I am using authelia as well for some time. At some point I was looking into kanidm. It looked promising, but never got into actually using it. I never figured out though, whether they support forward header auth.