Repository files navigation

warden-ory-kratos is aWarden extension that integrates withOry Kratos.

Ory Kratos is an open-source, API-first identity and user management service.

Add this line to your application's Gemfile:

gem'warden-ory-kratos'

SeeRailsWarden.

Create a new Rails initializer and inject RailsWarden.Configure which of the strategies your application will use.

# config/initializers/warden.rbrequire'rails_warden'require'warden/ory_kratos'Rails.configuration.middleware.useRailsWarden::Managerdo |manager|manager.failure_app=Warden::OryKratos::FailureApps::UnAuthorizedmanager.default_strategies[:SessionToken,:SessionCookie]# :JWTHeader strategy also availableend

Environment specific configuration for OryKratos.

# config/environments/development.rbWarden::OryKratos.configuredo |config|config.kratos_external_api='https://yourhostedproject.projects.oryapis.com'config.logger=Logger.new(STDOUT)# config.kratos_proxy_jwks    = 'http://localhost:4000/.ory/proxy/jwks.json'end

Add the auth mixin to the base controller class of your choosing.

# app/controllers/application_controller.rbclassApplicationController <ActionController::Base# Mixins were deprecated on master branch# include RailsWarden::MixinsincludeRailsWarden::Authenticationend

# app/controllers/articles_controller.rbclassArticlesController <ApplicationControllerprepend_before_action:authenticate!defindex@articles=Article.allend# ...end

There are three strategies available. When combined, the:SessionToken, and:SessionCookie strategies make up a "Kratos native" implementation. While the:JWTHeader strategy provides compatibility with the Ory cli proxy.

• Looks for anory_session cookie in the rack request.
• Makes an external request to Kratos for the user session.
• Accepts or rejects the request based on the user session information.

• Looks within the rack request for a token in bothAuthorization andX_Session_Token headers.
• Makes an external request to Kratos for the user session.
• Accepts or rejects the request based on the user session information.

• Loads the Ory cli proxy's JSON web key set (JWKS).
• Looks for anAuthorization header holding a JSON web token (JWT).
• Uses the JWKS to cryptographically verify the JWT was issued by the Ory cli proxy.
• Extracts the user session from the valid JWT.
• Accepts or rejects the request based on the user session information.

gem install --dev warden-ory-kratos

yard server --reload