Hydra+Kratos integration

[hcsaustrup]

Hi!

First of all, I'm very excited about the ORY stack - it seems like just the think we need to replace behemoths like Keycloak :-)

• I've got Kratos working with the reference self service UI. I've created an account, and can log in and see my session.
• Hydra has been installed, and I've added a client.
• Test application has been configured to use Hydra, but Hydra currently fails with You are seeing this page because configuration key urls.login is not set.

Am I supposed to use the Kratos Self Service UI for Hydra login and consent too? There seem to be a couple of branches attempting to support this, but I also see comments about it being outdated and not compatible with the current versions of Hydra (and Kratos).

Please advise :-)

/HC

Versions:

• oryd/kratos:v0.8.0-alpha.3
• oryd/kratos-selfservice-ui-node:v0.8.0-alpha.3
• oryd/hydra:v1.10.5

[vinckr]

Hey @hcsaustrup,
great that you found your way to us :-)

Tl;dr: Integration of Ory Hydra and Ory Kratos is being worked on (see also ory/kratos#273, it has not been moving too much, but we are working on it as well internally).
Right now you have to figure out how it works best in your setup.
For a reference consent frontend for Hydra check out this repo: https://github.com/ory/hydra-login-consent-node

It would be helpful to know some more about your use case as well. If you are mainly solving registration and login, it might be valuable to look at ways of doing it without Ory Hydra, depending on your requirements.

A community member wrote a docker-compose featuring all Ory Projects, check it out:
https://github.com/radekg/ory-reference-compose

[hcsaustrup]

Thanks for your response, @vinckr!

For the time being, I'm trying to replace Keycloak in my Kubernetes lab setup. The features I'm interested in, is IdP with accounts being local to the cluster, with an option to associate an external OAuth2 provider like Google or Github. Kratos seems to solve this.

For OAuth2-enabled services in my cluster, I assume that I need Hydra, with Kratos as my identity backend.

For "dump" services, OathKeeper seems to be the answer, although I'm not completely sure if OathKeeper is a Kratos client or a Hydra/OAuth2 client, but that's out of scope for this question.

I read through ory/kratos#273, and I got the impression that a seamless integration between Kratos and Hydra is coming at some point, but is currently low priority since the Kratos self-service portal can be modified to tie Hydra and Kratos together. If this is the case, I'll see if I can get any of the integration-branches working in my setup.

[vinckr]

Hey @hcsaustrup
a community member has written a simple integration for Hydra & Kratos in Go, check it out maybe it can help you:
ory/kratos#1656 (comment)

[vinckr]

@hcsaustrup
The Ory Kratos and Ory Hydra integration just landed with Hydra 2.0,
see the release notes for more details!

[grantzvolsky]

@hcsaustrup Just to add to what Vincent said, it was added to Kratos under the name 'OAuth2 integration' in this PR: ory/kratos#2804

[cybercoder]

@hcsaustrup The Ory Kratos and Ory Hydra integration just landed with Hydra 2.0, see the release notes for more details!

Is there any document for a standalone version? I need to integrate Hydra and Kratos in my lab.
Kratos as user-manager for my Kubernetes kube-api ( connect k8s api to Kratos via Hydra using OIDC client),
But I've not any clue.

[vinckr]

Hello @cybercoder
The community is in the process of adding an self-hosted Kratos+Hydra example here: https://github.com/ory/examples (have a look at the open PRs)
There are also Kubernetes helm charts here: https://github.com/ory/k8s