Then, you have to authenticate against Authelia/Authentik and a second time at the service via username and password usually.

FYI that at least in Authentik you can avoid the second login. Check the instructions they have on setting up Sonarr for more details, but you can save the app credentials in Authentik, then if your identity is authorized for access Authentik will automatically attach the credentials for the app: https://goauthentik.io/integrations/services/sonarr/

Works for anything that has http basic auth