ory/kratos

Features

• Multi-Factor Authentication - Secures user accounts by requiring additional verification steps like TOTP, WebAuthn, or email during the login process.
• Identity and Access Management - Provides a comprehensive identity and access management system for user registration, profile management, and multi-factor authentication.
• Identity and Access Management Servers - Acts as a centralized identity management server for user registration, authentication, and profile management.
• OAuth2 Implementations - Ensures secure token exchange by implementing appropriate flows like Authorization Code with PKCE for various application types.
• OAuth2 Providers - Functions as a standards-compliant OAuth2 and OIDC provider for token issuance and delegated access management.
• Relationship-Based Models - Implements complex relationship-based permission models to manage granular access across distributed systems.
• Relationship-Based Access Controls - Enforces granular access rights based on defined relationships between users and resources.
• Access Control and Authorization - Models complex access control requirements by defining namespaces, relations, and permissions.
• JWT Session Management - Maintains user sessions using cryptographically signed tokens that track identity metadata across services.
• OAuth2 Client Management - Identifies and authenticates applications during authorization flows by registering redirect URIs and managing client credentials.
• OIDC Identity Token Issuance - Verifies user identity and session information securely by requesting ID tokens alongside standard OAuth2 access tokens.
• Permission Management - Verifies user access by validating subject, permission, and object combinations before performing sensitive actions.
• Identity Federation - Integrates external identity providers using standard protocols to manage access across distributed systems.
• State Machine Orchestrators - Manages complex authentication and registration processes as stateful flows with persistent history.
• Graph Processing - Evaluates access rights by traversing directed graphs of relationships between subjects and objects.
• Authentication Flows - Supports headless authentication workflows via JSON APIs for flexible integration across web, mobile, and desktop platforms.
• Authentication Login Handlers - Delegates authentication to a custom application by handling login challenges and accepting or rejecting requests.
• Authentication CLI - Authenticates terminal sessions using browser flows or API keys for secure command-line access.
• Identity Management - Maps user fields to identity management functions like password recovery and multi-factor authentication.
• Flow Orchestrators - Orchestrates complex authentication state and security flows across diverse client interfaces.
• Permission Systems - Provides a dedicated language for modeling relationships and permissions to power global access control logic.
• API Decoupling - Separates user interface and backend layers through interface contracts to enable custom authentication experiences.
• Identity and Access Management - Handles user registration, login, and profile management workflows.
• Security And Privacy - Cloud-native authentication and identity management.
• JSON Schema Modeling - Enforces data validation and consistency for user identity structures using standard schema files.
• Client SDKs - Provides language-specific packages to simplify authentication and data retrieval tasks.
• Authorization Testing - Validates access control logic through manual API checks and automated test suites.
• Multi-Factor Authentication - Enforces multi-factor authentication using TOTP and WebAuthn to secure user account access.
• Authorization Middleware - Retrieves authorized resources by querying objects or subjects associated with specific users or relations.
• Consent Bypasses - Provides automated authorization bypasses for trusted first-party applications to streamline user login flows.
• Flow Initialization - Prepares the environment for user registration by setting up anti-CSRF tokens across browser, API, and mobile client platforms.
• Input Validation Schemas - Validates user input against defined identity schemas to handle errors related to password policies or missing required fields.
• Lifecycle Event Hooks - Executes custom business logic at specific stages of the identity lifecycle via event hooks.
• Registration Hooks - Streamlines user onboarding by automatically issuing sessions immediately after successful account creation using post-registration hooks.
• Relationship Management - Determines user access by expanding relationship trees to identify the underlying reasons for granted permissions.
• Project Scaffolding and Configuration - Generates new workspaces and project containers through the terminal to organize development resources.
• Webhook Configuration - Customizes OAuth2 token claims during issuance or refresh by registering a webhook endpoint.
• Identity Tracking Systems - Determines if a user has completed enough authentication factors to perform sensitive operations by tracking session assurance levels.

Star history