https://www.ory.sh/ logo
Join Slack
Powered by
Trying to get a bit of clarity on this post: <http...
# talk-kratos
j
Trying to get a bit of clarity on this post: https://github.com/ory/kratos/discussions/1907 Essentially, can I use a single Kratos instance so users can login across my app in multiple domains (example.com, example2.com, etc)? The user database is the same for all domains (no isolation) and there is no need for SSO (they can login again when going to a different domain). Thanks!
also from an auth perspective we could have one domain only e.g (auth.company.com), so long as the user is then redirected to the site domain
I see that there is a "custom domains" option, not available in the free tier
how does this translate in the opensource version of the product out of curiosity?
(we want to go with paid cloud, but want to avoid any non opensource features)
h
@jolly-ocean-27001 we solved it by re-applying 'set-cookie' from auth.company.com on the example.com, example2.com, etc. (like encoding it on the auth side and decoding it in example/example2 auth middleware) so example.com will have same cookie as auth.company.com, and kratos will not know what domain the request is coming from. 🫣 i would have preferred to use api-based generation of token, not cookie-based, but then you can't apply the token as cookie and use e.g oathkeeper to process the request, you'd have to implement your own authz layer
j
Thanks @happy-advantage-63621
that sounds hairy
if the approach is cookie based, can't we just assign a different cookie per site?
@magnificent-energy-493 @fast-lunch-54279 we'll probably discuss this next call, but this is one of the main issues we're facing
it's making it hard to understand if we are forced to go with Hydra or Kratos (cookie vs oauth)
for example I should be able to login to prosple.com and the same user be able to login to gradaustralia.com.au
we don't need SSO, it's fine for the user to login again (separate sessions)
the link above seems to imply that this is possible with a single Kratos instance, but how?
m
Hey Duarte, we have some internal events today, but will get back in detail by Friday or early next week 🙏
Hello @jolly-ocean-27001 apologies for the late response! You can do this using a single Ory Network instance on the Scale plan. You can add up to 5 domains and we can also scale that up to your needs - for more than 5 we need to discuss with you but there are in theory no technical limitations to scaling that up to hundreds or thousands.
can’t we just assign a different cookie per site?
That is basically what we do with this feature. There is also the OAuth2 option, but that is more for SSO/federation of sessions as you rightly noted.
j
Thanks @magnificent-energy-493!
19 Views
Open in Slack
PreviousNext
Powered by