Is there a pattern with Kratos/Hydra/Oathkeeper to convert a Kratos session token into an OAuth2 access token that identifies a user (not a machine)? I've not seen one and I'm not sure how you would go about that? Thinking in the context of using the Kratos direct login APIs, then also needing to make calls to another API which is protected by an OAuth2 access token (provided by hydra).

Kratos supports converting the session to a JWT: https://www.ory.sh/docs/identities/session-to-jwt-cors maybe that solves your issue?

I'm not sure that it does, becuase that JWT would not contain scopes for the target API (or any of the other access token required fields like audience and so on). Unless I'm missing something?

otherwise you need to do a full oauth2 flow

That's what I thought, and unless you do an authorization_code flow, the access_token you receive will not have a user-specific Id in it? That would include any user-specific claims or info? I don't think even OAuth2 Token Exchange (if it was supported by Hydra) would help in this instance, since I think the JWT submitted in that case must be a valid access or id token?

no you can't just use "a part of oauth2"