Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Heya. I want to migrate my kratos identities from point A to point B. We're using `password` credentials and intend on using the exact same parameters that we have setup on our self-hosted on point A. I noticed a couple things:

1. Kratos does not allow (for reasons?) `kratos get identity &lt;id&gt; -e "${KRATOS_ADMIN_API}" --format json-pretty -i password` only `oidc`
2. Also, a tiny code change allows it free and clear. 
Is there a reason for disallowing `IncludeCredentials: password` and only allowing `IncludeCredentials: oidc`? The REST api happily allows it. I'm curious why it wouldn't be "allowed" in the CLI logic?

Hey <@U06BXJSAZMY>. This looks like an oversight or mistake. PR is welcome :+1:

heh sure. i just figure that there would be a good reason to explicitly reject every credential type except oidc. Like. Hypothetically speaking... to add friction to migrating from _hosted_ to _nonhosted_ ory :slightly_smiling_face:

Yeah no, we don't tend to do stuff like that I hope. Not that I expect lots of people to migrate using the CLI (or at all :D).