hey dear ory community :) i’m using kratos to login users on multiple subdomains with OIDC (google), with a set of oauth credentials for each app per subdomain. setting this up like this works great:

providers:
  - id: google-subdomain1
    provider: google
    ...
  - id: google-subdomain2
    provider: google
    ...

👍 the problem is that kratos will create two different accounts for the same google user - since the identifier is generated from oidc.ID + claims.subject https://github.com/ory/kratos/blob/master/selfservice/strategy/oidc/strategy_login.go#L76 i’d like to login people to the same kratos account, when logging in as the same google user on each subdomain. is this use case supported? my only idea so far is running an instance of kratos per subdomain, with a different config.yaml using the same oidc.ID for each oauth provider. edit: issues from github that may be related https://github.com/ory/kratos/issues/1392 and https://github.com/ory/kratos/issues/1276

my only idea so far is running an instance of kratos per subdomain, with a different config.yaml using the same oidc.ID for each oauth provider.

I think that would be a good solution actually, probably depends how many oauth provider you are looking to implement. See also this comment: https://github.com/ory/kratos/issues/1276#issuecomment-830832081

Given that people link their social accounts - multiple accounts - to the same Ory Kratos account, would they use them for authentication? Or would they simply use it to e.g. connect all their instagram accounts to one?

In your case they would use them for authentication yes? Is asking the user to link their other social accounts through the settings UI an option?

Yes, it's a very popular sign-in method used on my deployments (apprx 30% google, 40% facebook, remainder creates local accounts) Asking users to link to existing accounts is a workaround, but in this case takes away the main advantage of speed/zero-interaction for the single-click login with OIDC. Workaround of just using 1 set of oauth creds works with google, but facebook requires different app per subdomain. A solution could be a config for sourcing the kratos identifier from

provider.Config().Provider + claims.Subject

instead of the provider ID, or maybe even a user defined identifier f.ex.

providers:
  - id: google-subdomain1
    provider: google
    custom_identifier: google

Guess that should be the same as running multiple instances of kratos with separate config.yaml to re-use identifiers. I'm always happy to contribute, if a feature like that aligns with ory team's vision :) Let me know ✌️