ory/kratos
13,455 stele·1,106 fork-uri·Go·apache-2.0·11 vizualizăriwww.ory.com/?utm_source=github&utm_medium=banner&utm_campaign=kratos↗
Kratos
Kratos is a centralized identity and access management server designed to handle user registration, authentication, and profile management. It functions as an identity flow orchestrator, managing the state and security of authentication processes across web, mobile, and command-line interfaces. The system provides a standards-compliant authorization server that issues tokens and manages delegated access for third-party applications and internal services, supporting multi-factor authentication and custom identity schemas to secure user accounts.
The project distinguishes itself through a headless architecture that decouples identity flows from the user interface. By providing JSON-based API responses, it allows developers to build custom authentication experiences for any platform. It also implements a relationship-based access control model, which evaluates permissions by traversing a directed graph of relationships between subjects and objects. This approach enables fine-grained access control, allowing developers to model complex authorization requirements and verify user permissions dynamically across distributed software systems.
Beyond core identity and authorization, the platform includes extensive developer tooling, such as language-specific client libraries and a command-line interface for managing projects and authentication sessions. It supports lifecycle extensions through hooks, allowing custom business logic to trigger after specific identity events. The system also provides robust session management using cryptographically signed tokens that track authentication assurance levels, ensuring consistent security across disparate application boundaries.
Features
- Multi-Factor Authentication - Secures user accounts by requiring additional verification steps like TOTP, WebAuthn, or email during the login process.
- Identity and Access Management - Provides a comprehensive identity and access management system for user registration, profile management, and multi-factor authentication.
- Identity and Access Management Servers - Acts as a centralized identity management server for user registration, authentication, and profile management.
- OAuth2 Implementations - Ensures secure token exchange by implementing appropriate flows like Authorization Code with PKCE for various application types.
- OAuth2 Providers - Functions as a standards-compliant OAuth2 and OIDC provider for token issuance and delegated access management.
- Relationship-Based Models - Implements complex relationship-based permission models to manage granular access across distributed systems.
- Relationship-Based Access Controls - Enforces granular access rights based on defined relationships between users and resources.
- Access Control and Authorization - Models complex access control requirements by defining namespaces, relations, and permissions.
- JWT Session Management - Maintains user sessions using cryptographically signed tokens that track identity metadata across services.
- OAuth2 Client Management - Identifies and authenticates applications during authorization flows by registering redirect URIs and managing client credentials.
- OIDC Identity Token Issuance - Verifies user identity and session information securely by requesting ID tokens alongside standard OAuth2 access tokens.
- Permission Management - Verifies user access by validating subject, permission, and object combinations before performing sensitive actions.
- Identity Federation - Integrates external identity providers using standard protocols to manage access across distributed systems.
- State Machine Orchestrators - Manages complex authentication and registration processes as stateful flows with persistent history.
- Graph Processing - Evaluates access rights by traversing directed graphs of relationships between subjects and objects.
- Authentication Flows - Supports headless authentication workflows via JSON APIs for flexible integration across web, mobile, and desktop platforms.
- Authentication Login Handlers - Delegates authentication to a custom application by handling login challenges and accepting or rejecting requests.
- Authentication CLI - Authenticates terminal sessions using browser flows or API keys for secure command-line access.
- Identity Management - Maps user fields to identity management functions like password recovery and multi-factor authentication.
- Flow Orchestrators - Orchestrates complex authentication state and security flows across diverse client interfaces.
- Permission Systems - Provides a dedicated language for modeling relationships and permissions to power global access control logic.
- API Decoupling - Separates user interface and backend layers through interface contracts to enable custom authentication experiences.
- Cryptography and Identity - Security-hardened identity and user management system.
- Identity and Access Management - Handles user registration, login, and profile management workflows.
- Security and Compliance - Identity server for authentication and MFA.
- Securitate și confidențialitate - Cloud-native authentication and identity management.
- JSON Schema Modeling - Enforces data validation and consistency for user identity structures using standard schema files.
- Client SDKs - Provides language-specific packages to simplify authentication and data retrieval tasks.
- Authorization Testing - Validates access control logic through manual API checks and automated test suites.
- Multi-Factor Authentication - Enforces multi-factor authentication using TOTP and WebAuthn to secure user account access.
- Authorization Middleware - Retrieves authorized resources by querying objects or subjects associated with specific users or relations.
- Consent Bypasses - Provides automated authorization bypasses for trusted first-party applications to streamline user login flows.
- Flow Initialization - Prepares the environment for user registration by setting up anti-CSRF tokens across browser, API, and mobile client platforms.
- Input Validation Schemas - Validates user input against defined identity schemas to handle errors related to password policies or missing required fields.
- Lifecycle Event Hooks - Executes custom business logic at specific stages of the identity lifecycle via event hooks.
- Registration Hooks - Streamlines user onboarding by automatically issuing sessions immediately after successful account creation using post-registration hooks.
- Relationship Management - Determines user access by expanding relationship trees to identify the underlying reasons for granted permissions.
- Project Scaffolding and Configuration - Generates new workspaces and project containers through the terminal to organize development resources.
- Webhook Configuration - Customizes OAuth2 token claims during issuance or refresh by registering a webhook endpoint.
- Identity Tracking Systems - Determines if a user has completed enough authentication factors to perform sensitive operations by tracking session assurance levels.
