Quick question: how does this differ from keycloak? Are they competing products or do they work fundamentally differently?
Show HN: Ory Kratos – Open-source identity server written in Go
31–40 of 67 posts
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#32As someone who knows very little about serious identity management, does something like Ory handle the auth part (in a variety of schemes), and then your application interacts with Ory somehow to validate the auth? I guess I'm most confused about where the connection between Ory and the application server is. I've only ever dealt with auth a monolith with sessions, so I'm pretty blind here. Any resource anyone would…
[deleted]
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#33As someone who knows very little about serious identity management, does something like Ory handle the auth part (in a variety of schemes), and then your application interacts with Ory somehow to validate the auth? I guess I'm most confused about where the connection between Ory and the application server is. I've only ever dealt with auth a monolith with sessions, so I'm pretty blind here. Any resource anyone would…
The main idea is that instead of a session cookie you are usually exchanging signed information in this scheme. Your app server or an intermediate proxy validates that the signing was authentic, and then receives some information (Often called “claims”) — such as “This account is an admin role user”, or “This account has user id 1234”.
With those pieces of information, you can do all your application lookups securely. With a bit of middleware to handle the incoming signed data (Often JWT), it probably looks about the same as your session-based authentication. The only difference is that you’ve split out and centralized your authentication (And possibly authorization via claims)!
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#34As someone who knows very little about serious identity management, does something like Ory handle the auth part (in a variety of schemes), and then your application interacts with Ory somehow to validate the auth? I guess I'm most confused about where the connection between Ory and the application server is. I've only ever dealt with auth a monolith with sessions, so I'm pretty blind here. Any resource anyone would…
> I guess I'm most confused about where the connection between Ory and the application server is. There might be none. The response from an identity provider (Ory) is signed and encrypted, is given to the user who is being authenticated and then the user brings it to the application. The process usually happens via browser redirects, but can be more manual. The response contains information about who the user is, the…
Just to clarify, as not everyone is familiar with service based architecture: When the application server is air-gapped from the identity provider, it is meant that your frontend application will have user information embedded in the requests it makes.
For example by setting a JWT in the headers or in a cookie when it's a web application.
Even the responsibility of validating that information can be extracted from the application server by doing that in the application gateway (also known as the ingress, for example nginx) which can be configured to read the JWT (or whatever format you choose) and reject unauthenticated/tampered requests.
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#35Re: Show HN: Ory Kratos – Open-source identity server written in Go
#36Quick question: how does this differ from keycloak? Are they competing products or do they work fundamentally differently?
One difference is that Keycloak has some UI which you can even customise for your installation. Fundamentally I guess they're similar, Keycloak is more mature but more Java.
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#37I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…
Open source documentation & tools are Okta/Auth0's biggest competitors :)
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#38Does this work with ALTS for gRPC?
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#39I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…
Same experience for me too. I learned a lot, and integrating OAuth into a platform was pretty painless, including importing and managing users.
It was the first time I felt like I can wrangle the OAuth spec and implementation, and really understand all the ways in which things can go wrong without proper care and expertise into how an OAuth server can be attacked, and how to mitigate those issues the right way.
Re: Show HN: Ory Kratos – Open-source identity server written in Go
#40I learned so much about AuthN and AuthZ from reading Ory code and docs. Sometimes it seems like Ory is the only web auth stuff on the internet that’s intended for you to understand how the whole system works, rather than telling you just enough to get you to use/buy their proprietary software (Auth0, Okta, etc). I read a few books as well but they were extremely poorly done. I eventually also read the entire OpenId C…
I'm also a huge fan of Keycloak for the same reason. It's been a while since I've looked at the Ory suite, but at least a year or two ago Keycloak was still the much more mature (and still fully OSS) product.
Either way, reading the Oauth2 and OIDC specs are probably the best way to get a really solid understanding of modern standardized authn and how to start thinking about authz.
https://openid.net/specs/openid-connect-discovery-1_0.html#P...
https://openid.net/specs/openid-connect-discovery-1_0.html#R...