Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Is there a way to fetch an identity’s password hash? It seems the `include_credential` param only supports `oidc`.

currently not due to security reasons. is there a reason why you need it?

In the long-term we don’t need it. But while we transition our app over to use Ory, there will be a short period of time where we had planned to use a mix of our existing flows and Ory flows, and it would be helpful during this period to be able to have the hash value.

I see, that’s an interesting use case. Basically you want the user to be able to sign in using both systems?

Yes. Technically only one system at a time, but with the use of feature flags, we’d have the ability to switch back to the old system in case things don’t go as expected.

I think I found a workaround where we don’t need the hash from Ory. I had to modify the original plan slightly.