text: (self.webpackChunkdocusaurus_template=self.webpackChunkdocusaurus_template||[]).push([[80621],{3905:function(e,t,n){"use strict";n.d(t,{Zo:function(){return d},kt:function(){return h}});var r=n(67294);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function i(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?a(Object(n),!0).forEach((function(t){o(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):a(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function s(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},a=Object.keys(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r<a.length;r++)n=a[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var l=r.createContext({}),u=function(e){var t=r.useContext(l),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},d=function(e){var t=u(e.components);return r.createElement(l.Provider,{value:t},e.children)},c={inlineCode:"code",wrapper:function(e){var t=e.children;return r.createElement(r.Fragment,{},t)}},p=r.forwardRef((function(e,t){var n=e.components,o=e.mdxType,a=e.originalType,l=e.parentName,d=s(e,["components","mdxType","originalType","parentName"]),p=u(n),h=o,f=p["".concat(l,".").concat(h)]||p[h]||c[h]||a;return n?r.createElement(f,i(i({ref:t},d),{},{components:n})):r.createElement(f,i({ref:t},d))}));function h(e,t){var n=arguments,o=t&&t.mdxType;if("string"==typeof e||o){var a=n.length,i=new Array(a);i[0]=p;var s={};for(var l in t)hasOwnProperty.call(t,l)&&(s[l]=t[l]);s.originalType=e,s.mdxType="string"==typeof e?e:o,i[1]=s;for(var u=2;u<a;u++)i[u]=n[u];return r.createElement.apply(null,i)}return r.createElement.apply(null,n)}p.displayName="MDXCreateElement"},32665:function(e,t,n){"use strict";n.r(t),n.d(t,{frontMatter:function(){return s},contentTitle:function(){return l},metadata:function(){return u},toc:function(){return d},default:function(){return p}});var r=n(22122),o=n(19756),a=(n(67294),n(3905)),i=["components"],s={id:"index",slug:"/",title:"Introduction",sidebar_label:"Introduction"},l=void 0,u={unversionedId:"index",id:"version-v1.10/index",isDocsHomePage:!1,title:"Introduction",description:"Hydra is an OAuth 2.0 and OpenID Connect Provider. In other words, an",source:"@site/versioned_docs/version-v1.10/index.md",sourceDirName:".",slug:"/",permalink:"/hydra/docs/",editUrl:"https://github.com/ory/hydra/edit/master/docs/versioned_docs/version-v1.10/index.md",tags:[],version:"v1.10",lastUpdatedBy:"aeneasr",lastUpdatedAt:1626263488,formattedLastUpdatedAt:"7/14/2021",frontMatter:{id:"index",slug:"/",title:"Introduction",sidebar_label:"Introduction"},sidebar:"version-v1.10/docs",next:{title:"5 Minute Tutorial",permalink:"/hydra/docs/5min-tutorial"}},d=[{value:"Flexible User Management",id:"flexible-user-management",children:[]},{value:"OpenID Certified",id:"openid-certified",children:[]},{value:"Cryptographic Key Storage",id:"cryptographic-key-storage",children:[]},{value:"Security First",id:"security-first",children:[]},{value:"High Performance",id:"high-performance",children:[]},{value:"Developer Friendly",id:"developer-friendly",children:[]},{value:"Limitations",id:"limitations",children:[]},{value:"Is ORY Hydra the right fit for you?",id:"is-ory-hydra-the-right-fit-for-you",children:[]},{value:"Other solutions",id:"other-solutions",children:[]}],c={toc:d};function p(e){var t=e.components,n=(0,o.Z)(e,i);return(0,a.kt)("wrapper",(0,r.Z)({},c,n,{components:t,mdxType:"MDXLayout"}),(0,a.kt)("p",null,"Hydra is an OAuth 2.0 and OpenID Connect Provider. In other words, an\nimplementation of the OAuth 2.0 Authorization Framework as well as the OpenID\nConnect Core 1.0 framework. As such, it issues OAuth 2.0 Access, Refresh, and ID\nTokens that enable third-parties to access your APIs in the name of your users."),(0,a.kt)("h2",{id:"flexible-user-management"},"Flexible User Management"),(0,a.kt)("p",null,'One of ORY Hydra\'s biggest advantages is that unlike other OAuth 2.0\nimplementations, it implements the OAuth and OpenID Connect standard without\nforcing you to use a "Hydra User Management" (login, logout, profile management,\nregistration), a particular template engine, or a predefined front-end.'),(0,a.kt)("p",null,"This allows you to implement user management and login your way, in your\ntechnology stack, with authentication mechanisms required by your use case\n(token-based 2FA, SMS 2FA, etc). You can of course use existing solutions like\n",(0,a.kt)("a",{parentName:"p",href:"https://github.com/go-authboss/authboss"},"authboss"),". It provides you all the\nbenefits of OAuth 2.0 and OpenID Connect while being minimally invasive to your\nbusiness logic and technology stack."),(0,a.kt)("h2",{id:"openid-certified"},"OpenID Certified"),(0,a.kt)("p",null,"ORY Hydra is a\n",(0,a.kt)("a",{parentName:"p",href:"https://openid.net/developers/certified/"},"Certified OpenID Connect Provider Server"),"\nand implements all the requirements stated by the OpenID Foundation. In\nparticular, it correctly implements the various OAuth 2.0 and OpenID Connect\nflows specified by the IETF and OpenID Foundation."),(0,a.kt)("h2",{id:"cryptographic-key-storage"},"Cryptographic Key Storage"),(0,a.kt)("p",null,"In addition to the OAuth 2.0 functionality, ORY Hydra offers a safe storage for\ncryptographic keys (used for example to sign JSON Web Tokens) and can manage\nOAuth 2.0 Clients."),(0,a.kt)("h2",{id:"security-first"},"Security First"),(0,a.kt)("p",null,"ORY Hydra's architecture and work flows are designed to neutralize many common\n(OWASP TOP TEN) and uncommon attack vectors.\n",(0,a.kt)("a",{parentName:"p",href:"/hydra/docs/security-architecture"},"Learn more"),"."),(0,a.kt)("h2",{id:"high-performance"},"High Performance"),(0,a.kt)("p",null,"Hydra has a low CPU and memory footprint, short start-up time, and scales\neffortlessly up and down on many platforms including Heroku, Cloud Foundry,\nDocker, Google Container Engine, and others."),(0,a.kt)("h2",{id:"developer-friendly"},"Developer Friendly"),(0,a.kt)("p",null,"Hydra is available for all popular platforms including Linux, OSX and Windows.\nIt ships as a single binary without any additional dependencies. For further\nsimplicity, it is available as a\n",(0,a.kt)("a",{parentName:"p",href:"https://hub.docker.com/r/oryd/hydra/"},"Docker Image"),"."),(0,a.kt)("p",null,"Hydra also provides a developer-friendly CLI."),(0,a.kt)("h2",{id:"limitations"},"Limitations"),(0,a.kt)("p",null,"Hydra has a few limitations too:"),(0,a.kt)("ol",null,(0,a.kt)("li",{parentName:"ol"},"ORY Hydra does not manage user accounts, i.e. user registration, password\nreset, user login, sending confirmation emails, etc. In Hydra's architecture,\nthe ",(0,a.kt)("em",{parentName:"li"},"Identity Provider")," is responsible for this."),(0,a.kt)("li",{parentName:"ol"},"ORY Hydra doesn't support the OAuth 2.0 Resource Owner Password Credentials\nflow because it is legacy, discouraged, and insecure.")),(0,a.kt)("h2",{id:"is-ory-hydra-the-right-fit-for-you"},"Is ORY Hydra the right fit for you?"),(0,a.kt)("p",null,"OAuth 2.0 can be used in many environments for various purposes. This list might\nhelp you decide if OAuth 2.0 and Hydra are the right fit for a use case:"),(0,a.kt)("ol",null,(0,a.kt)("li",{parentName:"ol"},"enable third-party solutions to access to your APIs: This is what an OAuth2\nProvider does, Hydra is a perfect fit."),(0,a.kt)("li",{parentName:"ol"},"be an Identity Provider like Google, Facebook, or Microsoft: OpenID Connect\nand thus Hydra is a perfect fit."),(0,a.kt)("li",{parentName:"ol"},"enable your browser, mobile, or wearable applications to access your APIs:\nRunning an OAuth2 Provider can work great for this. You don't have to store\npasswords on the device and can revoke access tokens at any time. GMail\nlogins work this way."),(0,a.kt)("li",{parentName:"ol"},"you want to limit what type of information your backend services can read\nfrom each other. For example, the ",(0,a.kt)("em",{parentName:"li"},"comment service")," should only be allowed to\nfetch user profile updates but shouldn't be able to read user passwords.\nOAuth 2.0 might make sense for you.")),(0,a.kt)("h2",{id:"other-solutions"},"Other solutions"),(0,a.kt)("p",null,"If you only need a library or SDKs that implements OAuth 2.0, take a look at\n",(0,a.kt)("a",{parentName:"p",href:"https://github.com/ory/fosite"},"fosite")," or\n",(0,a.kt)("a",{parentName:"p",href:"https://github.com/oauthjs/node-oauth2-server"},"node-oauth2-server"),"."),(0,a.kt)("p",null,"If you need a fully featured identity solution including user management and\nuser interfaces, those exist in the cloud as ",(0,a.kt)("a",{parentName:"p",href:"https://console.ory.sh"},"Ory")," or\nwhen self-hosting as ",(0,a.kt)("a",{parentName:"p",href:"https://www.keycloak.org"},"Keycloak")," or\n",(0,a.kt)("a",{parentName:"p",href:"https://github.com/ory/kratos/"},"Ory Kratos")," among others."))}p.isMDXComponent=!0}}]);