Ory Hydra using GCP Cloud Identity for authentication

[anupammishra-sada]

Hi Guys, I am new to Ory and looking for some documentation in which I can do the authentication via GCP cloud Identity. Can someone point me to the documentation or suggest the steps required.

[vinckr]

Hello @anupammishra-sada,

have you seen this document: https://www.ory.sh/docs/kratos/social-signin/google ?

[anupammishra-sada]

Hi @vinckr yes I did. What I am not sure about is how to configure local Ory Hydra instance to use GCP Cloud Identity as the IDP. I am unable to understand how to configuration done in the Ory console for a project maps int he Ory Hydra code. Can you guide me through it or provide any documentation.

[vinckr]

This is not possible using just Ory Hydra AFAIK.
You need something like Ory Kratos that can act as the OIDC client. Hydra is an OIDC server.

You can export configuration from Ory Network and use it in the respective Ory services (Kratos, Hydra, etc...): https://www.ory.sh/docs/guides/cli/config-with-cli

[anupammishra-sada]

Sorry @vinckr I wasn't clear with the ask probably and still learning Ory. I know that Ory Hydra can be integrated with Ory Kratos but isn't that necessitates me to maintain all my user identities in Ory Kratos. If yes, that is where my struggle is to use google cloud identity based users for authentication and use Hydra for authorization. ? So instead of maintaining and verifying the identity in Kratos it is done with GCP cloud identity. It might not be available out of the box, but can it be configured if required. ?

[anupammishra-sada]

Hi @vinckr Thanks a lot. Another question as a follow up, say incase I have multiple IDP. So take an example I have multiple users a@123.com, b@xyz.com these Id's are maintained in there respective IDP's.

1. Can I connect Ory Hydra to multiple IDP.?
2. When they login to my application based on the mailID can I do the authentication from the respective IDP. ?

[vinckr]

1. Yes, Ory Hydra can be connected to multiple Identity Providers (IDPs).

Ory Hydra itself is not an identity management system, but it can connect to your existing identity management system, which could be any IDP you have in place. This could be a MySQL+PHP login service, a Federated SAML SSO, or any other system you use to manage identities.

2. When a user tries to access your application, Ory Hydra can issue access, refresh, and ID tokens in a secure and OpenID Certified manner, connecting to the respective IDP based on the user's credentials. However, the specifics of how to route authentication requests based on the email domain (like a@123.com to IDP1, b@xyz.com to IDP2) would depend on the implementation details of your login provider. The login provider would need to be set up to handle this routing logic.
   See here for example how you would do it with Ory Kratos.

[anupammishra-sada]

Hi @vinckr , Does it mean, in case of Federated Identity Ory Kratos act as a Service Provider and can connect to multiple IDP's including SAML based IDP. Can you please point me to a documentation around how this can be achieved in a self hosted Ory Kratos instance.

[vinckr]

See here for OIDC: https://www.ory.sh/docs/self-hosted/kratos/configuration/oidc
Out of the box SAML is work in progress, but you can use something else for this functionality in the meantime.

[anupammishra-sada]

Thanks a lot @vinckr . Is there a feature request link to SAML feature which is WIP. ? And what do you mean by something else say if the IDP only supports SAML. ?

[vinckr]

Hey @anupammishra-sada
You can see the PR here: ory/kratos#2653
And there are SAML bridge projects that you can use with like jackson.

If you are interested in getting SAML into Ory, I would suggest to reach out to support@ory.sh