Hey everyone, I hope you don't mind this noob question 🙂 I reached out here because I have an app that is protected by API keys that is being used by some external users(machines) already. It has been in my backlog to replace my API key system to use OAuth2.0 client credentials for Machine to Machine comms. 1. I think I can use Ory Hydra for that, which generates out a client_id and secret then it handles the token mechanism • However I don't know, how I can utilize Ory to my own system for example, my use case (Given access token from Ory Hydra, Machine X can access object Y). Should Ory Hydra be enough since it's an AuthZ tool? 2. Or I need to utilize Ory Keto for that to make sure that the AuthZ works for my use case? So far, I'm still on the reading phase. So I don't know if I'm in the right path yet. but I appreciate it if you have this use case before and share some stories/ tips about it. Thank you 🙇

@lemon-balloon-30664 Ory Hydra should be enough for your use case based on the above. You can try out Ory Network (console.ory.sh) for free https://www.ory.sh/machine-to-machine-auth/ Please associate your Ory ID with this Slack account so we can continue to support you.

Hello people, I am trying to figuer out how I can setup a basic Signle Sign On flow with Ory. We are currently evaluating a few services for our internal company SSO Service and Ory looks promising, but I can not find the tutorial/guide on how to setup SSO with Ory (as-a-service or self-hosted). Am I blind? Does someone have a good link for me?

All I can see is these pages here: https://www.ory.sh/docs/oauth2-oidc/overview/oidc-concepts But is there no tutorial on how to setup OpenID Connect for PHP?

We are running Project Contour as ingress and would like to use Ory for Authentication and Authorization. We managed to successfully set up authentication however on the authorization side we require the authorization server to support gRPC envoy CheckRequest protocol version 3 (see more here), is that something that Ory supports? Or are we out of luck here?

How can I check Ory Cloud health with REST API? I am trying this.metadataApi .isReady() but it returns a 404 (that I get too if I go check manually my-ory-cloud.projects.oryapis.com/health/ready).

Hey everyone. I'm facing a problem with registration using OIDC and I'm sure you can help me to understand it. • When I try to perform an OIDC login using a new user (OIDC registration flow), Kratos is registering the user and redirects the browser to the value configured in

selfservice.flows.registration.after.oidc.default_browser_return_url

. I'm getting a session cookie, but even if I set the return URL to the login endpoint of my IdP UI, it cannot complete the login flow since it doesn't include a

login_challenge

that I can use to complete the OAuth2 login flow. • However, when the user is already registered and I try to log in using OIDC (OIDC login flow), everything works fine: Kratos redirects to the consent endpoint of my IdP UI and the OAuth2 flow ends successfully. Actually, the return URL set in

selfservice.flows.login.after.oidc.default_browser_return_url

is not used at all. As I see it, the OIDC registration flow should register the user and then behave the same way as the OIDC login flow, resuming the OAuth2 flow. I assume I'm doing/understanding something wrong. Can you help me? Thanks!

So happy to have our oathkeeper/kratos/keto integration prototype moving to a more production state. Thanks for help, special thanks for @steep-lamp-91158 and again thanks for those awesome production. Working now on a Websocket based permission check to expose parts of keto decision making to our frontend.

Hello everyone, are there some best practices around securing access to Ory CLI. Ideally we want disable calls from the Ory CLI entirely in production, is this a pattern that others have used?

Hi there! I am using Ory "managed" and want to use the JWT profile for OAuth2 ( I registered my OIDC provider JWKs (the trust relationship) via the Ory API and now want to exchange an access token like stated in the docs, but Ory gives me hard time, saying

Client credentials missing or malformed in both HTTP Authorization header and HTTP POST body

Any advice here? Thanks!

hello... we're running hydra v2.1.1 in a gke cluster and are unable to silence the request_logs for health/alive and health/ready despite having this in the config :

apiVersion: v1
kind: ConfigMap
data:
  hydra.yaml: |
    clients:
      http:
        disallow_private_ip_ranges: true
    log:
      format: text
      leak_sensitive_values: false
      level: debug
    serve:
      admin:
        port: 4445
        request_log:
          disable_for_health: true

also tried setting the env var on the pod spec:

env:
            - name: SERVE_ADMIN_REQUEST_LOG_DISABLE_FOR_HEALTH
              value: 'true'

with both settings we still see:

time=2023-05-11T01:30:37Z level=info msg=completed handling request http_request=map[headers:map[accept:*/* user-agent:kube-probe/1.24] host:[redacted] method:GET path:/health/alive query:<nil> remote:10.248.240.82:41960 scheme:https] http_response=map[headers:map[content-type:application/json; charset=utf-8] size:16 status:200 text_status:OK took:340.561µs]
time=2023-05-11T01:30:37Z level=info msg=started handling request http_request=map[headers:map[accept:*/* user-agent:kube-probe/1.24] host:[redacted] method:GET path:/health/ready query:<nil> remote:10.248.240.82:41968 scheme:https]
time=2023-05-11T01:30:37Z level=info msg=completed handling request http_request=map[headers:map[accept:*/* user-agent:kube-probe/1.24] host:[redacted] method:GET path:/health/ready query:<nil> remote:10.248.240.82:41968 scheme:https] http_response=map[headers:map[content-type:application/json; charset=utf-8] size:16 status:200 text_status:OK took:3.451065ms]

@busy-fish-14120 hello. Are you using Ory Network? and are you using some other tools for log data processing?

Hi there! Is it possible to specify [namespace: location] our own storage location?

limit: {}

namespaces:

location: <https://_namespace_location_.bin>

And is it possible to update permission-config and run other cli commands during CI/CD? Any Github action(s)? What's recommended way?

@wide-machine-60917 what exactly are you trying to achieve, and with what product?

I was not able to delete relationships, it was saying:

Error: undefined response type

. I deleted it from Ory console, but I'm getting the same error even when running

ory list relationships

Hey team, does anybody know why this happen frequently? If I try to create a “wrong” relationships, I’m getting this error and there are no ways to continue work. This literally blocks me. I can drop here namespaces and relationships.

Just a thought: this file might use a PR with Ory Cloud details in, assuming Ory Cloud has global URLs for oauth2: https://github.com/windmill-labs/windmill/blob/main/backend/oauth_connect.json

📣 Anyone who wants to run Ory CLI in Github Actions and having troubles - I just published Github Action. Feel free to use it.

I tested and configured account recovery emails yesterday. In a first test run, the emails arrived after about 30 minutes. I then reconfigured the templates and some other settings, and retriggered test emails (in two projects, yesterday ~19:20 CEST). I did not receive any test email yet. Is this an issue?

I’m getting a “resource not found” error when trying to delete an identity with the ory cli. I can see in the console that the identity exists so I’m really at a loss why this would be happening and wonder if there is a bug or something

ory delete identity xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx

Response:

Unable to locate the resource
xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx: this error should never be printed

I've used the "Ask AI" button in the documentation and.. it's cool!

Hi I'm trying to call the GetLoginRequest() method with hydra admin client, but it's causing issue with the hostname. So when I set the adminURL to http://hydra-admin:4445 the host becomes localhost like this

<http://localhost:4445/admin/oauth2/auth/requests/login?login_challenge=7276fa161b674c148e824ac6b51ab828>

but if I just set the host like http://hydra-admin then it host stays as it is. I'm running all in local kubernetes cluster in kind. If I make the request manually it works fine from that pod that is using client login request. So it's just calling http://localhost:4445 instead of http://hydra-admin:4445 that's why it's failing. What could be the reason? Has anyone faced this kind of issue ?

Hi all Does ORY opensource ecosystem support identity governance for example like synchronization with other system via different protocols (SCIM/Ldap/ etc ) and approval flows ? Maybe I just missed it somewhere in documentation…. please point me…

I have two websites, and I need to use the same account and password to log in, that is, single sign-on. Can Ory fulfill such a requirement? How to achieve it, is there any relevant documentation?

Cross App SSO

both websites need to be on the same domain for Kratos’s cookies to work on both

While not wrong Michael, there are ways to solve it @tall-mouse-53965 The easiest is to use Ory Network with is the option to add multiple cookie domains to one project, so you can issue sessions for multiple domains. This feature is part of the Scale plan. You can also use Ory OAuth2 to solve this alternatively.

@magnificent-energy-493 do you mean that i can use Essentials plan and solve it with OAuth2

does Developer plan support OAuth2?

Hi, we’re using ory console now. But it’s wired that we cannot get user’s email when using /userinfo endpoint. The identity model is default

email and password

. And the data mapping for github is also the one in the documentation. Did I make mistakes?