Ory Full-stack demo

[gen1us2k]

Hello everyone.

Ory has many examples and demos of using Ory products. They are simple and easy to use. However, it would be great to have a real-life example that absorbs all Ory products (Ory Cloud, Ory Hydra, Ory Kratos, Ory Oathkeeper, Ory Keto).

I come up with these ideas for the project.

1. Simplified Netflix clone
2. Simplified uber-like taxi management system
3. Youtube-like video hosting

Requirements for the app:

1. 3-4 microservices connected to each other. We can use oathkeeper here as an identity and access proxy
2. Ability to use Access-control features
3. Ability to use registration/login/recovery flows for users
4. Ability to use Oauth2 flows

What do you think of that? Do you have any ideas for a demo project?

[gen1us2k]

After a small research, I found that Quora/Reddit/HackerNews suits better for the full-stack demo because of

1. 'Login with Reddit/Hackernews/Quora' works best to have a demo for Ory Hydra. in addition, there will be integration between Ory Kratos
2. Usually, on such forums you need to have something like RBAC-based.
3. Ory Kratos will be the identity provider and perform login/registration/recovery flows

[HarryET]

Maybe not on this demo but a B2B app demo might be useful?

[danbim]

I like the idea in general but I fear that putting in all Ory products could make it quite complex to grasp. But having that would be helpful for sure. In addition I could imagine to have smaller examples which only use a subset of products and features, e.g. only authentication via Kratos and auth validation via Oathkeeper which I assume to be a standard use case.

[gen1us2k]

I agree that it can make it quite complex. However, we have small and easy-to-implement examples here.

[a-manraj-pvotal]

Using the entire stack, two most custom are the login page linked to kratos in web with hydra consent and definitely Keto for granular rules.

[BeMoreDog]

I think it sounds great and it would be good to incorporate a high level diagram making it clear what each product is for and how it is used (because when you first come to ory it's hard to wrap your head around this).
Also some clarification around Kratos log in with (e.g. Github) which doesn't need Hydra and the Login with Reddit/Hackernews/Quora which you mention does need Hydra.
Personally, I'd like it to also include API key access to back end APIs that doesn't tie the auth to a user (shameless plug, see here)

[chandanjog]

@gen1us2k Thanks for taking this up.

Regarding this -> 'Login with Reddit/Hackernews/Quora' works best to have a demo for Ory Hydra. in addition, there will be integration between Ory Kratos

I would like to have an up to date example that demonstrates usage of Hydra with authorize_code flow with PKCE as an OAuth Provider using self hosted login and consent pages interacting with Kratos for authenticating the identitites. With your previous example my understanding is that the login/consent endpoints will point to Reddit/Hackernews.

I got lucky searching for an example and finally found a working one here hidden in a branch - https://github.com/ory/kratos-selfservice-ui-node/tree/hydra-integration-2021 that helped me build my understanding of the flows. This example is still from an year ago and did not work with the latest Kratos version. I ended up using the latest code for Kratos self service UI and then integrating hydra related endpoints. It will be great to verify I haven't missed anything from a security perspective. I also ended up adding Oathkeeper in the mix. Here's the branch - https://github.com/chandanjog/ory-suite-spike/tree/updated-kratos-hydra and docker-compose setup to trigger authorize_code flow - https://github.com/chandanjog/ory-suite-spike/tree/updated-kratos-hydra/contrib/hydra.

It will be great to have an example from your side that I can use to validate my approach.

[tonytoth]

How about a Google Drive demo ?

[a-manraj-pvotal]

We are using the entire stack (even Keto) at Pvotal with Flutter multiplatform, go templates for login page web PKCE instead of node.js, pure kratos PKCE for API/mobile/heavy clients linked to hydra for JWT emission (with similar work to hydra-integration-2021). Oathkeeper for gRPC/gRPC-web validation with emissary and istio in Kubernetes. Then the microservices check with gRPC interceptors our authorizer (our custom Zanzibar rules abstraction to expand the checks) in front of Keto to store the rules with gRPC API. We talked about it at last Ory summit but didn't get time to do it as we were focusing to be event sourced applicatively. We will probably talk about the new event sourced version and maybe actually open it before next Ory summit. We are not doing video hosting yet, but were thinking in doing in with Google media CDN with their transcoding API for low delay video flows.

[gen1us2k]

Google Drive demo is a great example for Keto. Patrik gave a talk last Ory summit and we're working on publishing it on our blog. Here's a draft pull request

[vinckr]

Hey @a-manraj-pvotal , we would love to have you again on the next Ory Summit, your talk last year was mindblowing 🤯
Please submit your session here: https://sessionize.com/ory-summit/ that would help us a lot with plannig, thanks!

[gitn00b1337]

I think a SAAS example would be great as then you guys would see some of the pain points with it currently

[gitn00b1337]

As in B2B SAAS like any service provider (e.g. ecommerce)

[Buluc-Chabtan]

A great demo would be how each service works alone and how to integrate one by one to full stack to work with a flutter app not just flutter web app.

[dgbau]

I am only becoming familiar with Kratos and Keto at this point, but I would really love to see a full-stack tutorial for RBAC with Ory + Hasura + Next.js! I've found many of the existing auth solutions for this configuration to be somewhat lacking.

This would be very useful to showcase custom JWT's granular Role-based data access in Hasura, and also best practices to implement Ory in an app that blends client-side and server-side authentication needs.

One that tackles some standard roles (User, Admin, Editor, etc) but also gets into non-traditional cases such as specific users that need access to specific routes, etc.. would be a great plus too.