• Stars
    star
    3,220
  • Rank 13,944 (Top 0.3 %)
  • Language
    Go
  • License
    Apache License 2.0
  • Created about 7 years ago
  • Updated 3 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go.

ORY Oathkeeper - Cloud Native Identity & Access Proxy


Build Status Coverage Status Go Report Card PkgGoDev

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. The BeyondCorp Model is designed by Google and secures applications in Zero-Trust networks.

An Identity & Access Proxy is typically deployed in front of (think API Gateway) web-facing applications and is capable of authenticating and optionally authorizing access requests. The Access Control Decision API can be deployed alongside an existing API Gateway or reverse proxy. ORY Oathkeeper's Access Control Decision API works with:

among others.

This service is stable, but under active development and may introduce breaking changes in future releases. Any breaking change will have extensive documentation and upgrade instructions.

Ory Network Hybrid Support Plan

Ory offers a support plan for Ory Network Hybrid, including Ory on private cloud deployments. If you have a self-hosted solution and would like help, consider a support plan! The team at Ory has years of experience in cloud computing. Ory's offering is the only official program for qualified support from the maintainers. For more information see the website or book a meeting!

Project Renaming

The Ory Oathkeeper project was started in 2017 in Germany and owes its name to the Sword Oathkeeper from Game of Thrones. We also understand that the name is politically charged in the US as it is shared with a far-right militia organization in the US called "Oath Keepers".

To take a stand against extremism and avoid any confusion to the name's origin, we will be renaming the project in the near future. Please be patient with us as we work on this complicated change of various CIs, tools, scripts, and automations.


Installation

Head over to the ORY Developer Documentation to learn how to install ORY Oathkeeper on Linux, macOS, Windows, and Docker and how to build ORY Oathkeeper from source.

Who's using it?

The Ory community stands on the shoulders of individuals, companies, and maintainers. The Ory team thanks everyone involved - from submitting bug reports and feature requests, to contributing patches and documentation. The Ory community counts more than 33.000 members and is growing rapidly. The Ory stack protects 60.000.000.000+ API requests every month with over 400.000+ active service nodes. None of this would have been possible without each and everyone of you!

The following list represents companies that have accompanied us along the way and that have made outstanding contributions to our ecosystem. If you think that your company deserves a spot here, reach out to [email protected] now!

Type Name Logo Website
Adopter * Raspberry PI Foundation Raspberry PI Foundation raspberrypi.org
Adopter * Kyma Project Kyma Project kyma-project.io
Adopter * Tulip Tulip Retail tulip.com
Adopter * Cashdeck / All My Funds All My Funds cashdeck.com.au
Adopter * Hootsuite Hootsuite hootsuite.com
Adopter * Segment Segment segment.com
Adopter * Arduino Arduino arduino.cc
Adopter * DataDetect Datadetect unifiedglobalarchiving.com/data-detect/
Adopter * Sainsbury's Sainsbury's sainsburys.co.uk
Adopter * Contraste Contraste contraste.com
Adopter * Reyah Reyah reyah.eu
Adopter * Zero Project Zero by Commit getzero.dev
Adopter * Padis Padis padis.io
Adopter * Cloudbear Cloudbear cloudbear.eu
Adopter * Security Onion Solutions Security Onion Solutions securityonionsolutions.com
Adopter * Factly Factly factlylabs.com
Adopter * Nortal Nortal nortal.com
Adopter * OrderMyGear OrderMyGear ordermygear.com
Adopter * Spiri.bo Spiri.bo spiri.bo
Adopter * Strivacity Spiri.bo strivacity.com
Adopter * Hanko Hanko hanko.io
Adopter * Rabbit Rabbit rabbit.co.th
Adopter * inMusic InMusic inmusicbrands.com
Adopter * Buhta Buhta buhta.com
Adopter * Connctd Connctd connctd.com
Adopter * Paralus Paralus paralus.io
Adopter * TIER IV TIER IV tier4.jp
Adopter * R2Devops R2Devops r2devops.io
Adopter * LunaSec LunaSec lunasec.io
Adopter * Serlo Serlo serlo.org
Adopter * dyrector.io dyrector.io dyrector.io
Adopter * Stackspin stackspin.net stackspin.net
Adopter * Amplitude amplitude.com amplitude.com
Adopter * Pinniped pinniped.dev pinniped.dev
Adopter * Pvotal pvotal.tech pvotal.tech

Many thanks to all individual contributors

* Uses one of Ory's major projects in production.

Ecosystem

We build Ory on several guiding principles when it comes to our architecture design:

  • Minimal dependencies
  • Runs everywhere
  • Scales without effort
  • Minimize room for human and network errors

Ory's architecture is designed to run best on a Container Orchestration system such as Kubernetes, CloudFoundry, OpenShift, and similar projects. Binaries are small (5-15MB) and available for all popular processor types (ARM, AMD64, i386) and operating systems (FreeBSD, Linux, macOS, Windows) without system dependencies (Java, Node, Ruby, libxml, ...).

Ory Kratos: Identity and User Infrastructure and Management

Ory Kratos is an API-first Identity and User Management system that is built according to cloud architecture best practices. It implements core use cases that almost every software application needs to deal with: Self-service Login and Registration, Multi-Factor Authentication (MFA/2FA), Account Recovery and Verification, Profile, and Account Management.

Ory Hydra: OAuth2 & OpenID Connect Server

Ory Hydra is an OpenID Certified™ OAuth2 and OpenID Connect Provider which easily connects to any existing identity system by writing a tiny "bridge" application. It gives absolute control over the user interface and user experience flows.

Ory Oathkeeper: Identity & Access Proxy

Ory Oathkeeper is a BeyondCorp/Zero Trust Identity & Access Proxy (IAP) with configurable authentication, authorization, and request mutation rules for your web services: Authenticate JWT, Access Tokens, API Keys, mTLS; Check if the contained subject is allowed to perform the request; Encode resulting content into custom headers (X-User-ID), JSON Web Tokens and more!

Ory Keto: Access Control Policies as a Server

Ory Keto is a policy decision point. It uses a set of access control policies, similar to AWS IAM Policies, in order to determine whether a subject (user, application, service, car, ...) is authorized to perform a certain action on a resource.

Security

Disclosing vulnerabilities

If you think you found a security vulnerability, please refrain from posting it publicly on the forums, the chat, or GitHub. You can find all info for responsible disclosure in our security.txt.

Telemetry

Our services collect summarized, anonymized data which can optionally be turned off. Click here to learn more.

Documentation

Guide

The Guide is available here.

HTTP API documentation

The HTTP API is documented here.

Upgrading and Changelog

New releases might introduce breaking changes. To help you identify and incorporate those changes, we document these changes in UPGRADE.md and CHANGELOG.md.

Command line documentation

Run oathkeeper -h or oathkeeper help.

Develop

Developing with ORY Oathkeeper is as easy as:

$ cd ~
$ go get -d -u github.com/ory/oathkeeper
$ cd $GOPATH/src/github.com/ory/oathkeeper
$ export GO111MODULE=on
$ go test ./...

More Repositories

1

hydra

OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid.
Go
14,588
star
2

kratos

Next-gen identity server (think Auth0, Okta, Firebase) with Ory-hardened authentication, MFA, FIDO2, TOTP, WebAuthn, profile management, identity schemas, social sign in, registration, account recovery, passwordless. Golang, headless, API-only - without templating or theming headaches. Available as a cloud service.
Go
8,361
star
3

keto

Open Source (Go) implementation of "Zanzibar: Google's Consistent, Global Authorization System". Ships gRPC, REST APIs, newSQL, and an easy and granular permission language. Supports ACL, RBAC, and other access models.
Go
4,745
star
4

dockertest

Write better integration tests! Dockertest helps you boot up ephermal docker images for your Go tests with minimal work.
Go
3,676
star
5

fosite

Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.
Go
2,300
star
6

ladon

A SDK for access control policies: authorization for the microservice and IoT age. Inspired by AWS IAM policies. Written for Go.
Go
2,280
star
7

k8s

Kubernetes Helm Charts for the ORY ecosystem.
Mustache
330
star
8

kratos-selfservice-ui-node

TypeScript
278
star
9

hydra-login-consent-node

This is an ExpressJS reference implementation for the ORY Hydra User Login and Consent interface written in TypeScript and ExpressJS.
TypeScript
266
star
10

go-acc

Accurate Code Coverage reporting for Golang (Go)
Go
208
star
11

sdk

The place where ORY's SDKs are being auto-generated
PHP
137
star
12

docs

The Ory documentation
TypeScript
132
star
13

examples-archive

THIS REPOSITORY IS NOT UP TO DATE. Different docker-based examples for ORY's services (Hydra, Keto, Oathkeeper).
Shell
129
star
14

graceful

A best practice http server set up that supports graceful shutdown
Go
123
star
15

examples

A curated collection of examples and solutions created and maintained by the Ory Community.
JavaScript
103
star
16

x

Libraries used in the Ory ecosystem
Go
86
star
17

elements

Ory Elements is a component library that makes building login, registration and account pages for Ory a breeze. Check out the components library on Chromatic https://www.chromatic.com/library?appId=63b58e306cfd32348fa48d50
TypeScript
85
star
18

herodot

A lightweight Go library for writing responses and errors to HTTP
Go
82
star
19

kratos-selfservice-ui-react-nextjs

A full reference implementation for designing your own login, registration, recovery, verification, ... pages using Ory Kratos' APIs.
TypeScript
81
star
20

network

Ory runs a global end-to-end security infrastructure for humans, robots, and servers. We build and use open source software.
80
star
21

kratos-selfservice-ui-react-native

A reference implementation of an app using ORY Kratos for auth (login), sign up (registration), profile settings (update password), MFA/2FA, account recovery (password reset), and more for React Native. This repository is available as an expo template!
TypeScript
68
star
22

fosite-example

Go
66
star
23

kratos-client-go

Shell
55
star
24

cli

Create bulk action scripts, automate your tasks, manage your projects, and seamlessly interact with the Ory Network using the Ory command line interface (CLI).
Go
42
star
25

hydra-consent-app-go

A simple consent app for Hydra written in Go - for Hydra =< 1.0.0
Go
41
star
26

jobs

Want to build the next generation identity stack? You've come to the right place!
37
star
27

hydra-consent-app-express

A simple nodejs consent app based on express - for Hydra =< 1.0.0
JavaScript
37
star
28

hydra-client-go

Shell
34
star
29

oathkeeper-maester

Kuberenetes CRD Controller for Ory Oathkeeper. ⚠️ Maintained by the community, not an official Ory project!
Go
33
star
30

osin-storage

PostgreSQL storage backend for RangelReale osin OAuth2
Go
33
star
31

hydra-maester

Kuberenetes CRD Controller for Ory Hydra. ⚠️ Maintained by the community, not an official Ory project!
Go
32
star
32

web

www.ory.sh
TypeScript
25
star
33

hydra-client-java

Java
25
star
34

kratos-nextjs-react-example

Add login, registration, account recovery (password reset), account verification (email verification), social sign in, multi-factor authentication to your Next.js / React App using Ory!
TypeScript
25
star
35

status

DEPRECATED
Markdown
21
star
36

closed-reference-notifier

A GitHub action to open an issue when GitHub references in your code are closed.
TypeScript
20
star
37

hydra-js

DOES NOT WORK WITH VERSIONS > 0.10.0 - A simple library to help you build node-based identity providers that work with Hydra.
JavaScript
18
star
38

go-convenience

Well-tested helpers for dealing with daily problems in Go.
Go
18
star
39

defcon-30-ctf

Go
17
star
40

meta

A place where we plan and schedule our open source activities and track cross-project and ory-wide issues
Shell
17
star
41

redux-saga-fetch

A simple wrapper that reduces boilerplate code when using redux-saga in combination with async backend calls.
TypeScript
16
star
42

hydra-client-php

PHP
15
star
43

integrations

TypeScript
14
star
44

kratos-client-php

PHP
14
star
45

keto-client-go

Shell
14
star
46

build-buf-action

A GitHub action to build and lint protobuf using buildbuf
Shell
13
star
47

encrypt-dir

A very simple cli helper that encrypts files in directories using AES-GCM (128bit)
Go
13
star
48

summit

This repository holds all material related to the Ory Summit, specifically the presentations.
11
star
49

common

Ory's cross-project go libraries, intended for internal use.
Go
11
star
50

client-go

Shell
11
star
51

docusaurus-template

DEPRECATED
JavaScript
10
star
52

works

This repository shows examples of practical solutions using Ory projects and other OSS
Go
10
star
53

oathkeeper-client-go

Shell
10
star
54

ladon-community

Go
9
star
55

ci

Automation and robots for Ory's CI and CD pipelines
Shell
7
star
56

kratos-client-js

Autogenerated kratos SDK.
7
star
57

keto-client-java

Java
7
star
58

kratos-client-rust

Autogenerated kratos SDK.
Rust
7
star
59

kratos-client-java

Java
6
star
60

oathkeeper-client-php

PHP
6
star
61

keto-client-php

PHP
6
star
62

client-dotnet

Autogenerated client SDK.
C#
6
star
63

hydra-auth0-consent-sdk

A NodeJS library for working with Auth0 as an Identity Provider
JavaScript
6
star
64

kratos-client-ruby

Autogenerated kratos SDK.
Ruby
6
star
65

ory-config

A small Web App for configuring Ory systems built in VueJs 2.x
Vue
6
star
66

ory-sdk-go

Go
6
star
67

kratos-client-dart

Autogenerated kratos SDK.
Dart
5
star
68

ory-sdk-archive

Shell
5
star
69

pagination

Go
5
star
70

client-php

PHP
5
star
71

milestone-action

JavaScript
5
star
72

eslint-config-ory-am-react

The ESLint configuration used by Ory (React specific)
JavaScript
5
star
73

themes

TypeScript
5
star
74

open-source-support

Are you looking for help above and beyond our community self service support?
5
star
75

kratos-maester

5
star
76

hydra-client-dart

Autogenerated hydra SDK.
Dart
4
star
77

hydra-client-js

Autogenerated hydra SDK.
4
star
78

homebrew-tap

Location for all of Ory's homebrew packages
Ruby
4
star
79

label-sync-action

JavaScript
4
star
80

summit-platform

TypeScript
4
star
81

kratos-client-python

Autogenerated kratos SDK.
Python
4
star
82

keto-maester

4
star
83

metrics-middleware

A simple metrics middleware for segment.io
Go
4
star
84

sdk-js

JavaScript
4
star
85

client-java

Java
4
star
86

client-js

Autogenerated client SDK.
4
star
87

eslint-config-ory-am

The ESLint configuration used by Ory
JavaScript
3
star
88

changelog

Ory Changelog Generator
JavaScript
3
star
89

scoop

3
star
90

ory-client-go

3
star
91

slack-invite

3
star
92

oathkeeper-client-dotnet

Autogenerated oathkeeper SDK.
C#
3
star
93

oathkeeper-client-js

Autogenerated oathkeeper SDK.
3
star
94

hydra-oracle-plugin

Go
3
star
95

hydra-client-ruby

Autogenerated hydra SDK.
Ruby
3
star
96

hydra-client-rust

Autogenerated hydra SDK.
Rust
3
star
97

release

Release infrastructure for ORY and related components
HTML
3
star
98

hydra-client-dotnet

Autogenerated hydra SDK.
C#
3
star
99

homebrew-kratos

Ruby
3
star
100

keto-client-python

Autogenerated keto SDK.
3
star