Are there plans for handling multi-tenancy? Sort of like with Keycloak's realms.
Show HN: Ory Kratos – Open-source identity server written in Go
41–50 of 67 posts
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#42Quick question: how does this differ from keycloak? Are they competing products or do they work fundamentally differently?
Keycloak is more feature packed than the Ory stack. Ory is thinner than Keycloak.
Keycloak is heavy to learn but once you know it, everything is easy. It’s amazingly configurable. It has everything: saml, openid, federation, roles, groups, mappers, extensibility, authorisation services, configurable flows, …
What I like about Ory: thin components. Starts really fast, go binaries with zero dependencies.
What I didn’t like: extension points are inflexible and everything is a http call. Integration is a pita. Say you have hydra and kratos. You want kratos login but then use hydra tokens to fetch data from keto. Good luck writing the glue code.
Kratos has two things Keycloak could borrow: json identities with schemas and external ui pluggability. If Keycloak had those two, I’d never look back.
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#43Does ORY actually have 2FA yet? I remember the last time I checked it out it was pretty off putting that they advertised 2FA in the marketing material and Readme but it wasn’t actually there.
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#44I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…
In the .NET world, while no longer free (still is open source), there is https://duendesoftware.com/.
The folks behind the company and libraries know what they're doing.
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#45One of the co-maintainers here. Ory Kratos has been in development since 2018 and is finally out of beta! If you have any questions about the project, tech, flows, or Ory as a whole I’m here to help :)
Is there an UI for the identity management like defining roles and assigning identities to roles? I see the API part. But is there an UI part, besides the self-service account management? Because that general management interface is the missing piece in many of the identity services.
This was one of the primary reasons I ended up going with Keycloak, it's "batteries included" as far as UI goes.
UI for management, impersonation, configuration, etc... with RBAC, end-user UI for account preferences, profile, login, password reset, etc... all customizable/themeable.
With the switch to quarkus, is has a much more "single binary" feel and is very easy to deploy / configure.
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#46Does ORY actually have 2FA yet? I remember the last time I checked it out it was pretty off putting that they advertised 2FA in the marketing material and Readme but it wasn’t actually there.
Yes! WebAuthn, TOTP, Recovery Codes, MFA Policies - it’s all there :)
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#47I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…
In the .NET world, while no longer free (still is open source), there is https://duendesoftware.com/ . The folks behind the company and libraries know what they're doing.
It's tiring to see this discussion topic pop up again and again and again, but: the Duende software is decidedly not open source. You can read the code, but that's it. They don't seem to be making such claims themselves either.
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#48One of the co-maintainers here. Ory Kratos has been in development since 2018 and is finally out of beta! If you have any questions about the project, tech, flows, or Ory as a whole I’m here to help :)
Is there an SSO for api/rpc just like how github cli (gh) did their auth (gh auth login)? I've been looking for simple tutorials on how to get started with a bunch of openid libraries, and still not sure how to get it working with ory. I didn't proceed spelunking github code and end up settling on session management.
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#49I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…
In the .NET world, while no longer free (still is open source), there is https://duendesoftware.com/ . The folks behind the company and libraries know what they're doing.
https://github.com/DuendeSoftware/IdentityServer/blob/main/L... does not seem to square with any definition of "open source" I'm familiar with, and that goes double for having an in-repo file that just says "read this unversioned pdf on some other site"
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#50One of the co-maintainers here. Ory Kratos has been in development since 2018 and is finally out of beta! If you have any questions about the project, tech, flows, or Ory as a whole I’m here to help :)
Hey, I've seen the project in the past and it's very interesting, and definitely an improvement over existing alternatives. That said, I have one complaint quite unrelated to tech itself: I think the liberal use of the term "identity" is very inappropriate. Of course "identity" is an extremely hard term to even define , but as far as I can see ory kratos is only assisting with email and phone verification. To talk ab…
I usually understand "Identity" in the context of authentication and authorization to mean "who is the person or process trying to access the service", what do you think is inappropriate about this use of the word? Or another way to put it, from what should it be disambiguated?