Ory Hydra

Overview

Ory Hydra is a headless OAuth 2.0 and OpenID Connect authorization server. It issues tokens and delegates user login and consent to an application that the operator supplies. It is not a user directory or a complete workforce identity system.

Hydra can give Pomerium a standard OpenID Connect issuer while the operator keeps its existing login, consent, and user system.

The operator identity and login system authenticates and manages the user. Hydra runs the OAuth 2.0 and OpenID Connect protocol and issues tokens. Pomerium validates the response and applies route policy.

How it works

Register Pomerium as an Ory Hydra OAuth 2.0 client. Configure the public issuer, discovery endpoint, client secret, scopes, and exact callback URL. Operate a separate login and consent application.

Configure Pomerium with the exact issuer or provider URL, client ID, and client secret. Use the Pomerium callback URL as an exact redirect URI. Request only the scopes and claims that access policy needs.

Test discovery, signing-key rotation, the authorization code flow, logout, and required claim mappings before production use. Keep provider credentials outside source control.

Example

A team registers Pomerium as an Ory Hydra client. Hydra sends the user to the operator login and consent application. That application authenticates the user and returns the result to Hydra. Hydra issues the OpenID Connect response that Pomerium validates.

Considerations

• Ory Hydra does not manage users, passwords, or the login user interface.
• The operator must secure and operate the login, consent, and identity backend components.
• Claims and sign-in behavior depend on the separate identity, login, and consent components and on Hydra configuration.
• A standards-based OpenID Connect pattern is not evidence of a vendor-specific connector or partnership.