oathkeeper

Congrats on the launch! I'm curious about how this compares to existing Auth microservice solutions like Ory Kratos[0][1]. For the "short-lived tokens" that you mention, is that similar to Ory Kratos used with Ory Oathkeeper[2][3] with JWTs? That's a similar approach that I've seen companies like Uber taking for their microservice Auth. 0: https://www.ory.sh/kratos/ 1: https://github.com/ory/kratos 2: https://www.ory.sh/docs/kratos/guides/zero-trust-iap-proxy-i... 3: https://github.com/ory/oathkeeper

Sorry, w.r.t my second thought, how would this differ from something like Ory Keto[0] or Oath Keeper[1]? [0] https://github.com/ory/keto [1] https://github.com/ory/oathkeeper

Hydra feels mature. I think it's their longest-developed product so far. Besides breaking changes during big upgrades(v0 -> v1beta -> v1), everything has been painless: - It runs anywhere with or without containers - API makes sense, good SDKs are available in all my used languages - RAM usage is surprisingly low compared to usage and has been great for resource-constrained environments - Stateless means horizontal scaling is as easy as `replicas++` - Sub-millisecond response times for some calls, much faster than our previous setup With Hydra, I know it's the client's fault when OAuth calls fail and not just a buggy server implementation. This is reinforced in dev mode with great errors like: - The authorization code has already been used - The request is missing the response_type parameter - Parameter "nonce" must be set when using the

Keycloak and Authelia try to solve everything at once. So you get user management, but you also need to use their template and plugin system (so Java for Keycloak) and you can't use a different OAuth2 provider because well - you use Keycloak. I really love the projects and they have their use cases - with Ory however, you simply pick what you need: - Login, registration, mfa, user management, password change, account recovery, ... - Ory Kratos: http://github.com/ory/kratos - Permission management, roles, who is allowed to do what - Ory Keto: http://github.com/ory/keto - OAuth2, OpenID Connect Provider that you "connect" to your user management (e.g. Ory Kratos) - Ory Hydra: http://github.com/ory/hydra - A "middleware" which checks if requests are authenticated (who is the caller?) and authorized (is the caller allowed to do that) - Ory Oa

Hey, there were a few reasons behind this. - ease of migration was a big one, we had 100+ instances of bitly's oauth2_proxy, and were able to seamlessly migrate them to this, without any changes to the services being protected. - ease of deployment was also important. Our solution doesn't have any datastore dependencies, and is stateless, so was straightforward to deploy into our PaaS ( https://tech.buzzfeed.com/deploy-with-haste-the-story-of-rig... ). - when we built this, there were far fewer solutions than there are today. For example, Ory's Oathkeeper ( https://github.com/ory/oathkeeper) was released after we were already using sso internally at BuzzFeed. thanks!

Where is the ORY Security Console hidden? I can't see it on GitHub and all links lead to a running instance of it? Is this how you're hoping to monetise all your hard work? I don't begrudge that at all :-) It's just a little unclear? If there's going to be a security console, I wouldn't want it hosted by anyone else. Especially if I'm the type of person to deploy all the other components I'll undoubtedly want to deploy the console myself. [EDIT] There's also some on by default telemetry.. and the link for details is 404'ing: https://github.com/ory/oathkeeper#telemetry -> https://www.ory.sh/docs/guides/latest/9-telemetry I might not mind this, but I can't tell if the links don't go anywhere. I don't want to sound negative, other than these queries the ORY ecosystem looks lovely and something I might implement. Cheers

It's really nice that we see more and more awareness for Zero Trust and specifically Google's BeyondCorp whitepaper. If you're looking to experiment with this model yourself, check out the following open source projects. While they might not implement everything in Google's BeyondCorp paper yet, they are pretty close to the full thing, and address many issues raised in the comments. -> OAuth2 Authorization Server https://github.com/ory/hydra -> Identity & Access Proxy (early access): https://github.com/ory/oathkeeper If you have questions don't hesitate to ask.