yourdomain.com to your server. Set up TLS certificates (Let's Encrypt works perfectly). Authentik should only ever be accessed over HTTPS.

3

Create Users and Groups

Log in to the admin interface, create your team members as users, and organize them into groups. Groups make permission management easier—you can grant application access to "Engineering" rather than individual users.

4

Set Up MFA

Enable multi-factor authentication and require it for all users. Authentik supports TOTP (authenticator apps), WebAuthn (hardware keys), and SMS (not recommended). Push this requirement from day one—retrofitting MFA later is painful.

5

Connect Your Applications

For each application, you'll create a "Provider" (how Authentik speaks to the app) and an "Application" (what users see). Most modern apps support OAuth2/OIDC. Legacy apps might need SAML. Some need LDAP integration.

Common Integration Patterns

Different applications integrate with SSO in different ways. Here's what to expect:

Apps with Native SSO Support

Services like Grafana, GitLab, Nextcloud, and most modern SaaS apps have built-in OAuth2 or SAML support. Configuration is straightforward: create credentials in Authentik, enter them in the app's SSO settings.

Examples: GitLab, Grafana, Nextcloud, Mattermost, Outline, n8n

Apps Behind a Proxy

Some apps don't support SSO natively but can trust authentication headers from a reverse proxy. Authentik's forward auth feature integrates with Traefik, nginx, and Caddy to protect these apps.

Examples: Legacy internal tools, simple web apps, documentation sites

Apps Requiring LDAP

Older enterprise software often only supports LDAP authentication. Authentik provides an LDAP outpost that presents your users and groups in an LDAP-compatible format.

Examples: Some VPNs, older wikis, legacy enterprise software

Security Best Practices

Your SSO system becomes the keys to your kingdom. Protect it accordingly.

→ Require MFA for everyone. No exceptions. A compromised SSO account with no MFA means every connected application is compromised.
→ Separate admin accounts. Your daily work account shouldn't be an Authentik admin. Use dedicated admin accounts with extra security controls.
→ Regular backup testing. Back up your Authentik database and test restores. If your SSO goes down, nobody can access anything.
→ Monitor login attempts. Set up alerts for failed logins, logins from new locations, and admin actions. Authentik provides audit logs—use them.
→ Have a break-glass procedure. Document how to access critical systems if SSO is unavailable. Store these credentials securely (encrypted, offline, known to multiple people).
→ Keep it updated. SSO systems are high-value targets. Apply security patches promptly.

Planning Your Rollout

Don't try to SSO-enable everything at once. A phased approach reduces disruption and lets you learn as you go.

Suggested Rollout Order

1

Internal tools first

Wiki, documentation, internal dashboards. Low risk if something breaks, good practice ground.

2

Development tools

Git, CI/CD, project management. Your team uses these daily—SSO here shows immediate value.

3

Communication tools

Chat, email (if self-hosted). These benefit from centralized access control.

4

Production systems

Monitoring, infrastructure access. Do these last, with extra care and testing.

What About External SaaS?

Many SaaS applications support SSO—but often only on expensive enterprise plans. This is where you need to make pragmatic choices.

Worth the Enterprise Upgrade

  • ✓ Services with sensitive data access
  • ✓ High user turnover applications
  • ✓ Compliance-critical systems

Alternatives to Consider

  • → Self-host where possible
  • → Use password manager for non-SSO apps
  • → Choose vendors that include SSO

Getting Started

SSO is one of those investments that pays dividends immediately. Less password fatigue for your team, better security posture, easier onboarding and offboarding, and a foundation for more sophisticated access controls as you grow.

Start with Authentik, connect your most-used internal applications, and expand from there. Within a day you can have a working SSO setup that rivals what enterprises pay thousands for.

Need help implementing SSO? We specialize in setting up self-hosted identity management for small teams. From initial deployment to application integration, we can get your SSO running smoothly. Get in touch →