Show HN: Oathkeeper – Cloud-Native Identity and Access Proxy

The idea of the ory ecosystem ( https://github.com/ory / https://www.ory.am ) is to build a reliable, cloud native suite of tools which allow you to solve simple and complex IAM (identity and access management) use cases. Each service works standalone, but you can obviously combine them all.

The Oathkeeper proxy is one piece of the puzzle which basically takes incoming HTTP requests, evaluates them on a set of rules (e.g. authentication of credentials used, checking if the user has the right permissions, transforming the session data to a e.g. JWT) and either grants or denies access.

Other services include, for example, ORY Hydra ( https://github.com/ory/hydra ) which is an OAuth2 & OpenID Connect (certification pending) server that you can put "on top" of your existing user management.

While most developers opt to build these systems (permissions, user management) themselves, it is our vision to build a reliable, broadly adopted set of OSS tools that get you started quickly and that scale well as the requirements of your organization change.

Everything we do is build on top of open standards, we do not want to reinvent the wheel (unless nothing exists wrt to open standards). So everything in this ecosystem integrates well with existing systems.

If you have any questions, feel free to ask.

ps: New account because I lost my password and didn't set up a backup email. Stupid me.

I have not used envoy extensively yet, but there are obviously many more options such as Apache2 + mod_oidc, Kong + oauth2 plugin, and so on.

The main differentiator is that Oathkeeper is capable of performing more sophisticated permission checks (think RBAC / AWS IAM Policies) and is specifically geared towards solving authentication and authorization in front of "your" service.

Most other implementations I saw (and I think this also goes a bit for envoy) is that they solve access control as one of the things in the feature set, while also focusing strongly on routing, load balancing, and other typical API gateway issues.

We're explicitly not trying to build another API gateway but instead something that you deploy alongside your existing API gateway (or maybe as a sidecar) with the sole purpose of checking answering: "is the request that's coming through really allowed to perform that action?".

Hope this clarifies it, if not I'm more than happy to go into more detail :)

I just wrote a simple proxy myself that takes an OIDC authenticated user and forwards the request to backend servers if their session is valid. It only took me two days to get this proxy functionality up and running, but of course the main application itself was handling all of the authentication, authorisation and session stuff already.

It's good to know there's an option to do this in the future for projects that don't have all that groundwork done already, if this is easy to set up – at least initally – without having to include all the parts of the ecosystem.

Nice, I have heard about Ambassador before but did not have the time to look into it in detail. It is just amazing how much OSS is being created around the k8s/container ecosystem and I truly believe that it will greatly improve our lives as developers in the future.

I've added this to our internal list and we will check it out and see if any synergies are possible with our products. Our vision is that these services work so well and easy with the rest of the ecosystem, that you can get started with a new project in a day or two and have everything set up - from users, to permissions, to routing (e.g. via ambassador), to testing (there's still ton of space for this), and so on.

I think the journey of software development beyond 2020 will be very exciting!

ps: Sorry for slow responses, HN has a very high post wait time once you hit the limit. And thank you for the positive vibes :)

I was just speaking with Datawire/Ambassador CEO in their slack about Oathkeeper... you should reach out and speak with them. Interesting synergies IMO.