Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Open-Source Auth for NextJS / React

ory.dev

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Show HN: Open-Source Auth for NextJS / React

#11

Post by claystraw »

rapnie wrote: post #10

I found it hard to quickly determine whether Kratos can run completely self-hosted, or that there's always some connection to Ory / Ory Cloud services.

Both! :)

Ory Cloud is still in it's early phases and we have not been very good at communicating it well. Basically, we run Ory Kratos in Ory Cloud and it has full API and configuration and data compatibility with the version that is on GitHub! Our goal is to also allow users to easily switch from self-hosted to ory cloud and back - but it's still a bit of work until we get there.

If you just want to check our Ory Kratos and don't want to use the docker-compose command in the blog post, you can create an Ory Cloud account and use that instead of your local docker environment. That's basically the trade off you're making in a local environment. We have of course tons of plans for Ory Cloud but it's yet too early to share them with a broad audience.

We're currently focusing on gettin all of this much better communicated, and to make it easier to understand what the differences are. So totally get your confusion on it and can only say, we're working on making it better :) Hope this helped at least a little bit!

Re: Show HN: Open-Source Auth for NextJS / React

#12

Post by claystraw »

mjepronk wrote: post #8
claystraw wrote: post #3

Hello, one of the maintainers of https://github.com/ory/kratos (the system used in the blog post) here :) We started Ory Kratos because we saw so many developers struggle with OAuth2 and OpenID Connect. If you have any questions around application auth, OAuth2, or Go, open source I'll try to do my best to answer them accurately!

Thank you for working on this interesting open source product. I have some questions: - Is it possible to have multiple organizations in one single instance? Can I have some superusers that have access to all organizations? - Can I delegate authentication for a subset of users (in my case this will always be an entire organization) to another authentication provider (say Microsoft ADFS)? - Do you support SAML 2.0 cli…

Thank you for these questions! First of all I want to say that Ory Kratos is built for customer facing authentication first, so many of the enterprise requirements (e.g. LDAP integration) are still missing. Our vision is to build the de-facto open standard for auth, so enterprise IAM is on the roadmap. It just needs time & community feedback to get there :)

To answer your questions:

- Is it possible to have multiple organizations in one single instance? Can I have some superusers that have access to all organizations?

Depends how you interpret multiple organizations. If those are distinct users (meaning the same person has a profile in org A and org B and does not reuse them), so a true multi-tenant system, then this is not built in and we do not plan to add it.

Running Ory Kratos is very cheap in terms of resources (few MB of ram and no CPU on idle) so it's very affordable to spin up another instance. This doesn't work well for fully-automated deployments such as SaaS systems, but it does work if you are thinking about corporate systems.

You might also look for Ory Cloud, where you can deploy a new Ory Kratos instance with a simple API call.

- Can I delegate authentication for a subset of users (in my case this will always be an entire organization) to another authentication provider (say Microsoft ADFS)?

Yes! Right now we only support OpenID Connect and OAuth1/OAuth2 delegation but more to come.

- Do you support SAML 2.0 clients?

Not yet, but there's an active design document with discussions on different implementation scenarios.

- Do you have a REST API which can be used to create / deactivate users?

Creation - absolutely! Deactivation is not yet available as an API but identity state is already implemented, so adding it is really just a few lines of code.

There are also endpoints for revoking all active sessions which logs out users immediately of one to all systems.

Re: Show HN: Open-Source Auth for NextJS / React

#14

Post by claystraw »

chwzr wrote: post #13

hi, the nextjs integration looks all promising. Especially how fast it is integrated. I wonder if there is a smart way to automatically verify a session and get user details on one of my own api routes?

Yes absolutely, you can use the Ory SDK's `toSession()` function to resolve a Session Cookie (for browsers) or Session Token (for non-browsers, e.g. native mobile apps) to its identity.

We have on the list to add a section about using Next's new middleware feature to protect API routes. Is that something you'd be interested in?

Re: Show HN: Open-Source Auth for NextJS / React

#15

Post by chwzr »

claystraw wrote: post #14
chwzr wrote: post #13

hi, the nextjs integration looks all promising. Especially how fast it is integrated. I wonder if there is a smart way to automatically verify a session and get user details on one of my own api routes?

Yes absolutely, you can use the Ory SDK's `toSession()` function to resolve a Session Cookie (for browsers) or Session Token (for non-browsers, e.g. native mobile apps) to its identity. We have on the list to add a section about using Next's new middleware feature to protect API routes. Is that something you'd be interested in?

yes having the identity on hand by just looking up req.identity would be super neat feature!

Re: Show HN: Open-Source Auth for NextJS / React

#16

Post by p2hari »

claystraw wrote: post #7
arbobmehmood wrote: post #5

Looks neat. Will definitely check this out. May I know, how is this different from NextAuth?

I have not used NextAuth, so take my analysis with caution. As far as I can tell, NextAuth is similar to Passport.js as it offers many adapters to sign in with different providers (e.g. Twitch or Pipedrive). It is not an identity system though, so it does not have things like "update your profile info" or "link Google to this account". I think this manifests with missing password authentication. Even though that's no…

I think the part on DB adapters is right in the sense that NextAuth allows us to use whichever db persistence we need. But if that is handled by Ory. what Db does Ory use? Should we set up our own.?

Also, authentication and authorization are core for an app. If we do authentication here, how does authorization work? Can I bring my own authorization like oso etc.

Re: Show HN: Open-Source Auth for NextJS / React

#17

Post by joekrill »

For those looking for a comparison, this is like an alternative to KeyCloak, except you have to "bring your own UI" - which I see as a pro, not a con. I've been evaluating Kratos for some time now, implementing it in a React/Redux/RTK Query app, and I've been really impressed with it. It's still not on parity with the massive feature-set and customize-ability of KeyCloak, but it's getting there pretty quickly. As of the latest release I think it's finally in a state where it can be used in production with little friction. But I'm really looking forward to what the future holds.

Re: Show HN: Open-Source Auth for NextJS / React

#18

Post by bsid »

chwzr wrote: post #15
claystraw wrote: post #14

Earlier quoted context omitted.

Yes absolutely, you can use the Ory SDK's `toSession()` function to resolve a Session Cookie (for browsers) or Session Token (for non-browsers, e.g. native mobile apps) to its identity. We have on the list to add a section about using Next's new middleware feature to protect API routes. Is that something you'd be interested in?

yes having the identity on hand by just looking up req.identity would be super neat feature!

checkout - https://clerk.dev/solutions/nextjs-authentication, the middleware works like you're talking about. It's lighter weight than ory, i think. I've struggled to figure out how all of ory's pieces fit together, however their upcoming cloud offering may resolve some of those challenges!

Re: Show HN: Open-Source Auth for NextJS / React

#19

Post by joekrill »

rapnie wrote: post #10

I found it hard to quickly determine whether Kratos can run completely self-hosted, or that there's always some connection to Ory / Ory Cloud services.

It's completely self-hostable. You just need to provide a database (PostgreSQL, MySQL, CockroachDB). My impression is Ory Cloud is a hosted instance you can pay for instead of running it yourself (like using a hosted database solution instead of running your own, for example).

Re: Show HN: Open-Source Auth for NextJS / React

#20

Post by littlecranky67 »

claystraw wrote: post #7
arbobmehmood wrote: post #5

Looks neat. Will definitely check this out. May I know, how is this different from NextAuth?

I have not used NextAuth, so take my analysis with caution. As far as I can tell, NextAuth is similar to Passport.js as it offers many adapters to sign in with different providers (e.g. Twitch or Pipedrive). It is not an identity system though, so it does not have things like "update your profile info" or "link Google to this account". I think this manifests with missing password authentication. Even though that's no…

NextAuth has the credentials provider to allow username/password logins [0] - I use it in a project and it works okay-ish. However I too got a weird feeling when I read what the NextAuth team really thinks about a username/password login:

> The functionality provided for credentials based authentication is intentionally limited to discourage use of passwords due to the inherent security risks associated with them and the additional complexity associated with supporting usernames and passwords

I cannot disagree more. Using 3rd party auth has a lot of issues such as data privacy (requirement of stating that in your privacy/GDPR policy if you are in the EU), increased user support request when they cannot remember which auth provider they used, or the ever growing cases in which Facebook/Google/Whatnot decide to close someones account without possibility to appeal and effectively shutting them out of your App. Or the risk that if Google/FB/Github might not like your webapp, they can disable auth for your users with the flip of a switch. Me personally, I avoid 3rd party auth for those reasons alltogether.

[0]: https://next-auth.js.org/providers/credentials

Post reply on HN