https://www.ory.sh/ logo
Join Slack
Powered by
This message was deleted.
# general
m
This message was deleted.
j
Looks like I can just pass the session to the API?

https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7jbo8myhuflr9qm9tfxw.png▾

the other thing is how would this work in a multitenant app? In Oauth we have clients and each can be associated with a domain. Is that a concern with this model?
we have over 300 portals with different domains (the majority are all subdomains *.domain.com similar to how Slack does it but we do have a few custom domains as well)
does this forces to use Hydra?
b
Are all the apps under your control?
Your control as in your organizations control?
j
yes
a few nextjs apps and then several checks would be at the microservice level, exposed via GraphQL APIs
(everything under our control)
b
In which case I think Kratos and Oathkeeper should be enough. You could store roles and permissions as admin level metadata for each user in Kratos.
j
if it's stored as metadata, how would those relationships work? i.e modifying roles and permissions
I'm also trying to figure out how multitenancy works
b
How do you want to modify them
j
adding new permissions to roles for example without having to modify the user's metadata
i.e a user is assigned a role, the role is assigned permissions, standard RBAC
I haven't looked into Oathkeeper yet as I understood Keto to be the appropriate product for permissions and access control
b
As far as I am know, multi tenancy is not supported natively in the self hosted version. However the way we are doing it is, we store kratos uuid and tenant level details in our own backend.
j
so you have multiple Kratos instances?
b
No we don’t
Kratos only stores email and password and other business related items such as roles, tenant id etc is stored in our own backend where we use the kratos identity id to identify the user logged in
j
essentially we have 1 app, hundreds (thousands in the future) domains. The user logs in to a domain, goes through the auth process (against a single auth tenant) and is redirected back to the site
m
@jolly-ocean-27001 Apologies for multithreads 😅 We have a solution for multiple domains on Ory Network now, and we are trialing a new pricing schema for 1000+ of domains. I cant share it publicly yet, but I will DM you some details.
🙏 1
b
@magnificent-energy-493 Thank you for the followup. I hope I haven't given any wrong information 🙏
m
No that was alright 🙂 Thank you for explaining and sharing how you use Ory.
🙇‍♂️ 1
7 Views
Open in Slack
PreviousNext
Powered by