How to configure Kratos to work with Hydra?

[ditschedev]

Hey there!
I am feeling a bit lost configurationwise. The release notes of Hydra 2.0 state that with a bit of configuration Kratos can be used as the IdP. Thats what I was waiting for, amazing job with projects so far!

Can someone push me in the right direction on what configuration is meant? Or is a quickstart planned?

[ditschedev]

To be more specific:

hydra talkes to the idp through the consent app afaik. So do I understand right, that this consent app is no longer needed as I am just adding the functionality to the self-service and login app that Kratos uses?

[vinckr]

Hello @ditschedev

You still need to handle the consent flow through Kratos, you can see an example from the community here.
also see this project: https://github.com/lus/hydra-consent
and the related issue: ory/kratos-selfservice-ui-node#224.

Over time a tutorial how to set it up in the self-hosted section of Ory Hydra or Ory Kratos would be ideal IMO. This integration comes out of the box with Ory Network but requires some coding to set up on prem.
I hope this helps 🐝

[mattbarnicle]

hi @vinckr. i've been trying to get the "example from the community" link you posted working in Docker (as our project env all runs in Docker). the example is from this project + branch.

there is no docker-compose file in that branch, so I adapted one from the contrib/hydra dir in the kratos-selfservice-ui-node project hydra-integration-2021 branch. that seems to be working, though I'm not positive I used the correct container versions. now all the containers load without error, but when I click on the "Sign Up" link from the left side menu on the Welcome page, it loads the URL http://127.0.0.1:3000/.ory/kratos/public/self-service/registration/browser?return_to= which returns a 404 in the browser. I'm lost at this point as I don't understand what's going on here. do you have an idea what's not working / perhaps not configured correctly, or where i should look next to get this working?

thanks in advance!

docker-compose.yml:

# This docker-compose file sets up ORY Kratos, ORY Hydra, and this app in a network and configures
# in such a way that ORY Kratos is the Login Provider for ORY Hydra.

version: '3.7'

services:
  hydra-migrate:
    image: oryd/hydra:v2.0.3
    environment:
      - DSN=sqlite:///var/lib/sqlite/db.sqlite?_fk=true&mode=rwc
    volumes:
      -
        type: volume
        source: hydra-sqlite
        target: /var/lib/sqlite
        read_only: false
    command:
      migrate sql -e --yes
    restart: on-failure
    networks:
      - intranet

  hydra:
    image: oryd/hydra:v2.0.3
    depends_on:
      - hydra-migrate
    ports:
      - "4444:4444" # Public port
      - "4445:4445" # Admin port
      - "5555:5555" # Port for hydra token user
    command:
      # serve all --dangerous-force-http
      serve all --dev
    restart: on-failure # TODO figure out why we need this (incorporate health check into hydra migrate command?)
    environment:
      - LOG_LEAK_SENSITIVE_VALUES=true
      - URLS_SELF_ISSUER=http://127.0.0.1:4444
      - URLS_SELF_PUBLIC=http://127.0.0.1:4444
      - URLS_CONSENT=http://127.0.0.1:3000/auth/hydra/consent
      - URLS_LOGIN=http://127.0.0.1:3000/auth/hydra/login
      - URLS_LOGOUT=http://127.0.0.1:3000/logout
      - SECRETS_SYSTEM=youReallyNeedToChangeThis
      - OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=public,pairwise
      - OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=youReallyNeedToChangeThis
      - DSN=sqlite:///var/lib/sqlite/db.sqlite?_fk=true&mode=rwc
    networks:
      - intranet
    volumes:
      -
        type: volume
        source: hydra-sqlite
        target: /var/lib/sqlite
        read_only: false

  kratos-selfservice-ui-node:
    build:
      context: ../..
      dockerfile: Dockerfile
    environment:
      - HYDRA_ADMIN_URL=http://hydra:4445
      - KRATOS_PUBLIC_URL=http://kratos:4433/
      - KRATOS_ADMIN_URL=http://kratos:4434/
      - SECURITY_MODE=standalone
      - KRATOS_BROWSER_URL=http://127.0.0.1:3000/.ory/kratos/public
    ports:
      - "3000:3000"
    networks:
      - intranet
    volumes:
      - /tmp/ui-node/logs:/root/.npm/_logs

  kratos-migrate:
    image: oryd/kratos:v0.11.1
    environment:
      - DSN=sqlite:///var/lib/sqlite/db.sqlite?_fk=true&mode=rwc
    volumes:
      -
        type: volume
        source: kratos-sqlite
        target: /var/lib/sqlite
        read_only: false
      -
        type: bind
        source: ./kratos
        target: /etc/config/kratos
    command:
      -c /etc/config/kratos/.kratos.yml migrate sql -e --yes
    restart: on-failure
    networks:
      - intranet

  kratos:
    depends_on:
      - kratos-migrate
    image: oryd/kratos:v0.11.1
    ports:
      - "4433:4433" # public
      - "4434:4434" # admin
    restart: unless-stopped
    environment:
      - DSN=sqlite:///var/lib/sqlite/db.sqlite?_fk=true
    command:
      serve -c /etc/config/kratos/.kratos.yml --dev
    volumes:
      -
        type: volume
        source: kratos-sqlite
        target: /var/lib/sqlite
        read_only: false
      -
        type: bind
        source: ./kratos
        target: /etc/config/kratos
    networks:
      - intranet

# Sending emails is not part of this demo, so this is commented out:
#
#  mailslurper:
#    image: oryd/mailslurper:latest-smtps
#    ports:
#      - "4436:4436"
#      - "4437:4437"
#    networks:
#      - intranet

networks:
  intranet:

volumes:
  kratos-sqlite:

  hydra-sqlite:

.kratos.yml:

serve:
  public:
    base_url: http://127.0.0.1:3000/.ory/kratos/public/
  admin:
    base_url: http://kratos:4434/

selfservice:
  default_browser_return_url: http://127.0.0.1:3000/
  allowed_return_urls:
    - http://127.0.0.1:3000/
    - http://127.0.0.1:3000/auth/hydra/login

  methods:
    password:
      enabled: true

  flows:
    settings:
      ui_url: http://127.0.0.1:3000/settings

    verification:
      ui_url: http://127.0.0.1:3000/verification
      enabled: false

    recovery:
      ui_url: http://127.0.0.1:3000/recovery
      enabled: false

    logout:
      after:
        default_browser_return_url: http://127.0.0.1:3000/auth/login

    login:
      ui_url: http://127.0.0.1:3000/auth/login

    registration:
      ui_url: http://127.0.0.1:3000/auth/registration
      after:
        password:
          hooks:
            -
              hook: session

log:
  level: debug

hashers:
  argon2:
    parallelism: 1
    memory: 128KB
    iterations: 2
    salt_length: 16
    key_length: 16

identity:
  schemas:
    - id: default
      url: file:///etc/config/kratos/identity.schema.json

courier:
  smtp:
    connection_uri: smtps://test:test@mailslurper:1025/?skip_ssl_verify=true