Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

github.com

Post reply on HN
Print view View original

31–40 of 114 posts

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#31

Post by aidos »

arekkas wrote: post #29
aidos wrote: post #26

Earlier quoted context omitted.

Interesting. Any more details available on what’s configurable? How does it work out pricing wise?

The flow is essentially what you see in the small video on the docs page and can be set up in the Ory Network Console with a few clicks. I agree though that the docs here are a bit thin. Pricing wise this is available on the Scale tier currently dubbed as "Enterprise SSO" although "B2B Organizations" probably would be more correct: https://www.ory.sh/pricing/ There are no limits to how many organizations you can have…

Thanks.

In terms of other enforcement, I meant more wrt to an organisation that _didn't_ use another IDP but still wanted to apply PW policies (for example) on their domain.

Could you create an Ory project (sorry, don't know all your terminology) to forward on to?

Something like:

Our app -> Ory -> split by domain -> Ory for specific domain -> Policies.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#32

Post by buro9 »

passwordless via email is the single thing that I've been waiting for, once I integrate this I can disable Auth0 and still support the OSS SaaS forum platform — this previously required an Auth0 account, and has sent Auth0 at least 10 medium sized customers.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#33

Post by v3ss0n »

arekkas wrote: post #18
v3ss0n wrote: post #16

Ory Kratos is so complicated .Authentik is much simpler and easier.

We have worked quite a lot on making Ory Kratos easier to consume. In the release notes you find ~4 CLI commands you can use to get a fully working Ory Kratos up and running, with all UIs and configuration management :) You should give it another try!

I will give a try. Back in 2023 it's very complicated to build own web application backend and frontend with it so we ended up choosing Authentik.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#35

Post by mooreds »

Congratulations, this is a big release. Some great features in there. Love the phone number as a first class citizen, something we've been considering for a while.

(I work for a competitor, FusionAuth.)

I noticed account linking, between social accounts and existing accounts, based on email matching, was a new feature.

It's documented here: https://www.ory.sh/docs/kratos/social-signin/link-multiple-p... I believe.

The document walks through the "linking an existing account with a password to social account" scenario. I was wondering if there was also the ability to go the other way, from an existing social account to adding a password?

How do you handle the case where Alice signs up with a username of alice@example.com but later wants to link alice@gmail.com?

I also wonder if you can block account linking on a per user basis or if it is enabled for everyone in a system.

We've had account linking for a few years (documentation here: https://fusionauth.io/docs/lifecycle/authenticate-users/iden... ) and have had customers bring up some edge cases like this.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#36

Post by mooreds »

fuomag9 wrote: post #34

Unfortunately this is not comparable to authentik for me, it looks like it’s only for applications you’re developing and not already implemented solutions

What do you mean? I think it supports oidc endpoints? https://www.ory.sh/docs/oauth2-oidc/authorization-code-flow indicates this.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#37

Post by zinekeller »

asdaq1312512 wrote: post #21
arekkas wrote: post #8

Earlier quoted context omitted.

Yes, this is definitely true. However, there are use cases and companies who rely on SMS based two-factor: - Using SMS for phone verification - Using SMS for mobile login (think dating apps for example) - Using SMS for two-factor where other factors are not available / convenient (often in emerging markets) SIM Swap Attack, SIM Port Hacking are all real, but as always in security it comes down to your threat model to…

> - Using SMS for mobile login (think dating apps for example) Dating apps in particular seem to be a problematic example to me. In some regions, phone numbers change owners quite easily (e.g., no possibility to port a phone number to a new contract, and quick re-cycling of the phone number when a contract is terminated).

To be fair, it really depends on the region you're operating. Some regions (like most places in Asia) use this as the primary identifier (instead of email), so despite the very obvious security flaws you might be simply be forced to offer it.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#38

Post by aidos »

mooreds wrote: post #25
aidos wrote: post #22

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login p…

Hmm. (I work for FusionAuth, thanks for giving us a try!) So you want a screen in front of the login process where someone enters their email address, and then a second screen where a variety of login options are presented? Along with the ability to enforce MFA on a per domain basis? Anything else you are looking to customize at the domain level, such as password rules or registration ability?

For the moment our needs are actually fairly light. I'm trying to remember exactly what I ran into with FusionAuth but struggling a little unfortunately.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#39

Post by mffap »

aidos wrote: post #22

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login p…

Have a look at ZITADEL (https://github.com/zitadel/zitadel or https://zitadel.com/), I think that does what you want. You can create multiple tenants (called Organizations) and you can setup security / login rules per organization such as enforcing MFA. Furthermore you can configure on each tenant a separate SSO and users are directly forwarded to their identity provider. When you first enter your username (could be an email) on the login screen, the policies of the user's organization will be applied. That allows you to route users based on their email domain etc. One additional thing to mention is that ZITADEL does not only handle authentication, but also authorization with self-service. Managers of an organization can, for example, assign users of their organization roles.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#40

Post by lucideer »

DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

> I thought it was well-established that SMS text messages should not be used for authentication purposes?

Using SMS text messages for 2FA is barely better than 1FA, but it is better.

There's a lot of value in discouraging what many see as the easy option, especially when the alternatives are getting users to install extra apps (or even buy hardware keys of some sort), so the scaremongering around SMS is warranted, but it's still absolutely better than nothing.

Post reply on HN