Custom Provider

ORY Hydra
#1

Hi

First i must say im amazed with the ORY stack.

In the other hand, im a noob in what security matters, saying that in my company we are trying to migrate our security made over Keycloak with a custom provider that communicates to an Ahuthenticator.

Is this possible with ORY ? iv seen Hydra specs:

ORY Hydra is an OpenID Certified™ OAuth2 and OpenID Connect Provider can connect to any existing identity database (LDAP, AD, KeyCloak, PHP+MySQL, …) and user interface.

But is hard to find documentation regarding to the quote, and what even means “user interface” ?

Thanks.

#2

I don’t understand the question, you want to use Hydra and Keycloak together?

#3

No, as i said we are trying to migrate from Keycloak to Hydra.The issue, we own a custom provider over Keycloak (so authentication occurs in other platform). Is that possible on Hydra?

1 Like
#4

Yes, that is the core concept behind Hydra :slight_smile:

#5

But i couldn’t find documentation about integrations or code examples on how to do it. Also if you search stuff on the docs seems to be broken. :frowning_face:

#6

What is broken for you wrt search?

#7

I did search for “LDAP” but couldnt find anything regarding to it.

The Login Flow and Consent Flow, if im not wrong both talk about connecting two OAuth services basically. What i need is a Authorization Provider (without OAuth). To own the login screen on ORY and then ask if the credencials are OK in other platform.

#8

No, you misunderstood. Please re-read the relevant parts in the docs and check out the 5 minute quickstart guide etc!

There is no mention of LDAP because we do not support LDAP directly, you have to implement the „bridge“ between Hydra and your login solution yourself!

#9

Yes i misunderstood, the Hydra details say that ^ so i got Confused. I will try to read more about the “bridge” (provider) implementation.

Thanks.

#10

@cristiandley KeyCloak is different because it’s a full identity stack while Hydra just orchestrate the OAuth workflows with some level of session management.

What @hackerman means by “bridge” is this:

  • You have to configure hydra to redirect to a login service (you have to write this one on your own)
  • In your login service, you should perform the auth (trough LDAP or whatever protocol you are using) and based on the auth result accept or deny the login request.

Cheers,

Asaf.

#11

@asaf000 first, thanks (when i said custom provider, i refered to the concept of “bridge”, we are on the same page now).

You have to configure hydra to redirect to a login service (you have to write this one on your own)

Is this example the same thing? https://github.com/ory/hydra-login-consent-node

Thanks

#12

@cristiandley yea if you like node, you can fork this and your own logic instead of this