Hello, I’m new to Ory but I’m have a specific problem that I hope Kratos can help me with. I want to be able to create multiple identities where the [

email

,

other_key

] should be unique. E.g. this is valid • [

<mailto:test@test.com|test@test.com>

,

key1

] • [

<mailto:test@test.com|test@test.com>

,

key2

] But not this • [

<mailto:test@test.com|test@test.com>

,

key1

] • [

<mailto:test@test.com|test@test.com>

,

key1

] Does anyone now if this is supported and if so point me in the right direction where I should look for info? ❤️

Hey @colossal-carpenter-42980 you have control over the identity schema with Ory, so basically the data model that makes up the identity. https://www.ory.sh/docs/kratos/manage-identities/identity-schema#username-and-password When you say “this is valid” do you mean an authorization use case (what is X allowed to do?) ? In that case I would point you to our permission service (Ory Keto) https://www.ory.sh/docs/keto/concepts/relation-tuples

Thanks for your reply! By “this is valid”, I mean the authentication/registration - not the authorization. Another example: A user enters app1.domain.com and should be able to create an account/identity with the unique combination of [

<mailto:test@test.com|test@test.com>

,

app1

]. Later the same user enters app2.domain.com and should be able to do the same but with [

<mailto:test@test.com|test@test.com>

,

app2

] as a unique identifier. Do you follow? 🙂

Hey @colossal-carpenter-42980, thanks for clarifying. I am not sure I follow you all the way 😄 test@test.com would be the indentifier? The identifier (usually an email, but can be a username or something else as well) is unique, as well as the credential (usually a password, but there are other options. So in your case would test@test.com be the identifier and

app1

be the password? Or is

app1

something like an “invitation code” that you need to be able to create an account? If you have multiple apps you can also choose to have 2 seperate userstores (for example 2 Ory Network projects, or 2 databases when self-hosting). Then you dont run into any conflicts. Or should all apps under “domain.com” serve the same userstore?