hydra

Keto only does authorization, independent of users, devices, bots, applications, ... Basically you store your ACLs there and then ask "is _subject_ allowed to do _relation_ on _object_". All the variables are whatever you define them to be. Check out https://github.com/ory/kratos, our identity server. Or https://github.com/ory/hydra, our OAuth2 server. All of them together can be assembled to have something like Keycloak.

The first vulnerability is in the title, OAuth is an Authorization framework (Open Authorization) and is explicitly NOT for authentication. It’s also a delegation protocol (I give you something to do on my behalf). If you want a list of things that can go wrong, look here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-1... Generally you probably do not need OAuth2: https://www.ory.sh/hydra/docs/concepts/before-oauth2/ But if you do don’t roll your own but use proven open source like https://github.com/ory/hydra

Personally I think of Authelia and Keratin as really good projects in the don't-build-auth-into-your-apps-ever-again space. If auth isn't already built into your app gateway/mesh/proxy, then these services might be something worth dropping alongside. A few more projects in this space: - Keycloak (you won't get fired for picking this)[0] - CloudFoundry's UAA[1] - Gluu [2] - ORY (Hydra + friends)[3] - Keratin [4] - OpenUnison [5] - Dex[6] - Netlify's GoTrue[7] All of these solutions are a bit different but here are some of the axes: - Whether or not they function as an OAuth provider - Whether they're centered around application-user-login via mechanisms like email/password, application auth, or SSO - Whether or not they serve as a proxy to another down-the-line OAuth provider (Dex, GoTrue) - GUI availability - F/OSS-ness (basically all of

Keycloak and Authelia try to solve everything at once. So you get user management, but you also need to use their template and plugin system (so Java for Keycloak) and you can't use a different OAuth2 provider because well - you use Keycloak. I really love the projects and they have their use cases - with Ory however, you simply pick what you need: - Login, registration, mfa, user management, password change, account recovery, ... - Ory Kratos: http://github.com/ory/kratos - Permission management, roles, who is allowed to do what - Ory Keto: http://github.com/ory/keto - OAuth2, OpenID Connect Provider that you "connect" to your user management (e.g. Ory Kratos) - Ory Hydra: http://github.com/ory/hydra - A "middleware" which checks if requests are authenticated (who is the caller?) and authorized (is the caller allowed to do that) - Ory Oa