Hydra

Hydra is a headless identity server that functions as a certified OAuth2 and OpenID Connect provider. It is designed as an authentication engine that manages authorization handshakes and token lifecycles while remaining decoupled from the user interface.

The project distinguishes itself through a headless architecture, allowing external management of login and consent flows. It provides specialized capabilities for dynamic client registration, JSON Web Token issuance, and a system for rotating encryption secrets without service downtime.

The system covers a broad range of identity operations, including the orchestration of authentication sequences, identity provisioning, and token lifecycle management. It supports state persistence via adapters for PostgreSQL, MySQL, and CockroachDB, and includes observability tools through Prometheus-compatible metrics and distributed tracing.

Administrative access is managed through port-based API isolation to separate privileged endpoints from public-facing protocol APIs.

Features

Identity Providers - Functions as a centralized identity provider delivering unified authentication and authorization via standard protocols.
Identity Servers - Provides a centralized platform for authentication, authorization, and federation services as a headless server.
Headless Architectures - Implements a headless architecture that decouples identity protocol logic from the user interface via management APIs.
JWT Format Tokens - Generates access tokens in JSON Web Token format to enable local verification by clients.
API Access Control - Secures APIs by issuing JWT access tokens and managing scopes to control resource permissions.
Login and Consent Handlers - Provides secure endpoints to accept or reject user authentication and scope authorization requests.
Authentication Scope Management - Validates and matches requested OAuth2 scopes to control client access levels.
Authorization Handshake APIs - Exposes APIs to implement the technical handshake of authentication without prescribing the user interface.
Authentication Orchestration - Coordinates complex authentication and authorization sequences, including login and user consent flows.
Client Registration Protocols - Implements standardized procedures for the secure onboarding and registration of new client applications.
Identity Provider Integrations - Integrates existing user databases with the authorization server to manage login and consent flows.
Identity Token Services - Issues cryptographically signed JSON Web Tokens to authorize access to protected resources.
Key Management - Manages the generation and rotation of cryptographic key pairs for signing tokens.
OAuth2 Client Management - Provides tools for registering and scoping external application access via OAuth2.
OAuth2 Implementations - Implements standard OAuth2 authorization sequences, including code, implicit, and hybrid flows.
OIDC Identity Token Issuance - Acts as an OIDC provider to issue identity tokens based on internal roles.
OIDC Protocol Implementations - Executes standardized OpenID Connect authorization flows and discovery endpoints for specification compatibility.
OpenID Connect Providers - Functions as a certified OpenID Connect and OAuth2 provider for standardized single sign-on.
Token Validation - Verifies that requested scopes and audiences are whitelisted before issuing new tokens during refresh.
Single Sign-On Solutions - Enables users to authenticate once and access multiple independent applications via standardized identity protocols.
Application Registration - Provides mechanisms for registering third-party applications that request access to protected resources.
OAuth2 Access Token Issuance - Generates signed JSON Web Tokens as access tokens to facilitate secure resource authorization.
Token Management - Provides headless APIs to manage the full lifecycle of active access tokens.
JSON Web Tokens - Issues signed JSON Web Tokens containing identity and session data for local verification by relying parties.
CockroachDB Integrations - Supports state and configuration persistence using CockroachDB.
PostgreSQL Persistence - Utilizes PostgreSQL to ensure reliable storage of identity and authorization data across restarts.
MySQL Integrations - Supports state and identity data persistence using MySQL.
Authorization State Adapters - Uses interchangeable database adapters to maintain authorization state across PostgreSQL, MySQL, and CockroachDB.
OIDC Discovery - Publishes a standardized discovery endpoint to provide clients with authentication, token, and authorization server locations.
Dynamic Client Registrations - Implements dynamic client registration and trust establishment using metadata and dynamic endpoints.
Token Metadata Retrievals - Implements a secure validation endpoint for inspecting the metadata and current status of access and refresh tokens.
Audience Restrictions - Ensures access tokens are only used at authorized endpoints by defining the intended audience.
Lifespan Configuration - Provides configurable expiration timeouts for login, consent, and refresh tokens.
Client Authentication Configurations - Allows defining whether a client authenticates at the token endpoint using HTTP Basic or a POST body.
Automated Secret Rotation - Maintains a rotation array of encryption keys to allow seamless secret updates without service downtime.
OAuth 2.1 Implementations - Adheres to the latest OAuth 2.1 standards for internet-scale authentication.
Refresh Token Grants - Supports the issuance of new identity tokens during refresh token grant flows.
JWKS Distribution - Exposes a JSON Web Key Set endpoint for clients to verify signed tokens using rotating public keys.
Token Introspection - Implements token revocation and introspection to verify and invalidate active security tokens.
Session Termination Services - Executes front-channel and back-channel logout flows to terminate user sessions across identity providers.
Identity and Access Providers - Open-source server for OIDC and OAuth2 protocols.
API Security - High-performance OAuth2 and OpenID Connect server implementation.
Cryptography and Identity - Hardened OAuth 2.0 and OpenID Connect provider.
安全与隐私 - OpenID Connect and OAuth2 provider.

Star 历史

oryhydra

Name: ory/hydra
Author: ory

View on GitHub

17,236 星标1,583 分支GoApache-2.017 次浏览www.ory.com/?utm_source=github&utm_medium=banner&utm_campaign=hydra

Hydra

Administrative access is managed through port-based API isolation to separate privileged endpoints from public-facing protocol APIs.

Features

Identity Providers - Functions as a centralized identity provider delivering unified authentication and authorization via standard protocols.
Identity Servers - Provides a centralized platform for authentication, authorization, and federation services as a headless server.
Headless Architectures - Implements a headless architecture that decouples identity protocol logic from the user interface via management APIs.
JWT Format Tokens - Generates access tokens in JSON Web Token format to enable local verification by clients.
API Access Control - Secures APIs by issuing JWT access tokens and managing scopes to control resource permissions.
Login and Consent Handlers - Provides secure endpoints to accept or reject user authentication and scope authorization requests.
Authentication Scope Management - Validates and matches requested OAuth2 scopes to control client access levels.
Authorization Handshake APIs - Exposes APIs to implement the technical handshake of authentication without prescribing the user interface.
Authentication Orchestration - Coordinates complex authentication and authorization sequences, including login and user consent flows.
Client Registration Protocols - Implements standardized procedures for the secure onboarding and registration of new client applications.
Identity Provider Integrations - Integrates existing user databases with the authorization server to manage login and consent flows.
Identity Token Services - Issues cryptographically signed JSON Web Tokens to authorize access to protected resources.
Key Management - Manages the generation and rotation of cryptographic key pairs for signing tokens.
OAuth2 Client Management - Provides tools for registering and scoping external application access via OAuth2.
OAuth2 Implementations - Implements standard OAuth2 authorization sequences, including code, implicit, and hybrid flows.
OIDC Identity Token Issuance - Acts as an OIDC provider to issue identity tokens based on internal roles.
OIDC Protocol Implementations - Executes standardized OpenID Connect authorization flows and discovery endpoints for specification compatibility.
OpenID Connect Providers - Functions as a certified OpenID Connect and OAuth2 provider for standardized single sign-on.
Token Validation - Verifies that requested scopes and audiences are whitelisted before issuing new tokens during refresh.
Single Sign-On Solutions - Enables users to authenticate once and access multiple independent applications via standardized identity protocols.
Application Registration - Provides mechanisms for registering third-party applications that request access to protected resources.
OAuth2 Access Token Issuance - Generates signed JSON Web Tokens as access tokens to facilitate secure resource authorization.
Token Management - Provides headless APIs to manage the full lifecycle of active access tokens.
JSON Web Tokens - Issues signed JSON Web Tokens containing identity and session data for local verification by relying parties.
CockroachDB Integrations - Supports state and configuration persistence using CockroachDB.
PostgreSQL Persistence - Utilizes PostgreSQL to ensure reliable storage of identity and authorization data across restarts.
MySQL Integrations - Supports state and identity data persistence using MySQL.
Authorization State Adapters - Uses interchangeable database adapters to maintain authorization state across PostgreSQL, MySQL, and CockroachDB.
OIDC Discovery - Publishes a standardized discovery endpoint to provide clients with authentication, token, and authorization server locations.
Dynamic Client Registrations - Implements dynamic client registration and trust establishment using metadata and dynamic endpoints.
Token Metadata Retrievals - Implements a secure validation endpoint for inspecting the metadata and current status of access and refresh tokens.
Audience Restrictions - Ensures access tokens are only used at authorized endpoints by defining the intended audience.
Lifespan Configuration - Provides configurable expiration timeouts for login, consent, and refresh tokens.
Client Authentication Configurations - Allows defining whether a client authenticates at the token endpoint using HTTP Basic or a POST body.
Automated Secret Rotation - Maintains a rotation array of encryption keys to allow seamless secret updates without service downtime.
OAuth 2.1 Implementations - Adheres to the latest OAuth 2.1 standards for internet-scale authentication.
Refresh Token Grants - Supports the issuance of new identity tokens during refresh token grant flows.
JWKS Distribution - Exposes a JSON Web Key Set endpoint for clients to verify signed tokens using rotating public keys.
Token Introspection - Implements token revocation and introspection to verify and invalidate active security tokens.
Session Termination Services - Executes front-channel and back-channel logout flows to terminate user sessions across identity providers.
Identity and Access Providers - Open-source server for OIDC and OAuth2 protocols.
API Security - High-performance OAuth2 and OpenID Connect server implementation.
Cryptography and Identity - Hardened OAuth 2.0 and OpenID Connect provider.
安全与隐私 - OpenID Connect and OAuth2 provider.

Hydra 的开源替代方案

相似的开源项目，按与 Hydra 的功能重合度排序。

dexidp/dex
dexidp/dex
10,902在 GitHub 上查看
Dex is an OpenID Connect provider and identity federation proxy that translates authentication signals from various upstream sources into a unified OpenID Connect interface. It functions as a multi-protocol identity broker, enabling client applications to implement a single standard while delegating user verification to external identity providers. The project distinguishes itself through a pluggable connector architecture that bridges disparate protocols including LDAP, SAML, and OAuth2. It provides specific integrations for services such as GitHub, Google, GitLab, and Microsoft, while offer
Gohacktoberfestidentity-provideridp
在 GitHub 上查看10,902
openiddict/openiddict-core
openiddict/openiddict-core
5,168在 GitHub 上查看
This project is a .NET identity stack and server framework used to build certified OpenID Connect and OAuth 2.0 identity providers. It provides the core logic required to issue and validate security tokens and manage user authentication across various grant types and protocol flows. The framework includes a protocol translation layer that bridges OpenID Connect and SAML to enable interoperability between different identity providers. It also supports a stateless mode of operation, which removes built-in validation and storage to allow for manual control over token and client verification. Th
C#
在 GitHub 上查看5,168
doorkeeper-gem/doorkeeper
doorkeeper-gem/doorkeeper
5,501在 GitHub 上查看
Doorkeeper is an OAuth 2 authorization server and provider for Ruby on Rails and Grape applications. It provides the necessary framework to build an authorization server that issues and validates security tokens for third-party applications, effectively acting as a security middleware to protect API endpoints. The project integrates an identity layer via OpenID Connect to verify user identities and retrieve profile information. It supports a variety of security patterns, including the implementation of the PKCE flow for public clients and the issuance of stateless JSON Web Tokens. Its broade
Ruby
在 GitHub 上查看5,501
panva/node-oidc-provider
panva/node-oidc-provider
3,756在 GitHub 上查看
node-oidc-provider is a framework for building OpenID Certified authorization servers and identity providers within Node.js environments. It provides a comprehensive suite of tools for managing the full lifecycle of OAuth 2.0 and OpenID Connect services, including user authentication, client registration, and the issuance and validation of identity and access tokens. The project distinguishes itself through a highly modular architecture that allows developers to integrate authentication services directly into existing web application stacks. It supports advanced customization through a middle
JavaScriptauthorizationauthorization-serverconnect
在 GitHub 上查看3,756

查看 Hydra 的所有 30 个替代方案

常见问题解答

ory/hydra 是做什么的？

ory/hydra 的主要功能有哪些？

ory/hydra 的主要功能包括：Identity Providers, Identity Servers, Headless Architectures, JWT Format Tokens, API Access Control, Login and Consent Handlers, Authentication Scope Management, Authorization Handshake APIs。

ory/hydra 有哪些开源替代品？

ory/hydra 的开源替代品包括： dexidp/dex — Dex is an OpenID Connect provider and identity federation proxy that translates authentication signals from various… openiddict/openiddict-core — This project is a .NET identity stack and server framework used to build certified OpenID Connect and OAuth 2.0… doorkeeper-gem/doorkeeper — Doorkeeper is an OAuth 2 authorization server and provider for Ruby on Rails and Grape applications. It provides the… panva/node-oidc-provider — node-oidc-provider is a framework for building OpenID Certified authorization servers and identity providers within… casdoor/casdoor — Casdoor is a centralized identity and access management platform that functions as an OAuth 2.0 authorization server.… quarkusio/quarkus — Quarkus is a Kubernetes-native Java framework designed for building high-performance, memory-efficient applications.…