ory/hydra
17,236 Stars·1,583 Forks·Go·Apache-2.0·17 Aufrufewww.ory.com/?utm_source=github&utm_medium=banner&utm_campaign=hydra↗
Hydra
Hydra is a headless identity server that functions as a certified OAuth2 and OpenID Connect provider. It is designed as an authentication engine that manages authorization handshakes and token lifecycles while remaining decoupled from the user interface.
The project distinguishes itself through a headless architecture, allowing external management of login and consent flows. It provides specialized capabilities for dynamic client registration, JSON Web Token issuance, and a system for rotating encryption secrets without service downtime.
The system covers a broad range of identity operations, including the orchestration of authentication sequences, identity provisioning, and token lifecycle management. It supports state persistence via adapters for PostgreSQL, MySQL, and CockroachDB, and includes observability tools through Prometheus-compatible metrics and distributed tracing.
Administrative access is managed through port-based API isolation to separate privileged endpoints from public-facing protocol APIs.
Features
- Identity Providers - Functions as a centralized identity provider delivering unified authentication and authorization via standard protocols.
- Identity Servers - Provides a centralized platform for authentication, authorization, and federation services as a headless server.
- Headless Architectures - Implements a headless architecture that decouples identity protocol logic from the user interface via management APIs.
- JWT Format Tokens - Generates access tokens in JSON Web Token format to enable local verification by clients.
- API Access Control - Secures APIs by issuing JWT access tokens and managing scopes to control resource permissions.
- Login and Consent Handlers - Provides secure endpoints to accept or reject user authentication and scope authorization requests.
- Authentication Scope Management - Validates and matches requested OAuth2 scopes to control client access levels.
- Authorization Handshake APIs - Exposes APIs to implement the technical handshake of authentication without prescribing the user interface.
- Authentication Orchestration - Coordinates complex authentication and authorization sequences, including login and user consent flows.
- Client Registration Protocols - Implements standardized procedures for the secure onboarding and registration of new client applications.
- Identity Provider Integrations - Integrates existing user databases with the authorization server to manage login and consent flows.
- Identity Token Services - Issues cryptographically signed JSON Web Tokens to authorize access to protected resources.
- Key Management - Manages the generation and rotation of cryptographic key pairs for signing tokens.
- OAuth2 Client Management - Provides tools for registering and scoping external application access via OAuth2.
- OAuth2 Implementations - Implements standard OAuth2 authorization sequences, including code, implicit, and hybrid flows.
- OIDC Identity Token Issuance - Acts as an OIDC provider to issue identity tokens based on internal roles.
- OIDC Protocol Implementations - Executes standardized OpenID Connect authorization flows and discovery endpoints for specification compatibility.
- OpenID Connect Providers - Functions as a certified OpenID Connect and OAuth2 provider for standardized single sign-on.
- Token Validation - Verifies that requested scopes and audiences are whitelisted before issuing new tokens during refresh.
- Single Sign-On Solutions - Enables users to authenticate once and access multiple independent applications via standardized identity protocols.
- Application Registration - Provides mechanisms for registering third-party applications that request access to protected resources.
- OAuth2 Access Token Issuance - Generates signed JSON Web Tokens as access tokens to facilitate secure resource authorization.
- Token Management - Provides headless APIs to manage the full lifecycle of active access tokens.
- JSON Web Tokens - Issues signed JSON Web Tokens containing identity and session data for local verification by relying parties.
- CockroachDB Integrations - Supports state and configuration persistence using CockroachDB.
- PostgreSQL Persistence - Utilizes PostgreSQL to ensure reliable storage of identity and authorization data across restarts.
- MySQL Integrations - Supports state and identity data persistence using MySQL.
- Authorization State Adapters - Uses interchangeable database adapters to maintain authorization state across PostgreSQL, MySQL, and CockroachDB.
- OIDC Discovery - Publishes a standardized discovery endpoint to provide clients with authentication, token, and authorization server locations.
- Dynamic Client Registrations - Implements dynamic client registration and trust establishment using metadata and dynamic endpoints.
- Token Metadata Retrievals - Implements a secure validation endpoint for inspecting the metadata and current status of access and refresh tokens.
- Audience Restrictions - Ensures access tokens are only used at authorized endpoints by defining the intended audience.
- Lifespan Configuration - Provides configurable expiration timeouts for login, consent, and refresh tokens.
- Client Authentication Configurations - Allows defining whether a client authenticates at the token endpoint using HTTP Basic or a POST body.
- Automated Secret Rotation - Maintains a rotation array of encryption keys to allow seamless secret updates without service downtime.
- OAuth 2.1 Implementations - Adheres to the latest OAuth 2.1 standards for internet-scale authentication.
- Refresh Token Grants - Supports the issuance of new identity tokens during refresh token grant flows.
- JWKS Distribution - Exposes a JSON Web Key Set endpoint for clients to verify signed tokens using rotating public keys.
- Token Introspection - Implements token revocation and introspection to verify and invalidate active security tokens.
- Session Termination Services - Executes front-channel and back-channel logout flows to terminate user sessions across identity providers.
- Identity and Access Providers - Open-source server for OIDC and OAuth2 protocols.
- API Security - High-performance OAuth2 and OpenID Connect server implementation.
- Cryptography and Identity - Hardened OAuth 2.0 and OpenID Connect provider.
- Sicherheit und Datenschutz - OpenID Connect and OAuth2 provider.
