hydra

Very impressive, and at the same time very scary because who knows what security issues are hidden beneath the surface. Not even Claude knows! There is very reliable tooling like https://github.com/ory/hydra readily available that has gone through years of iteration and pentests. There are also lots of libraries - even for NodeJS - that have gone through certification. In my view this is an antipattern of AI usage and „roll your own crypto“ reborn.

Hey Sytten, I work in the community team for Ory. OSS is actually very important for us and definitely not second class. (see also https://www.ory.sh/docs/open-source/commitment) The assumption that Ory does not offer support contracts for self-hosted Ory is wrong (although we did not in the past, when the team was smaller). We are doing contracts for companies using our software self-hosted: See here and contact us if you are interested! https://www.ory.sh/support/ This way we can assign engineers to your case and work on any issues you encounter or work on any contributions or features required. Ory releases all features for free for everyone to use. What is not free however is our time and work. To merge a PR/add a new feature/etc. a significant amount of time is needed to make sure the code lives up to standards, passes all tests,

> 10k M2M tokens for $250/month sounds like a really bad deal if I can just spin up https://github.com/ory/hydra that can easily handle 10k requests per second. Spinning one up is easy, sure. Making sure it's production ready, is not so much.

Congrats on the launch, building a product in this space is incredibly difficult. I took a look at the stack, here are a few observations: - "ISO certified secure auth": What does that mean? I could not find proof of your ISO certification. Can you please share? - 10k M2M tokens for $250/month sounds like a really bad deal if I can just spin up https://github.com/ory/hydra that can easily handle 10k requests per second. - Looks like you're using OAuth2 as the primary "login" and "session management". What compelled you to do this? - It looks like you're using some open source technology under the hood for the OAuth2 flows - which one are you using (out of curiosity)? And finally, what sets you apart? It looks like the same solution for the known problem that big players (such as Okta and Auth0 - publicly traded) have already mastered. Ory

If you are just looking to run a custom OAuth/OIDC server, Ory Hydra is ridiculously easy to set up. Keycloak comes with the full IAM stack, so if you need that good; if you just need the OAuth server, its a bit much in my opinion. Have not tried Dex so can't speak to that. https://github.com/ory/hydra https://github.com/keycloak/keycloak

Victor, congratulations on the launch! I am one of the maintainers at https://github.com/ory/hydra and it makes me super happy to see that Ory Hydra is being used for such innovative projects :) If you’re interested to join Ory, we’d be excited to have you! Drop Aeneas a line and he’ll take it from there: aeneas@ory.sh Hopefully we’ll talk soon :)

Keto only does authorization, independent of users, devices, bots, applications, ... Basically you store your ACLs there and then ask "is _subject_ allowed to do _relation_ on _object_". All the variables are whatever you define them to be. Check out https://github.com/ory/kratos, our identity server. Or https://github.com/ory/hydra, our OAuth2 server. All of them together can be assembled to have something like Keycloak.

The first vulnerability is in the title, OAuth is an Authorization framework (Open Authorization) and is explicitly NOT for authentication. It’s also a delegation protocol (I give you something to do on my behalf). If you want a list of things that can go wrong, look here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-1... Generally you probably do not need OAuth2: https://www.ory.sh/hydra/docs/concepts/before-oauth2/ But if you do don’t roll your own but use proven open source like https://github.com/ory/hydra

Personally I think of Authelia and Keratin as really good projects in the don't-build-auth-into-your-apps-ever-again space. If auth isn't already built into your app gateway/mesh/proxy, then these services might be something worth dropping alongside. A few more projects in this space: - Keycloak (you won't get fired for picking this)[0] - CloudFoundry's UAA[1] - Gluu [2] - ORY (Hydra + friends)[3] - Keratin [4] - OpenUnison [5] - Dex[6] - Netlify's GoTrue[7] All of these solutions are a bit different but here are some of the axes: - Whether or not they function as an OAuth provider - Whether they're centered around application-user-login via mechanisms like email/password, application auth, or SSO - Whether or not they serve as a proxy to another down-the-line OAuth provider (Dex, GoTrue) - GUI availability - F/OSS-ness (basically all of

Keycloak and Authelia try to solve everything at once. So you get user management, but you also need to use their template and plugin system (so Java for Keycloak) and you can't use a different OAuth2 provider because well - you use Keycloak. I really love the projects and they have their use cases - with Ory however, you simply pick what you need: - Login, registration, mfa, user management, password change, account recovery, ... - Ory Kratos: http://github.com/ory/kratos - Permission management, roles, who is allowed to do what - Ory Keto: http://github.com/ory/keto - OAuth2, OpenID Connect Provider that you "connect" to your user management (e.g. Ory Kratos) - Ory Hydra: http://github.com/ory/hydra - A "middleware" which checks if requests are authenticated (who is the caller?) and authorized (is the caller allowed to do that) - Ory Oa