Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Ory Kratos – Open-source identity server written in Go

github.com

Post reply on HN
Print view View original

51–60 of 67 posts

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#51

Post by slx26 »

j0057 wrote: post #50
slx26 wrote: post #24

Earlier quoted context omitted.

Hey, I've seen the project in the past and it's very interesting, and definitely an improvement over existing alternatives. That said, I have one complaint quite unrelated to tech itself: I think the liberal use of the term "identity" is very inappropriate. Of course "identity" is an extremely hard term to even define , but as far as I can see ory kratos is only assisting with email and phone verification. To talk ab…

I usually understand "Identity" in the context of authentication and authorization to mean "who is the person or process trying to access the service", what do you think is inappropriate about this use of the word? Or another way to put it, from what should it be disambiguated?

A user account, an email or a phone number do not uniquely identify a person or process, and it doesn't tell you whether it's actually a person or a process.

Edit: "account" may not fully capture everything ory might be trying to do, but it's definitely closer than "identity".

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#52

Post by davedx »

baconfly wrote: post #2

One of the co-maintainers here. Ory Kratos has been in development since 2018 and is finally out of beta! If you have any questions about the project, tech, flows, or Ory as a whole I’m here to help :)

Using it professionally at my current client, seems solid so far. Good work!

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#53

Post by moooo99 »

The Ory suite seems like quite an amazing project! I have read through quite a bit of the documentation and I really appreciate the in depth yet understandable explanations of Auth, OIDC and OAuth 2. Unlike other providers that just want to show you how to integrate their solutions, the Ory docs feel like the people who wrote it actually want to make me understand identity management!

The only wish I have, especially as a beginner developer: please make it easier to understand how your solution (especially Kratos as a non-standard) is integrated in my project. Many of the blog posts and tutorials only show how to authenticate and use the flows Ory provides, but it took quite a while to find examples how the backend with the application logic actually fits into the picture.

Other than that, I really like where this project is going. I'll definitely check out the cloud offer. Excited to see what this project will become!

For anyone also looking for examples to learn from, here is what I found

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#54

Post by prisout64 »

atonse wrote: post #41

Are there plans for handling multi-tenancy? Sort of like with Keycloak's realms.

It probably depends how many tenants you are looking at. If you have <100 or so you can deploy a kratos instance for each. With many more there is the managed Ory Cloud solution or you can build something bespoke with Ory Hydra (OAuth2 server).

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#55

Post by ownagefool »

baconfly wrote: post #2

One of the co-maintainers here. Ory Kratos has been in development since 2018 and is finally out of beta! If you have any questions about the project, tech, flows, or Ory as a whole I’m here to help :)

We use hydra. Very interested in Kratos. Thanks for the contribution. :)

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#56

Post by d_watt »

tinco wrote: post #34
breton wrote: post #30

Earlier quoted context omitted.

> I guess I'm most confused about where the connection between Ory and the application server is. There might be none. The response from an identity provider (Ory) is signed and encrypted, is given to the user who is being authenticated and then the user brings it to the application. The process usually happens via browser redirects, but can be more manual. The response contains information about who the user is, the…

Just to clarify, as not everyone is familiar with service based architecture: When the application server is air-gapped from the identity provider, it is meant that your frontend application will have user information embedded in the requests it makes. For example by setting a JWT in the headers or in a cookie when it's a web application. Even the responsibility of validating that information can be extracted from th…

I know this is the discussion as old as JWTs, but the tradeoff here is how do deauthenticate the user. If you delete/disable the user, or change their role, there's still a stateful JWT out there claiming they have certain grants.

You either need to accept a certain TTL on the JWT, or be able to revalidate the JWT on every request with some authoritative service to ensure the grants are good (which sort of invalidates the value of the grants encoded in the JWT itself).

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#57

Post by wharfjumper »

baconfly wrote: post #2

One of the co-maintainers here. Ory Kratos has been in development since 2018 and is finally out of beta! If you have any questions about the project, tech, flows, or Ory as a whole I’m here to help :)

Congratulations on Kratos coming out of Beta.

We evaluated Ory a few months ago. My understanding:

1. Ory Kratos provides session-based authentication and user management.

2. Ory Hydra is a self-managed server that secures access to your applications and APIs with OAuth 2.0 and OpenID Connect.

Basically we want to replace AWS Cognito (which is pretty much abandonware) to secure our API so we needed both applications. Unfortunately we had to put our efforts on hold:

1. Bugs around traits meant we had issues around password change, password recovery and email change/reverifications for our use-case

2. Lack of documentation prevented us making progress on 2FA/WebAuthn

3. Bearer token/Oauth consent flow wasn't available without a lot of work because Kratos and Hydra are not "integrated" [1]. Someone shows how they rolled their own integration [2].

I'd love for someone to advise that we were wrong or misunderstood things or that things have moved on since then!

[1] https://github.com/ory/kratos/issues/273 [2] https://blog.px.dev/open-source-auth/

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#58

Post by homarp »

daigoba66 wrote: post #44
skrtskrt wrote: post #8

I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…

In the .NET world, while no longer free (still is open source), there is https://duendesoftware.com/ . The folks behind the company and libraries know what they're doing.

>(still is open source)

I think https://en.wikipedia.org/wiki/Source-available_software is more accurate

see https://duendesoftware.com/license/identityserver.pdf (as pointed by https://github.com/DuendeSoftware/IdentityServer/blob/main/L... ) for their actual license.

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#59

Post by rad_gruchalski »

yacine_ wrote: post #37
skrtskrt wrote: post #8

I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…

Open source documentation & tools are Okta/Auth0's biggest competitors :)

I find the documentation from Okta snd Auth0 pretty solid for understanding basic concepts of OpenID and Oauth.

Re: Show HN: Ory Kratos – Open-source identity server written in Go

#60

Post by password4321 »

andrewstuart2 wrote: post #40
skrtskrt wrote: post #8

I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…

I'm also a huge fan of Keycloak for the same reason. It's been a while since I've looked at the Ory suite, but at least a year or two ago Keycloak was still the much more mature (and still fully OSS) product. Either way, reading the Oauth2 and OIDC specs are probably the best way to get a really solid understanding of modern standardized authn and how to start thinking about authz. https://openid.net/specs/openid-con…

Keycloak: Open-Source Identity and Access Management

https://news.ycombinator.com/item?id=31258469

and a couple lighter-weight projects to bookmark for myself:

Caddy Security https://news.ycombinator.com/item?id=31258469#31259369

GoTrue https://news.ycombinator.com/item?id=29392517#29399741

and a brief discussion of SCIM (Cross-domain Identity), including a Keycloak v16 extension:

https://news.ycombinator.com/item?id=31408059#31413662

Post reply on HN