Okay...can someone PLEASE explain to me what

SERVE_PUBLIC_BASE_URL

should be set to when you are using Oathkeeper and JWT and when you are using cookie without it? The most frustrating thing about working with Kratos is understand when "public" actually means public to the world...or just means "public" API. That keeps biting me in the butt, and it needs to STOP! Can someone lay it out for me finally once and for all?

it should be the external domain e.g. auth.example.com. It can also contain paths e.g. example.com/auth/ As the documentation says:

The URL where the endpoint is exposed at. This domain is used to generate redirects, form URLs, and more.

• https://www.ory.sh/kratos/docs/reference/configuration/ Here is an example, you do a login redirect, the browser gets redirected back to whatever value you specified under

selfservice.flows.login.ui_url

. The user now fills in their details. You in the background have a form pointing to whatever kratos is giving you (e.g.

<http://auth.example.com/self-service/login?flow=af09e010-ea81-4597-9fd9-5012ec8aa278|auth.example.com/self-service/login?flow=af09e010-ea81-4597-9fd9-5012ec8aa278>

) this is calculated by kratos using the

serve.public.base_url

. Cookie domains are set using the

session.cookie.domain

config. This value can be overridden when using

domain_aliasing

. https://www.ory.sh/kratos/docs/guides/multi-domain-cookies Public also does mean public (to the world), meaning that it is safe to expose on your server. Is there something in the documentation that is making this confusing?

I think the confusing thing, @User, is that all your examples use localhost or 127.0.0.1 and not actual real domains. Because of that an internal connection between services has the SAME URL as external URL's, so when figuring out what the settings should be, you get confused--and stay that way for a long time. I finally got stuff working with Kratos, but I am STILL confused about how to properly configure Oathkeepr and Kratos together for my app inside a cluster using domains. I have a

docker-compose

installation that has worked great, but I am unable to get mutators to actually activate and create JWT tokens under ANY condition inside Kubernetes. Is there a reference implementation of this being done by anybody anywhere?

Awesome @User! Can't wait to read your medium post about it 🙂

I will make sure to let you know when it is done! Perhaps a week...this is really important stuff! In the end, I was bitten by just a few configuration settings combined with an SSL certificate not validating to its root...

I agree Travis, and thanks a ton for your feedback and work 🙏 We still have a lot of work to do on the documentation. Please do let me know if I can help you in any way with the article, happy to review etc. We will also repost it on our blog (with credit to you and a link to your project) if you like.

@User I have started work on the content this weekend. I think you will really like it, because it will reflect TWO different projects we actually have in production and be an end-to-end example.

I love to hear that @User 🙌 Ping me whenever!