Skip to content

Commit 0b1a732

Browse files
k9ertJeremy Bogleaeneasr
authored
feat: preliminary ORY Hydra integration (#50)
Co-authored-by: Jeremy Bogle <[email protected]> Co-authored-by: hackerman <[email protected]>
1 parent 259de30 commit 0b1a732

24 files changed

+1330
-241
lines changed

‎.dockerignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
node_modules/
1+
node_modules/
2+
lib

‎README.md

+8-1
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,21 @@ This application can be configured using two environment variables:
3030
- `BASE_URL` (optional): The base url of this app. If served e.g. behind a proxy or via
3131
GitHub pages this would be the path, e.g. `https://mywebsite.com/kratos-selfservice-ui-node/`.
3232
**Must be absolute!**
33+
- `COOKIE_SECRET` (optional): This secret is used to encrypt cookies which are used as part of the ORY Hydra
34+
integration.
3335
- `TLS_CERT_PATH` (optional): Path to certificate file. Should be set up together with `TLS_KEY_PATH` to enable HTTPS.
3436
- `TLS_KEY_PATH` (optional): Path to key file Should be set up together with `TLS_CERT_PATH` to enable HTTPS.
3537

38+
If you want to also use hydra and connect an app via OAuth2, set these env-variables:
39+
- `HYDRA_ADMIN_URL` should point to hydra's admin port including scheme (e.g. https://hydra.example.com:445)
40+
41+
If you want to test hydra without the use of kratos for user-management, rather have a look at the [hydra-login-consent-node][https://github.com/ory/hydra-login-consent-node].
42+
3643
### Network Setup
3744

3845
This application works in two set ups:
3946

40-
- Standalone with ORY Kratos
47+
- Standalone with ORY Kratos (plus optionally ORY Hydra)
4148
- With the ORY Oathkeeper Reverse Proxy
4249

4350
#### Standalone using cookies

‎contrib/hydra/README.md

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# ORY Kratos as Login Provider for ORY Hydra
2+
3+
**Warning: ** this is a preliminary example and will properly be implemented in ORY Kratos directly.
4+
5+
For now, to run this example execute:
6+
7+
```shell script
8+
$ docker-compose up --build
9+
```
10+
11+
Next, create an OAuth2 Client
12+
13+
```shell script
14+
$ docker-compose exec hydra \
15+
hydra clients create \
16+
--endpoint http://127.0.0.1:4445 \
17+
--id auth-code-client \
18+
--secret secret \
19+
--grant-types authorization_code,refresh_token \
20+
--response-types code,id_token \
21+
--scope openid,offline \
22+
--callbacks http://127.0.0.1:5555/callback
23+
```
24+
25+
and perform an OAuth2 Authorize Code Flow
26+
27+
```shell script
28+
$ docker-compose exec hydra \
29+
hydra token user \
30+
--client-id auth-code-client \
31+
--client-secret secret \
32+
--endpoint http://127.0.0.1:4444/ \
33+
--port 5555 \
34+
--scope openid,offline
35+
```

‎contrib/hydra/docker-compose.yml

+130
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
# This docker-compose file sets up ORY Kratos, ORY Hydra, and this app in a network and configures
2+
# in such a way that ORY Kratos is the Login Provider for ORY Hydra.
3+
4+
version: '3.7'
5+
6+
services:
7+
postgresd:
8+
image: postgres:9.6
9+
ports:
10+
- "5432:5432"
11+
environment:
12+
- POSTGRES_USER=pguser
13+
- POSTGRES_PASSWORD=secret
14+
- POSTGRES_MULTIPLE_DATABASES=kratos,hydra
15+
volumes:
16+
- ./pg-init:/docker-entrypoint-initdb.d
17+
networks:
18+
- intranet
19+
20+
hydra-migrate:
21+
image: oryd/hydra:v1.6.0-alpine
22+
depends_on:
23+
- postgresd
24+
environment:
25+
- DSN=postgres://pguser:secret@postgresd:5432/hydra?sslmode=disable
26+
command:
27+
migrate sql -e --yes
28+
restart: on-failure
29+
networks:
30+
- intranet
31+
32+
hydra:
33+
image: oryd/hydra:v1.6.0-alpine
34+
depends_on:
35+
- hydra-migrate
36+
ports:
37+
- "4444:4444" # Public port
38+
- "4445:4445" # Admin port
39+
- "5555:5555" # Port for hydra token user
40+
command:
41+
serve all --dangerous-force-http
42+
restart: on-failure # TODO figure out why we need this (incorporate health check into hydra migrate command?)
43+
environment:
44+
- LOG_LEAK_SENSITIVE_VALUES=true
45+
- URLS_SELF_ISSUER=http://127.0.0.1:4444
46+
- URLS_SELF_PUBLIC=http://127.0.0.1:4444
47+
- URLS_CONSENT=http://127.0.0.1:3000/auth/hydra/consent
48+
- URLS_LOGIN=http://127.0.0.1:3000/auth/hydra/login
49+
- URLS_LOGOUT=http://127.0.0.1:3000/logout
50+
- SECRETS_SYSTEM=youReallyNeedToChangeThis
51+
- OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=public,pairwise
52+
- OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=youReallyNeedToChangeThis
53+
- DSN=postgres://pguser:secret@postgresd:5432/hydra?sslmode=disable
54+
networks:
55+
- intranet
56+
57+
kratos-selfservice-ui-node:
58+
build:
59+
context: ../..
60+
dockerfile: Dockerfile
61+
environment:
62+
- HYDRA_ADMIN_URL=http://hydra:4445
63+
- KRATOS_PUBLIC_URL=http://kratos:4433/
64+
- KRATOS_ADMIN_URL=http://kratos:4434/
65+
- SECURITY_MODE=standalone
66+
ports:
67+
- "3000:3000"
68+
networks:
69+
- intranet
70+
71+
kratos-migrate:
72+
image: oryd/kratos:v0.4.6-sqlite
73+
environment:
74+
- DSN=sqlite:///var/lib/sqlite/db.sqlite?_fk=true&mode=rwc
75+
volumes:
76+
-
77+
type: volume
78+
source: kratos-sqlite
79+
target: /var/lib/sqlite
80+
read_only: false
81+
-
82+
type: bind
83+
source: ./kratos
84+
target: /etc/config/kratos
85+
command:
86+
-c /etc/config/kratos/.kratos.yml migrate sql -e --yes
87+
restart: on-failure
88+
networks:
89+
- intranet
90+
91+
kratos:
92+
depends_on:
93+
- kratos-migrate
94+
image: oryd/kratos:v0.4.6-sqlite
95+
ports:
96+
- "4433:4433" # public
97+
- "4434:4434" # admin
98+
restart: unless-stopped
99+
environment:
100+
- DSN=sqlite:///var/lib/sqlite/db.sqlite?_fk=true
101+
command:
102+
serve -c /etc/config/kratos/.kratos.yml --dev
103+
volumes:
104+
-
105+
type: volume
106+
source: kratos-sqlite
107+
target: /var/lib/sqlite
108+
read_only: false
109+
-
110+
type: bind
111+
source: ./kratos
112+
target: /etc/config/kratos
113+
networks:
114+
- intranet
115+
116+
# Sending emails is not part of this demo, so this is commented out:
117+
#
118+
# mailslurper:
119+
# image: oryd/mailslurper:latest-smtps
120+
# ports:
121+
# - "4436:4436"
122+
# - "4437:4437"
123+
# networks:
124+
# - intranet
125+
126+
networks:
127+
intranet:
128+
129+
volumes:
130+
kratos-sqlite:

‎contrib/hydra/kratos/.kratos.yml

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
serve:
2+
public:
3+
base_url: http://127.0.0.1:3000/.ory/kratos/public/
4+
admin:
5+
base_url: http://kratos:4434/
6+
7+
selfservice:
8+
default_browser_return_url: http://127.0.0.1:3000/
9+
whitelisted_return_urls:
10+
- http://127.0.0.1:3000/
11+
- http://127.0.0.1:3000/auth/hydra/login
12+
13+
strategies:
14+
password:
15+
enabled: true
16+
17+
flows:
18+
settings:
19+
ui_url: http://127.0.0.1:3000/settings
20+
21+
verification:
22+
ui_url: http://127.0.0.1:3000/verification
23+
enabled: false
24+
25+
recovery:
26+
ui_url: http://127.0.0.1:3000/recovery
27+
enabled: false
28+
29+
logout:
30+
after:
31+
default_browser_return_url: http://127.0.0.1:3000/auth/login
32+
33+
login:
34+
ui_url: http://127.0.0.1:3000/auth/login
35+
36+
registration:
37+
ui_url: http://127.0.0.1:3000/auth/registration
38+
after:
39+
password:
40+
hooks:
41+
-
42+
hook: session
43+
44+
log:
45+
level: debug
46+
47+
hashers:
48+
argon2:
49+
parallelism: 1
50+
memory: 131072
51+
iterations: 2
52+
salt_length: 16
53+
key_length: 16
54+
55+
identity:
56+
default_schema_url: file:///etc/config/kratos/identity.schema.json
57+
58+
courier:
59+
smtp:
60+
connection_uri: smtps://test:test@mailslurper:1025/?skip_ssl_verify=true

‎contrib/hydra/kratos/identity.schema.json

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"$id": "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
3+
"$schema": "http://json-schema.org/draft-07/schema#",
4+
"title": "Person",
5+
"type": "object",
6+
"properties": {
7+
"traits":{
8+
"type": "object",
9+
"properties": {
10+
11+
"email": {
12+
"type": "string",
13+
"format": "email",
14+
"title": "E-Mail",
15+
"minLength": 3,
16+
"ory.sh/kratos": {
17+
"credentials": {
18+
"password": {
19+
"identifier": true
20+
}
21+
}
22+
}
23+
}
24+
},
25+
"required": [
26+
"email"
27+
]
28+
}
29+
},
30+
"additionalProperties": false
31+
}

‎contrib/hydra/pg-init/pg-init.sh

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/bin/bash
2+
3+
set -e
4+
set -u
5+
6+
function create_user_and_database() {
7+
local database=$1
8+
echo " Creating user and database '$database'"
9+
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL
10+
CREATE USER $database;
11+
CREATE DATABASE $database;
12+
GRANT ALL PRIVILEGES ON DATABASE $database TO $database;
13+
EOSQL
14+
}
15+
16+
if [ -n "$POSTGRES_MULTIPLE_DATABASES" ]; then
17+
echo "Multiple database creation requested: $POSTGRES_MULTIPLE_DATABASES"
18+
for db in $(echo $POSTGRES_MULTIPLE_DATABASES | tr ',' ' '); do
19+
create_user_and_database $db
20+
done
21+
echo "Multiple databases created"
22+
fi

0 commit comments

Comments
 (0)