Hydra and SAML

[janiskemper]

In a current project we plan on using the Ory framework (mainly Kratos and Keto). In the future we might want to use external authentication via SAML. I have found some issues, but have no experience myself with this topic. We basically just want to have an answer to the question whether Hydra is what we are looking for or not. Any comments?

Here are the links I found (and which did not really help me)
#1519
#29

[tacurran]

@janiskemper regarding SAML there are several issues open , as you mention, representing use cases. Perhaps you can explain the following points to clarify your use case:

• Credentials management using Kratos <insert description, and requirements>
• Policy, access management using Keto <insert description, and requirements along with the build or branch version>
• SAML <insert description, and requirements>
  With that information we can perhaps answer your request. Thank you for your support for Ory.

[vinckr]

Since the topic seems to be stale, I will select an answer for now.

[robertlagrant]

@vinckr I think I have a similar question. It's basically this: can Hydra act as a SAML service provider that returns a JWT? I.e. can it generate a SAML request, and when the user comes back with a valid SAML assertion, parse that assertion and return a Hydra JWT to be enforced by Oathkeeper as per usual?

[vinckr]

Hey @robertlagrant,
AFAICT that is not possible at the moment. There are some older issues talking about addding SAML server capabilities: #1519 (and a few more), but they have not received much engagement.

What most are looking for is to integrate with SAML on the client side, which is being implemented at the moment (you also looked at this issue).
For the server side (becoming SAML provider) in Ory Hydra are no plans so far.

[robertlagrant]

Hi @vinckr thanks for the swift update!

I was wondering about using Hydra directly, but not as a SAML identity provider, only as a SAML service provider (i.e. a client).

Given none of my auth sources need to store local info (other than what Hydra can expose as an id_token) nor have password reset etc flows, I think I would only need Kratos for its SAML functionality, which would be quite a big addition.

Not debating; I'm just explaining the reasoning!