Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Ory Kratos – Open-source identity server written in Go

github.com

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#22

Post by smcl »

I think "Identity Provider" is more correct, no? "IdentityServer" is the name of a specific IdP implemented in .NET (formerly OSS as https://identityserver4.readthedocs.io/en/latest, and now as a more commercial form as Duende IdentityServer: https://duendesoftware.com/products/identityserver)

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#24

Post by slx26 »

baconfly wrote: post #2

One of the co-maintainers here. Ory Kratos has been in development since 2018 and is finally out of beta! If you have any questions about the project, tech, flows, or Ory as a whole I’m here to help :)

Hey, I've seen the project in the past and it's very interesting, and definitely an improvement over existing alternatives. That said, I have one complaint quite unrelated to tech itself: I think the liberal use of the term "identity" is very inappropriate. Of course "identity" is an extremely hard term to even define, but as far as I can see ory kratos is only assisting with email and phone verification. To talk about "identity" on that context seems very out of place to me. Maybe there's more that I've missed, and if that's the case I'm sorry. I understand words have more than one meaning, but there are big challenges to solve with regards to identity in the digital world that as far as I can see ory doesn't try to solve at all, and we end up spending time reading through the docs and trying to see if someone is making a meaningful contribution to the field for nothing. I know competitors use the term irresponsibly too, but... nevermind.

Sorry for the rant and what may sound like a very negative comment, I wrote this quickly. I think it would be great to right away stop using the term "identity" so freely and use something else, or at least clearly explain what do you understand for identity. I think it would be great for programmers to start disambiguating the concept, and I think projects like ory have a good opportunity (that you yourselves created and built, of course!) to make it a bit better.

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#25

Post by jjice »

As someone who knows very little about serious identity management, does something like Ory handle the auth part (in a variety of schemes), and then your application interacts with Ory somehow to validate the auth? I guess I'm most confused about where the connection between Ory and the application server is.

I've only ever dealt with auth a monolith with sessions, so I'm pretty blind here.

Any resource anyone would recommend would also be greatly appreciated!

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#26

Post by redconfetti »

baconfly wrote: post #16
PinguTS wrote: post #10

Earlier quoted context omitted.

Is there an UI for the identity management like defining roles and assigning identities to roles? I see the API part. But is there an UI part, besides the self-service account management? Because that general management interface is the missing piece in many of the identity services.

The system is API only (headless) but we have reference implementations available. For a management UI you can use Ory Cloud :) For permissions, that’s a different service: https://github.com/ory/keto

It's nice to know there is an existing interface available, however one can drop it altogether and adopt an alternative, or create their own.

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#27

Post by VWWHFSfQ »

yilugurlu wrote: post #21

I know stating this silly, but it really bugs me seeing the link below at GitHub repo page. https://www.ory.sh/kratos/?utm_source=github&utm_medium=bann...

you don't think they should be allowed to know the source of link clicks to their website

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#29

Post by Perseids »

skrtskrt wrote: post #8

I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…

As I've opined here [1] I think OIDC is not a good example for an authentication protocol. As you are already into spec reading, you could take a look how SSH and TLS 1.3 (especially mutually authenticated TLS) handle the same topic. (All available freely as IETF RFCs.) And if you're interested in the cryptography, your can't go wrong with Cryptography Engineering (ISBN: 978-0470474242) by Ferguson, Schneier and Kohno.

[1] https://news.ycombinator.com/item?id=31259826

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#30

Post by breton »

jjice wrote: post #25

As someone who knows very little about serious identity management, does something like Ory handle the auth part (in a variety of schemes), and then your application interacts with Ory somehow to validate the auth? I guess I'm most confused about where the connection between Ory and the application server is. I've only ever dealt with auth a monolith with sessions, so I'm pretty blind here. Any resource anyone would…

> I guess I'm most confused about where the connection between Ory and the application server is.

There might be none. The response from an identity provider (Ory) is signed and encrypted, is given to the user who is being authenticated and then the user brings it to the application. The process usually happens via browser redirects, but can be more manual. The response contains information about who the user is, their identifiers and properties. It is totally possible to have a scenario where the application is air-gapped.

There might be some interaction if the application wants to enrich the passed response.

I cannot suggest any books, but you could search about SAML2, OpenID Connect (oidc), identity providers and service providers.

Post reply on HN