Integrate with Kimai
Support level: Community
What is Kimai?
Kimai is a free and open source time-tracking application for recording work time and reporting it by customer, project, activity, and user.
Preparation
The following placeholders are used in this guide:
kimai.companyis the FQDN of the Kimai installation.authentik.companyis the FQDN of the authentik installation.admin.groupis the name of the authentik group whose members should receive the Kimai administrator role.
This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.
authentik configuration
To support the integration of Kimai with authentik, you need to create an application/provider pair in authentik.
Kimai imports SAML users during their first login. To assign Kimai roles from authentik group membership, configure the role mappings in the Kimai local.yaml file in the next section.
Create an application and provider
authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the Issuer value to: https://authentik.company/application/saml/<application_slug>/metadata/
Older versions of authentik set this value to authentik by default. If you're running an older version, please set Issuer to https://authentik.company/application/saml/<application_slug>/metadata/, where <application_slug> is the slug that you selected for the application.
-
Log in to authentik as an administrator and open the authentik Admin interface.
-
Navigate to Applications > Applications and click New Application to open the application wizard.
- Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the slug value because it will be required later.
- Choose a Provider type: select SAML Provider as the provider type.
- Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
- Set the ACS URL to
https://kimai.company/auth/saml/acs. - Set the SLS URL to
https://kimai.company/auth/saml/logout. - Set the SLS Binding to
Redirect. - Set the Logout Method to
Front-channel (Iframe). - Set the Audience to
https://kimai.company/. - Set the Service Provider Binding to
Post. - Under Advanced protocol settings:
- Select an available Signing certificate.
- Set NameID Property Mapping to
authentik default SAML Mapping: Email. - Set Default NameID Policy to Email address.
- Set the ACS URL to
- Configure Bindings (optional): create a binding (policy, group, or user) to control which users can access the Kimai application from the Application Dashboard page.
-
Click Submit.
Download the signing certificate
- Log in to authentik as an administrator and open the authentik Admin interface.
- Navigate to Applications > Providers and click on the name of the newly created Kimai provider.
- Under Related objects > Download signing certificate, click Download. The certificate content is required in the next section.
Kimai configuration
Paste the following block in your local.yaml file, after replacing the placeholder values from above. The file is usually located in /opt/kimai/config/packages/local.yaml.
For x509cert, open the authentik signing certificate in a text editor and paste the full certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
kimai:
saml:
provider: authentik
activate: true
title: Log in with authentik
mapping:
- {
saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress,
kimai: email,
}
- {
saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name,
kimai: alias,
}
roles:
resetOnLogin: true
attribute: http://schemas.xmlsoap.org/claims/Group
mapping:
# Insert your roles here (ROLE_USER is added automatically)
- { saml: admin.group, kimai: ROLE_ADMIN }
connection:
idp:
entityId: "https://authentik.company/application/saml/<application_slug>/metadata/"
singleSignOnService:
url: "https://authentik.company/application/saml/<application_slug>/"
binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
singleLogoutService:
url: "https://authentik.company/application/saml/<application_slug>/"
binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
x509cert: |
-----BEGIN CERTIFICATE-----
<certificate contents from authentik>
-----END CERTIFICATE-----
sp:
entityId: "https://kimai.company/"
assertionConsumerService:
url: "https://kimai.company/auth/saml/acs"
binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
singleLogoutService:
url: "https://kimai.company/auth/saml/logout"
binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
# privateKey: ""
# only set baseurl, if auto-detection doesn't work
baseurl: "https://kimai.company/auth/saml/"
strict: false
debug: true
security:
nameIdEncrypted: false
authnRequestsSigned: false
logoutRequestSigned: false
logoutResponseSigned: false
wantMessagesSigned: false
wantAssertionsSigned: false
wantNameIdEncrypted: false
requestedAuthnContext: true
signMetadata: false
wantXMLValidation: true
signatureAlgorithm: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
digestAlgorithm: "http://www.w3.org/2001/04/xmlenc#sha256"
contactPerson:
technical:
givenName: "Kimai Admin"
emailAddress: "admin@example.com"
organization:
en:
name: "Kimai"
displayname: "Kimai"
url: "https://kimai.company"
Afterwards, rebuild the Kimai cache or restart the Docker container.
Enable single logout (optional)
Kimai's SAML logout endpoint is only reachable through the Symfony firewall. By default, Kimai points the firewall's logout path at its own local logout route, so https://kimai.company/auth/saml/logout never processes the logout request that authentik sends, and the Kimai session survives.
Kimai also enables always_remember_me by default. Even after the logout request is processed correctly, Kimai reissues its REMEMBERME cookie during the logout redirect, which signs the user back in on their next request and makes the logout appear to have no effect.
To let authentik end Kimai sessions, add the following block to the same local.yaml file. This changes the firewall's logout path to the SAML route and stops Kimai from issuing a persistent login cookie:
security:
firewalls:
secured_area:
logout:
path: /auth/saml/logout
target: homepage
enable_csrf: false
remember_me:
secret: "%kernel.secret%"
lifetime: 604800
path: /
always_remember_me: false
Restart Kimai, then confirm that both settings applied:
php bin/console debug:config security firewalls
The logout section should report path: /auth/saml/logout, and the remember_me section should report always_remember_me: false.
Disabling always_remember_me means users are no longer kept signed in to Kimai across browser sessions. If you need persistent logins, keep the setting enabled and accept that authentik cannot fully end a Kimai session.
Changing the firewall's logout path also changes what Kimai's own Log out button does, because both use the same path. Kimai's local logout route no longer has a controller behind it and returns an error when opened directly.
Configuration verification
To confirm that authentik is properly configured with Kimai, open Kimai, log out, and click Log in with authentik. You should be redirected to authentik to log in and then redirected back to Kimai. If you configured single logout, log out of authentik. Your browser passes through the Kimai logout endpoint on the way, and reloading Kimai returns you to its login page.