I am struggling to understand how to offer multiple ways of logging in - say, email/password & google & github The examples I've seen are single-provider - and request a flowid - is there a way of getting a list of the available flows with their id. Ideally, I'd love to pick apart a project that implements this - does anyone know of such a beast ? 😉

Kratos returns a list of nodes that represent the relevant logins This was not very clear to me in the docs, but it helped to see the react-spa example in the elements repo. This was by far the closest to my env, and the components there implement this magic for you https://github.com/ory/elements/tree/main/examples/react-spa

@curved-oxygen-35290 hey there! I've been struggling configuring azure ad as oidc, I'm getting a 404 on the callback. Did you face this issue? How did you solve it?

sorry havent made it that far 🙂

sadkek @magnificent-energy-493 @high-optician-2097 @proud-plumber-24205 could someone of you give a hand on this?

The self callback endpoint I believe is on the kratos daemon But it seems like the request is going to the self serve ui

Getting OIDC to work locally is not trivial, we use ory tunnel for this with Ory Network. I am not sure if the same method works when selfhosting or what the best method is to test this when self-hosting. Maybe something like Cloudflare Tunnels?

I'm not familiar with Cloudfare Tunnels, would you provide further guidance?

This gets confusing when we are using localhost and ports for everything I host my equivalent of self service UI on login.domain.com And I host kratos on kratos.domain.com After you click "sign in with Google" or whatever you go through several redirects on Google / YouTube (lol long story) side then it should redirect you to kratos.domain.com/self-service/methods/oidc Your current one is redirecting to login.domain.com which doesn't have that endpoint at all One that is fixed, kratos.domain.com/self-service/methods/oidc will redirect you back to your self service landing after doing a set cookie with your session (depending on config)

And how could I configure it if I want to keep it running locally?

I would try a hosts file defining domains for your local machine and a reverse proxy listening on 80/443 routing to the correct port based off of the host header This is a standard nginx vhost setup You could also do something with a local k3s and an ingress doing your reverse proxy

@quick-barista-10563 Mmm...Okay, I'll try. Btw, is there a containerized image or helm chart of this? https://github.com/ory/kratos-selfservice-ui-react-nextjs

I don't think of that specific one However this is similar enough :) https://github.com/ory/k8s/tree/master/helm/charts/kratos-selfservice-ui-node

We had this one implementedhttps://github.com/ory/k8s/tree/master/helm/charts/kratos-selfservice-ui-node in k8s but id doesn't recognize the loggin, so we tried running on our local machine the raectnextjs and connect it with kratos (which IS running in k8s). Do you think we could have a meeting next Tuesday afternoon to get your help on this?

I think you need to set baseurl up, it's in the config / helm config https://github.com/ory/k8s/blob/master/helm/charts/kratos-selfservice-ui-node/values.yaml#L135 The other services (kratos) should have one too

I've set the baseurl, yes. I've tried setting the localhost, the service name:port and the endpoint, to no avail @quick-barista-10563

Hey @shy-beach-55709 Are you an Ory Network customer? We would be happy to help if the problem is related to your Ory Network project. For self hosting we can't always help due to resource constraints.

We would like to have it on our k8s cluster because that's where all our apps are, at least in this stage in which we are testing and validating. I understand about limited resources, but if not possible to have a meeting to see this blocker, could you provide some futher guidance? We've spent days going through the documentation and still haven't been able to figure this out, which is frustrating while also preventing us from testing Ory with our apps to see if it meets our needs or not.

It's really difficult to debug self-hosting issues since it can be a variety of problems, configuration, network (docker) as well as the UI integration. This is in-fact why we built the Ory Network so you don't need to sit with debugging problems like these. I unfortunately cannot spend time debugging these kind of setup problems due to resource constraints. If you, however, believe this to be a problem with Kratos, I would advise you to open a discussion https://github.com/ory/kratos/discussions or issue https://github.com/ory/kratos/issues where we (the engineering team) can more effectively assist you.

When you set base url was there any change?? I spent a lot of time mixing up the format of the standard config with the helm config

Basically, this is my yaml. I think the error is on the urls. i understand I should have two endpoints: one for ory-kratos-admin service and another one for ory-kratos-public.

kratos:
        config:
          dsn: memory
          identity:
            default_schema_id: default
            schemas:
              - id: default
                url: file:///etc/config/identity.default.schema.json
          courier:
            smtp:
              connection_uri: <smtps://myuser:secret@mail.example.com:587/?skip_ssl_verify=true>
          serve:
            public:
              base_url: ory-kratos-public
              cors:
                enabled: true
            admin:
              base_url: ory-kratos-admin
          session:
            cookie:
              same_site: Lax    
          selfservice:
            default_browser_return_url: ory-kratos-admin/welcome
            allowed_return_urls:
              - ory-kratos-admin
            methods:
              password:
                enabled: true
              link:
                enabled: true
                config:
                  lifespan: 15m
              oidc:
                enabled: true
                config:
                  providers:
                    - id: microsoft
                      provider: microsoft
                      label: microsoft
                      client_id: client_id
                      client_secret: client_secret
                      microsoft_tenant: common
                      issuer_url: <https://login.microsoftonline.com/common/oauth2/v2.0/authorize>
                      mapper_url: <https://storage.googleapis.com/bac-gcs-production/ca2c1bb3278251cd64913563fcff9412253581c821d078016e55761e965f989530a8777852603e571aa19ec09553af1cfdd28ba58489d94e4e2f9b906d04455f.jsonnet>
                      scope:
                        - openid
                        - profile
                        - email
                        - <https://graph.microsoft.com/User.Read>           
                      subject_source: me
            flows:
              error:
                ui_url: ory-kratos-admin/error

              settings:
                ui_url: ory-kratos-admin/settings
                privileged_session_max_age: 15m

              recovery:
                enabled: true
                ui_url: ory-kratos-admin/recovery

              verification:
                enabled: true
                ui_url: ory-kratos-admin/verification
                after:
                  default_browser_return_url: ory-kratos-admin/verified

              logout:
                after:
                  default_browser_return_url: ory-kratos-admin/login

              login:
                lifespan: 10m
                ui_url: ory-kratos-admin/login
                after:
                  default_browser_return_url: ory-kratos-admin/dashboard


              registration:
                lifespan: 10m
                ui_url: ory-kratos-admin/registration
                after:
                  default_browser_return_url: ory-kratos-admin/registered
                  oidc:
                    default_browser_return_url: hory-kratos-admin/dashboard
                 

        automigration:
          enabled: true         
        identitySchemas:
          "identity.default.schema.json": |
            {
              "$id": "<https://schemas.ory.sh/presets/kratos/identity.email.schema.json>",
              "$schema": "<http://json-schema.org/draft-07/schema#>",
              "title": "Person",
              "type": "object",
              "properties": {
                "traits": {
                  "type": "object",
                  "properties": {
                    "email": {
                      "type": "string",
                      "format": "email",
                      "title": "E-Mail",
                      "<http://ory.sh/kratos|ory.sh/kratos>": {
                        "credentials": {
                          "password": {
                            "identifier": true
                          }
                        },
                        "recovery": {
                          "via": "email"
                        },
                        "verification": {
                          "via": "email"
                        }
                      }
                    }
                  },
                  "required": [
                    "email"
                  ],
                  "additionalProperties": false
                }
              }
            }
  chart: kratos

Here's a snippet from mine

kratos:
  config:
    session:
      cookie:
        name: session
        domain: <http://domain.net|domain.net>
        same_site: Strict
    serve:
      admin:
        base_url: "<http://127.0.0.1:8088>"
      public:
        base_url: "<https://kratos.domain.net>"

Did you replace your real urls with easy to read strings for the paste?

base_url: ory-kratos-public

Yes, I did. More or less they look like this: http://ory-kratos-public.my-domain.com http://ory-kratos-admin.my-domain.com http://ory-kratos-ui.my-domain.com

My admin baseurl is local host so I can use kubectl port forward to access it, so far it hasn't needed to be publically accessible I'll look to see if I set browser url

I've made some changes, and I'm still not being able to make it work: This is the current full info: kratos.yaml:

kratos:
        config:
          dsn: memory
          identity:
            default_schema_id: default
            schemas:
              - id: default
                url: file:///etc/config/identity.default.schema.json
          courier:
            smtp:
              connection_uri: <smtps://myuser:secret@mail.example.com:587/?skip_ssl_verify=true>
          serve:
            public:
              base_url: <http://ory-kratos-public.my-domain>
              cors: 
                enabled: true
            admin:
              base_url: "<http://127.0.0.1:4434>"
          session:
            cookie:
              same_site: Lax    
          selfservice:
            default_browser_return_url: <http://ory-kratos.my-domain/welcome>
            allowed_return_urls:
              - <http://ory-kratos.my-domain>
            methods:
              password:
                enabled: true
              link:
                enabled: true
                config:
                  lifespan: 15m
              oidc:
                enabled: true
                config:
                  providers:
                    - id: microsoft
                      provider: microsoft
                      label: microsoft
                      client_id: client_id
                      client_secret: client_secret
                      microsoft_tenant: common
                      issuer_url: <https://login.microsoftonline.com/common/oauth2/v2.0/authorize>
                      mapper_url: <https://storage.googleapis.com/bac-gcs-production/ca2c1bb3278251cd64913563fcff9412253581c821d078016e55761e965f989530a8777852603e571aa19ec09553af1cfdd28ba58489d94e4e2f9b906d04455f.jsonnet>
                      scope:
                        - openid
                        - profile
                        - email
                        - <https://graph.microsoft.com/User.Read>           
                      subject_source: me
            flows:
              error:
                ui_url: <http://ory-kratos.my-domain/error>

              settings:
                ui_url: <http://ory-kratos.my-domain/settings>
                privileged_session_max_age: 15m

              recovery:
                enabled: true
                ui_url: <http://ory-kratos.my-domain/recovery>

              verification:
                enabled: true
                ui_url: <http://ory-kratos.my-domain/verification>
                after:
                  default_browser_return_url: <http://ory-kratos.my-domain/verified>

              logout:
                after:
                  default_browser_return_url: <http://ory-kratos.my-domain/login>

              login:
                lifespan: 10m
                ui_url: <http://ory-kratos.my-domain/login>
                after:
                  default_browser_return_url: <http://ory-kratos.my-domain/dashboard>
              registration:
                lifespan: 10m
                ui_url: <http://ory-kratos.my-domain/registration>
                after:
                  default_browser_return_url: <http://ory-kratos.my-domain/registered>
                  oidc:
                    default_browser_return_url: <http://ory-kratos.my-domain/dashboard>

Node ui:

source:
  repoURL: '<https://k8s.ory.sh/helm/charts>'
  targetRevision: 0.28.0
  helm:
    parameters:
      - name: kratosAdminUrl
        value: '<http://ory-kratos-admin.my-domain.com/>'
      - name: kratosPublicUrl
        value: '<http://ory-kratos-public.my-domain.com/>'
      - name: service.type
        value: LoadBalancer
      - name: kratosBrowserUrl
        value: '<http://ory-kratos.my-domain.com/>'
  chart: kratos-selfservice-ui-node

Login page and error are as shown in the images below. I'm sure this is a completely dumb error sadkek

A new, different, error, I call that progress!

That's the inspect. The 200 is when I load the page, and then I get a 300 error which leads to the 404. In our case, the urls are: ory-kratos for the ui (say, the login site), the ory-kratos-public and the ory-kratos-admin belong to the kratos itself deployment.

the thing I find interesting is that the first piece is my flow is:

POST <https://kratos.domain.net/self-service/login?flow=96d622b0-b518-4750-bce3-4a5d841eb9dd>

And yours seems to be a GET My 303 response redirects me to google, and sets a cookie (

ory_kratos_continuity

) but yours seems to redirect directly to the browser url

Any suggestion about what to change or where to look at to make this work?

That does indeed seem very odd; when you disable password and "link" methods does it start attempting to contact microsoft?

Still the same error with a 303 between the 200 and the 404.

the flow_id is great because you can look it up in the api

But still, I understand that then the flow implemented here isn't working, because it should be taking me to the ory-kratos-admin instead of the public. Right?

Hey, please be respectful when pinning maintainers. Thanks

Hello @shy-beach-55709, I am sorry that you are having trouble running Ory. Please understand that we are constrained in our resources and provide community support on a best effort basis. If you require more comprehensive support, we recommend our managed service, Ory Network, which offers direct assistance. If you are self-hosting Ory, it is important to note that you are responsible for any issues that may arise, as with any other free open source software. Throughout Ory’s lifetime, we have received tens of thousands of issues and PRs, and in order to maintain our commitment to the community, we prioritize and focus on issues that have a broad impact. Unfortunately, burnout has become a topic of concern amongst open-source projects. It can lead to severe personal and health issues as well as opening catastrophic attack vectors. The motivation for this is to help us build a sustainable open source ecosystem and not ignore, reject, or belittle anyone. Thank you for your understanding, and to all those who contribute to and support the Ory community. 🙏✌️

I understand and appreciate your reply, though I'm still a little bit disappointed since the documentation on how to deploy this using helm/k8s is lacking. Guess we could work it, I'll share how we've done it if we are able to overcome the issues mentioned above 🙂 thanks!

Hey @shy-beach-55709 That would be great yes 🙂 If you want to do a little write up and publish it on our blog, I would be happy to assist you with that and we could do some “co-marketing”.

Just a little update on this. I'm loving Ory, though it has been quite a ride the configuration using helm 🙈 We're finishing the configuration of Oathkeeper-Keto-Kratos (in Kratos we configured different authorizers) and we can see the effort and the value Ory adds to our business. So thanks for keeping it up 🙂 Once we are done we'll write our step by step guide and share it in case it's useful for somebody else

@shy-beach-55709 please, that would be great 😉

Hello @shy-beach-55709 Thanks for the update and the feedback! I agree its not easy to self-host the full stack of Ory especially in k8s - it is one of the reasons why we build Ory Network as simple & affordable alternative to that 🙂 And as for the guide that would be very cool, maybe we can add it as drop in example here: https://github.com/ory/examples or on our blog. In any case let me know if I can help with that in any way. I am also doing “case studies” with companies who use Ory in production, let me know if you are interested in that - see the fandom case study for example

We'll do. Currently we're stuck figuring out the permission structure in Keto, but we already have a guide we use internally with the team so that everybody understands how it works our implementation. We could use that one as a starting point. Regarding of doing a case study with our company, I'll check that with my team and let you know. We haven't move this to production stage yet, though.