Ory Hydra/Kratos Integration in Go

[atreya2011]

Hi everyone!

I have created an extremely simple hydra + kratos implementation in Go. Should be easy to follow and translate to any other language of your choice.
It's WIP and does not have a README at the moment. Planning to add instructions on how to spin everything up within the next few days.

https://github.com/atreya2011/go-kratos-test without hydra
https://github.com/atreya2011/go-kratos-test/tree/hydra-consent with hydra

Diff
https://github.com/atreya2011/go-kratos-test/compare/hydra-consent

I have used the following versions and planning to keep them up to date to the best of my ability 🙇🏼‍♂️

• Kratos v0.8.0-alpha.3
• Hydra v1.10.6

There are 4 branches at the moment:

• main: contains a kratos only implementation
• hydra: kratos + hydra without consent page implementation
• hydra-consent: kratos + hydra with a yet to implement consent page
• microsoft-oidc: kratos only implementation with Microsoft social login (as an answer to this StackOverflow question: https://stackoverflow.com/questions/70034185/ory-kratos-login-page-for-login-with-microsoft)

To try out the kratos only implementation, you need to have Docker installed and then do the following:

1. Clone the repository locally.
2. Run docker-compose up --build in one terminal session
3. Then in your browser, open, http://localhost:4455/login

To try out the reference kratos + hydra implementation, you need to have

• Docker installed
• Register a dummy account first using the kratos only implementation in the main branch! Sorry about this 🙇🏼‍♂️

And then do the following:

1. Clone the repository locally.

2. git checkout hydra-consent

3. Run docker-compose up --build in one terminal session (in case hydra fails to startup, run docker-compose down and docker-compose up --build again)

4. In yet another terminal session, create an OAuth2 Client

docker-compose exec hydra \
    hydra clients create \
    --endpoint http://127.0.0.1:4445 \
    --id auth-code-client \
    --secret secret \
    --grant-types authorization_code,refresh_token \
    --response-types code,id_token \
    --scope openid,offline \
    --callbacks http://127.0.0.1:5555/callback

5. And perform an OAuth2 Authorize Code Flow

docker-compose exec hydra \
    hydra token user \
    --client-id auth-code-client \
    --client-secret secret \
    --endpoint http://127.0.0.1:4444/ \
    --port 5555 \
    --scope openid,offline

I still have to address the following issues:

• Consent UI Implementation
• User breaks login flow if they try to register a new account and gets back to the login screen (keep a hydra login flow state like the reference Node.js implementation, and this is the reason why an account has to be registered first using the kratos only implementation before trying out the hydra integration branch)

[aeneasr]

Great stuff! :))

[atreya2011]

Great stuff! :))

Thank you 🙇🏼‍♂️

[allenhaozi]

awesome job

[atreya2011]

awesome job

Thank you! It's still a work in progress and I am slowly ironing out a few issues...

[kevinan9]

How does Hydra talk to Kratos? or vice versa. Thanks.

[atreya2011]

@Kaanapali
Sorry for not being to get back sooner. In my example implementation, I am just kick-starting the Kratos login flow once the user hits /login endpoint.
The detailed implementation can be found here: https://github.com/atreya2011/go-kratos-test/blob/b0515620dc3e3eb9c9995b1bbd55f0cc2907c7ee/main.go#L193
Let me know if you need any clarification regarding this 🙏🏼

[atreya2011]

A flow diagram for anyone interested in how my implementation coordinates request/response with Kratos and Hydra 🙏🏼

[hiendaovinh]

I have problems with glueing both Kratos and Hydra migrations together. kratos-migrate or hydra-migrate would fail because table networks already exists. Any suggestion?

[hiendaovinh]

An error occurred while connecting to SQL: error executing migrations/sql/20150100000001000000_networks.postgres.up.sql, sql: CREATE TABLE "networks"

ERROR: relation "networks" already exists (SQLSTATE 42P07)

[hiendaovinh]

Use two separate schema/db for kratos and hydra

[vinckr]

Hey @hiendaovinh @atreya2011
The Ory Kratos and Ory Hydra integration just landed with Hydra 2.0,
see the release notes for more details!

[ma-hartma]

Hi @vinckr, that's great news! I am really looking forward to using the kratos/hydra integration.

The release notes say:

Ory Identities is now compatible with the Ory OAuth2 Login and Consent Flow. This means, for example, that Ory Kratos can be the login provider for Ory Hydra with a bit of configuration.

I've looked through all the docs but couldn't find an example how to configure it. Do you know where to find it?

[hiendaovinh]

Congrats with the release!
Do you have documentation with the integration and ES256 JWT configuration?
Thank you! @vinckr

[vinckr]

For anyone looking this is a good summary of how it looks currently:
ory/kratos#2976 (comment)

[atreya2011]

@vinckr Thank you for the update! I will update my code to reflect the latest versions of both Hydra and Kratos.

[atreya2011]

@vinckr
It took a while but I finally found the time to update my example implementation to the latest version of Kratos and Hydra :)
https://github.com/atreya2011/go-kratos-test/tree/hydra-consent

@everyone
I have updated the quickstart instructions in the README file 🙇
https://github.com/atreya2011/go-kratos-test/tree/hydra-consent#readme