upstream/upstream-ory-keto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)
Some checks failed
CI / Run lints and checks (push) Failing after 47s
Details
CI / Run tests (push) Failing after 1s
Details
CI / Run race tests (push) Failing after 5s
Details
CI / Build CLI docs (push) Has been skipped
Details
CI / Run buf actions (push) Failing after 5s
Details
CodeQL / Analyze (go) (push) Failing after 3s
Details
CodeQL / Analyze (javascript) (push) Failing after 2s
Details
Docker Image Scanners / scanners (push) Failing after 3s
Details
Format / format (push) Failing after 3s
Details
Synchronize Issue Labels / Synchronize Issue Labels (push) Has been skipped
Details
CI / Generate release (push) Has been skipped
Details
CI / Draft newsletter (push) Has been skipped
Details
CI / Pending approval Slack notification (push) Has been skipped
Details
CI / Send newsletter (push) Has been skipped
Details

Browse Source
This commit is contained in:
upstream-mirror
2026-09-16 01:08:34 +05:00
commit 9456a4e922
2560 changed files with 120911 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

312
oryx/configx/stub/benchmark/benchmark.yaml Normal file
View File

@@ -0,0 +1,312 @@
# Please find the documentation for this file at
# https://www.ory.com/oathkeeper/docs/configuration
log:
level: debug
format: json
profiling: cpu
serve:
proxy:
port: 1234
host: 127.0.0.1
timeout:
read: 1s
write: 2s
idle: 3s
cors:
enabled: true
allowed_origins:
- https://example.com
- https://*.example.com
allowed_methods:
- POST
- GET
- PUT
- PATCH
- DELETE
allowed_headers:
- Authorization
- Content-Type
exposed_headers:
- Content-Type
allow_credentials: true
max_age: 10
debug: true
tls:
key:
path: /path/to/key.pem
base64: LS0tLS1CRUdJTiBFTkNSWVBURUQgUFJJVkFURSBLRVktLS0tLVxuTUlJRkRqQkFCZ2txaGtpRzl3MEJCUTB3...
cert:
path: /path/to/cert.pem
base64: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr...
api:
port: 1235
host: 127.0.0.2
timeout:
read: 1s
write: 2s
idle: 3s
cors:
enabled: true
allowed_origins:
- https://example.org
- https://*.example.org
allowed_methods:
- GET
- PUT
- PATCH
- DELETE
allowed_headers:
- Authorization
- Content-Type
exposed_headers:
- Content-Type
allow_credentials: true
max_age: 10
debug: true
tls:
key:
path: /path/to/key.pem
base64: LS0tLS1CRUdJTiBFTkNSWVBURUQgUFJJVkFURSBLRVktLS0tLVxuTUlJRkRqQkFCZ2txaGtpRzl3MEJCUTB3...
cert:
path: /path/to/cert.pem
base64: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr...
prometheus:
port: 9000
host: localhost
metrics_path: /metrics
collapse_request_paths: true
# Configures Access Rules
access_rules:
# Locations (list of URLs) where access rules should be fetched from on boot.
# It is expected that the documents at those locations return a JSON or YAML Array containing ORY Oathkeeper Access Rules.
repositories:
# If the URL Scheme is `file://`, the access rules (an array of access rules is expected) will be
# fetched from the local file system.
- file://path/to/rules.json
# If the URL Scheme is `inline://`, the access rules (an array of access rules is expected)
# are expected to be a base64 encoded (with padding!) JSON/YAML string (base64_encode(`[{"id":"foo-rule","authenticators":[....]}]`)):
- inline://W3siaWQiOiJmb28tcnVsZSIsImF1dGhlbnRpY2F0b3JzIjpbXX1d
# If the URL Scheme is `http://` or `https://`, the access rules (an array of access rules is expected) will be
# fetched from the provided HTTP(s) location.
- https://path-to-my-rules/rules.json
# Optional fields describing matching strategy, defaults to "regexp".
matching_strategy: glob
errors:
fallback:
- json
handlers:
redirect:
enabled: true
config:
to: http://path-to/redirect
json:
enabled: true
config:
verbose: true
when:
- error:
- unauthorized
- forbidden
- internal_server_error
request:
header:
content_type:
- application/json
accept:
- application/json
cidr:
- 127.0.0.0/24
# All authenticators can be configured under this configuration key
authenticators:
# Configures the anonymous authenticator
anonymous:
# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
enabled: true
config:
# Sets the anonymous username. Defaults to "anonymous". Common names include "guest", "anon", "anonymous", "unknown".
subject: guest
# Configures the cookie session authenticator
cookie_session:
# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
enabled: true
config:
# Sets the origin to proxy requests to. If the response is a 200 with body `{ "subject": "...", "extra": {} }`
# The request will pass the subject through successfully, otherwise it will be marked as unauthorized
check_session_url: https://session-store-host
# Sets a list of possible cookies to look for on incoming requests, and will fallthrough to the next authenticator if
# none of the passed cookies are set on the request
only:
- sessionid
# Configures the jwt authenticator
jwt:
# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
enabled: true
config:
# REQUIRED IF ENABLED - The URL where ORY Oathkeeper can retrieve JSON Web Keys from for validating the JSON Web
# Token. Usually something like "https://my-keys.com/.well-known/jwks.json". The response of that endpoint must
# return a JSON Web Key Set (JWKS).
jwks_urls:
- https://my-website.com/.well-known/jwks.json
- https://my-other-website.com/.well-known/jwks.json
- file://path/to/local/jwks.json
# Sets the strategy to be used to validate/match the scope. Supports "hierarchic", "exact", "wildcard", "none". Defaults
# to "none".
scope_strategy: wildcard
# Configures the noop authenticator
noop:
# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
enabled: true
# Configures the oauth2_client_credentials authenticator
oauth2_client_credentials:
# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
enabled: true
config:
# REQUIRED IF ENABLED - The OAuth 2.0 Token Endpoint that will be used to validate the client credentials.
token_url: https://my-website.com/oauth2/token
# Configures the oauth2_introspection authenticator
oauth2_introspection:
# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
enabled: true
config:
# REQUIRED IF ENABLED - The OAuth 2.0 Token Introspection endpoint.
introspection_url: https://my-website.com/oauth2/introspection
# Sets the strategy to be used to validate/match the token scope. Supports "hierarchic", "exact", "wildcard", "none". Defaults
# to "none".
scope_strategy: exact
# Enable pre-authorization in cases where the OAuth 2.0 Token Introspection endpoint is protected by OAuth 2.0 Bearer
# Tokens that can be retrieved using the OAuth 2.0 Client Credentials grant.
pre_authorization:
# Enable pre-authorization. Defaults to false.
enabled: true
# REQUIRED IF ENABLED - The OAuth 2.0 Client ID to be used for the OAuth 2.0 Client Credentials Grant.
client_id: some_id
# REQUIRED IF ENABLED - The OAuth 2.0 Client Secret to be used for the OAuth 2.0 Client Credentials Grant.
client_secret: some_secret
# The OAuth 2.0 Scope to be requested during the OAuth 2.0 Client Credentials Grant.
scope:
- foo
- bar
# REQUIRED IF ENABLED - The OAuth 2.0 Token Endpoint where the OAuth 2.0 Client Credentials Grant will be performed.
token_url: https://my-website.com/oauth2/token
# Configures the unauthorized authenticator
unauthorized:
# Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
enabled: true
# All authorizers can be configured under this configuration key
authorizers:
# Configures the allow authorizer
allow:
# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
enabled: true
# Configures the deny authorizer
deny:
# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
enabled: true
# Configures the keto_engine_acp_ory authorizer
keto_engine_acp_ory:
# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
enabled: true
config:
# REQUIRED IF ENABLED - The base URL of ORY Keto, typically something like http(s)://<host>[:<port>]/
base_url: http://my-keto/
required_action: unknown
required_resource: unknown
# Configures the remote authorizer
remote:
# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
enabled: true
config:
remote: https://host/path
headers: {}
# Configures the remote_json authorizer
remote_json:
# Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
enabled: true
config:
remote: https://host/path
payload: "{}"
# All mutators can be configured under this configuration key
mutators:
header:
enabled: true
config:
headers:
foo: bar
# Configures the cookie mutator
cookie:
# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.
enabled: true
config:
cookies:
foo: bar
# Configures the hydrator mutator
hydrator:
# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.
enabled: true
config:
api:
url: https://some-url/
# Configures the id_token mutator
id_token:
# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.
enabled: true
config:
# REQUIRED IF ENABLED - Sets the "iss" value of the ID Token.
issuer_url: https://my-oathkeeper/
# REQUIRED IF ENABLED - Sets the URL where keys should be fetched from. Supports remote locations (http, https) as
# well as local filesystem paths.
jwks_url: https://fetch-keys/from/this/location.json
# jwks_url: file:///from/this/absolute/location.json
# jwks_url: file://../from/this/relative/location.json
# Sets the time-to-live of the ID token. Defaults to one minute. Valid time units are: s (second), m (minute), h (hour).
ttl: 1h
# Configures the noop mutator
noop:
# Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.
enabled: true

204
oryx/configx/stub/benchmark/schema.config.json Normal file
View File

@@ -0,0 +1,204 @@
{
"log": {
"level": "debug",
"format": "json"
},
"profiling": "cpu",
"serve": {
"proxy": {
"port": 1234,
"host": "127.0.0.1",
"timeout": {
"read": "1s",
"write": "2s",
"idle": "3s"
},
"cors": {
"enabled": true,
"allowed_origins": ["https://example.com", "https://*.example.com"],
"allowed_methods": ["POST", "GET", "PUT", "PATCH", "DELETE"],
"allowed_headers": ["Authorization", "Content-Type"],
"exposed_headers": ["Content-Type"],
"allow_credentials": true,
"max_age": 10,
"debug": true
},
"tls": {
"key": {
"path": "/path/to/key.pem",
"base64": "LS0tLS1CRUdJTiBFTkNSWVBURUQgUFJJVkFURSBLRVktLS0tLVxuTUlJRkRqQkFCZ2txaGtpRzl3MEJCUTB3..."
},
"cert": {
"path": "/path/to/cert.pem",
"base64": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr..."
}
}
},
"api": {
"port": 1235,
"host": "127.0.0.2",
"cors": {
"enabled": true,
"allowed_origins": ["https://example.org", "https://*.example.org"],
"allowed_methods": ["GET", "PUT", "PATCH", "DELETE"],
"allowed_headers": ["Authorization", "Content-Type"],
"exposed_headers": ["Content-Type"],
"allow_credentials": true,
"max_age": 10,
"debug": true
},
"tls": {
"key": {
"path": "/path/to/key.pem",
"base64": "LS0tLS1CRUdJTiBFTkNSWVBURUQgUFJJVkFURSBLRVktLS0tLVxuTUlJRkRqQkFCZ2txaGtpRzl3MEJCUTB3..."
},
"cert": {
"path": "/path/to/cert.pem",
"base64": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr..."
}
}
}
},
"access_rules": {
"repositories": [
"file://path/to/rules.json",
"inline://W3siaWQiOiJmb28tcnVsZSIsImF1dGhlbnRpY2F0b3JzIjpbXX1d",
"https://path-to-my-rules/rules.json"
],
"matching_strategy": "glob"
},
"errors": {
"fallback": ["json"],
"handlers": {
"redirect": {
"enabled": true,
"config": {
"to": "http://path-to/redirect"
}
},
"json": {
"enabled": true,
"config": {
"verbose": true,
"when": [
{
"error": ["unauthorized", "forbidden", "internal_server_error"],
"request": {
"header": {
"content_type": ["application/json"],
"accept": ["application/json"]
},
"cidr": ["127.0.0.0/24"]
}
}
]
}
}
}
},
"authenticators": {
"anonymous": {
"enabled": true,
"config": {
"subject": "guest"
}
},
"cookie_session": {
"enabled": true,
"config": {
"check_session_url": "https://session-store-host",
"only": ["sessionid"]
}
},
"jwt": {
"enabled": true,
"config": {
"jwks_urls": [
"https://my-website.com/.well-known/jwks.json",
"https://my-other-website.com/.well-known/jwks.json",
"file://path/to/local/jwks.json"
],
"scope_strategy": "wildcard"
}
},
"noop": {
"enabled": true
},
"oauth2_client_credentials": {
"enabled": true,
"config": {
"token_url": "https://my-website.com/oauth2/token"
}
},
"oauth2_introspection": {
"enabled": true,
"config": {
"introspection_url": "https://my-website.com/oauth2/introspection",
"scope_strategy": "exact",
"pre_authorization": {
"enabled": true,
"client_id": "some_id",
"client_secret": "some_secret",
"scope": ["foo", "bar"],
"token_url": "https://my-website.com/oauth2/token"
}
}
},
"unauthorized": {
"enabled": true
}
},
"authorizers": {
"allow": {
"enabled": true
},
"deny": {
"enabled": true
},
"keto_engine_acp_ory": {
"enabled": true,
"config": {
"base_url": "http://my-keto/",
"required_action": "unknown",
"required_resource": "unknown"
}
}
},
"mutators": {
"header": {
"enabled": false,
"config": {
"headers": {
"foo": "bar"
}
}
},
"cookie": {
"enabled": true,
"config": {
"cookies": {
"foo": "bar"
}
}
},
"hydrator": {
"enabled": true,
"config": {
"api": {
"url": "https://some-url/"
}
}
},
"id_token": {
"enabled": true,
"config": {
"issuer_url": "https://my-oathkeeper/",
"jwks_url": "https://fetch-keys/from/this/location.json",
"ttl": "1h"
}
},
"noop": {
"enabled": true
}
}
}

41
oryx/configx/stub/domain-aliases/config.schema.json Normal file
View File

@@ -0,0 +1,41 @@
{
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"domain_aliases": {
"title": "Domain Aliases",
"description": "Adds an alias domain. If a request with the hostname (FQDN) matching the hostname in the alias is found, that URL is used as the base URL.",
"type": "array",
"items": [
{
"additionalProperties": false,
"type": "object",
"required": ["match_domain", "base_path", "scheme"],
"properties": {
"match_domain": {
"minLength": 1,
"title": "Matching Domain",
"description": "Sets the matching domain. If the domain matches with this entry, the accompanying base_url will be used.",
"type": "string",
"examples": ["localhost", "my-domain.com"]
},
"scheme": {
"title": "Scheme",
"description": "Sets the scheme, for example https or http.",
"type": "string",
"enum": ["http", "https"]
},
"base_path": {
"minLength": 1,
"title": "Base Path",
"description": "Sets the base path for the matched domain.",
"type": "string",
"default": "/",
"pattern": "^/.*$",
"examples": ["/", "/.ory/kratos"]
}
}
}
]
}
}
}

27
oryx/configx/stub/from-files/a.yaml Normal file
View File

@@ -0,0 +1,27 @@
version: v0.5.3-alpha.1
dsn: memory
serve:
public:
base_url: http://127.0.0.1:4433/
cors:
enabled: true
admin:
base_url: http://kratos:4434/
selfservice:
default_browser_return_url: http://127.0.0.1:4455/
whitelisted_return_urls:
- http://127.0.0.1:4455
methods:
password:
enabled: true
flows:
error:
ui_url: http://127.0.0.1:4455/error
settings:
ui_url: http://127.0.0.1:4455/settings

54
oryx/configx/stub/from-files/b.yaml Normal file
View File

@@ -0,0 +1,54 @@
selfservice:
flows:
settings:
privileged_session_max_age: 15m
recovery:
enabled: true
ui_url: http://127.0.0.1:4455/recovery
verification:
enabled: true
ui_url: http://127.0.0.1:4455/verify
after:
default_browser_return_url: http://127.0.0.1:4455/
logout:
after:
default_browser_return_url: http://127.0.0.1:4455/auth/login
login:
ui_url: http://127.0.0.1:4455/auth/login
lifespan: 10m
registration:
lifespan: 10m
ui_url: http://127.0.0.1:4455/auth/registration
after:
password:
hooks:
- hook: session
log:
level: debug
format: text
leak_sensitive_values: true
secrets:
cookie:
- PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
hashers:
argon2:
parallelism: 1
memory: 131072
iterations: 2
salt_length: 16
key_length: 16
identity:
default_schema_url: file:///etc/config/kratos/identity.schema.json
courier:
smtp:
connection_uri: smtps://test:test@mailslurper:1025/?skip_ssl_verify=true

1085
oryx/configx/stub/from-files/config.schema.json Normal file
View File

File diff suppressed because it is too large Load Diff

124
oryx/configx/stub/from-files/expected.json Normal file
View File

@@ -0,0 +1,124 @@
{
"courier": {
"smtp": {
"connection_uri": "smtps://test:test@mailslurper:1025/?skip_ssl_verify=true",
"from_address": "no-reply@ory.kratos.sh"
}
},
"dsn": "sqlite:///var/lib/sqlite/db.sqlite?_fk=true",
"hashers": {
"argon2": {
"iterations": 2,
"key_length": 16,
"memory": 131072,
"parallelism": 1,
"salt_length": 16
}
},
"identity": {
"default_schema_url": "file:///etc/config/kratos/identity.schema.json"
},
"log": {
"format": "text",
"leak_sensitive_values": true,
"level": "debug"
},
"secrets": {
"cookie": ["PLEASE-CHANGE-ME-I-AM-VERY-INSECURE"]
},
"selfservice": {
"default_browser_return_url": "http://127.0.0.1:4455/",
"flows": {
"error": {
"ui_url": "http://127.0.0.1:4455/error"
},
"login": {
"lifespan": "10m",
"ui_url": "http://127.0.0.1:4455/auth/login"
},
"logout": {
"after": {
"default_browser_return_url": "http://127.0.0.1:4455/auth/login"
}
},
"recovery": {
"enabled": true,
"lifespan": "1h",
"ui_url": "http://127.0.0.1:4455/recovery"
},
"registration": {
"after": {
"password": {
"hooks": [
{
"hook": "session"
}
]
}
},
"lifespan": "10m",
"ui_url": "http://127.0.0.1:4455/auth/registration"
},
"settings": {
"lifespan": "1h",
"privileged_session_max_age": "15m",
"ui_url": "http://127.0.0.1:4455/settings"
},
"verification": {
"after": {
"default_browser_return_url": "http://127.0.0.1:4455/"
},
"enabled": true,
"lifespan": "1h",
"ui_url": "http://127.0.0.1:4455/verify"
}
},
"methods": {
"link": {
"enabled": true
},
"oidc": {
"enabled": false
},
"password": {
"enabled": true
},
"profile": {
"enabled": true
}
},
"whitelisted_return_urls": ["http://127.0.0.1:4455"]
},
"serve": {
"admin": {
"base_url": "http://kratos:4434/",
"host": "0.0.0.0",
"port": 4434
},
"public": {
"base_url": "http://127.0.0.1:4433/",
"cors": {
"allow_credentials": true,
"allowed_headers": ["Authorization", "Content-Type", "X-Session-Token"],
"allowed_methods": ["POST", "GET", "PUT", "PATCH", "DELETE"],
"allowed_origins": ["*"],
"debug": false,
"enabled": true,
"exposed_headers": ["Content-Type"],
"max_age": 0,
"options_passthrough": false
},
"host": "0.0.0.0",
"port": 4433
}
},
"session": {
"cookie": {
"path": "/",
"persistent": true,
"same_site": "Lax"
},
"lifespan": "24h"
},
"version": "v0.5.3-alpha.1"
}

792
oryx/configx/stub/hydra/config.schema.json Normal file
View File

@@ -0,0 +1,792 @@
{
"$id": "https://github.com/ory/hydra/docs/config.schema.json",
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "ORY Hydra Configuration",
"type": "object",
"definitions": {
"http_method": {
"type": "string",
"enum": [
"POST",
"GET",
"PUT",
"PATCH",
"DELETE",
"CONNECT",
"HEAD",
"OPTIONS",
"TRACE"
]
},
"port_number": {
"type": "integer",
"description": "The port to listen on.",
"minimum": 1,
"maximum": 65535
},
"socket": {
"type": "object",
"additionalProperties": false,
"description": "Sets the permissions of the unix socket",
"properties": {
"owner": {
"type": "string",
"description": "Owner of unix socket. If empty, the owner will be the user running hydra.",
"default": ""
},
"group": {
"type": "string",
"description": "Group of unix socket. If empty, the group will be the primary group of the user running hydra.",
"default": ""
},
"mode": {
"type": "integer",
"description": "Mode of unix socket in numeric form",
"default": 493,
"minimum": 0,
"maximum": 511
}
}
},
"cors": {
"type": "object",
"additionalProperties": false,
"description": "Configures Cross Origin Resource Sharing for public endpoints.",
"properties": {
"enabled": {
"type": "boolean",
"description": "Sets whether CORS is enabled.",
"default": false
},
"allowed_origins": {
"type": "array",
"description": "A list of origins a cross-domain request can be executed from. If the special * value is present in the list, all origins will be allowed. An origin may contain a wildcard (*) to replace 0 or more characters (i.e.: http://*.domain.com). Only one wildcard can be used per origin.",
"items": {
"type": "string",
"minLength": 1,
"not": {
"type": "string",
"description": "does match all strings that contain two or more (*)",
"pattern": ".*\\*.*\\*.*"
},
"anyOf": [
{
"format": "uri"
},
{
"const": "*"
}
]
},
"uniqueItems": true,
"default": ["*"],
"examples": [
[
"https://example.com",
"https://*.example.com",
"https://*.foo.example.com"
]
]
},
"allowed_methods": {
"type": "array",
"description": "A list of HTTP methods the user agent is allowed to use with cross-domain requests.",
"default": ["POST", "GET", "PUT", "PATCH", "DELETE"],
"items": {
"type": "string",
"enum": [
"POST",
"GET",
"PUT",
"PATCH",
"DELETE",
"CONNECT",
"HEAD",
"OPTIONS",
"TRACE"
]
}
},
"allowed_headers": {
"type": "array",
"description": "A list of non simple headers the client is allowed to use with cross-domain requests.",
"default": ["Authorization", "Content-Type"],
"items": {
"type": "string"
}
},
"exposed_headers": {
"type": "array",
"description": "Sets which headers are safe to expose to the API of a CORS API specification.",
"default": ["Content-Type"],
"items": {
"type": "string"
}
},
"allow_credentials": {
"type": "boolean",
"description": "Sets whether the request can include user credentials like cookies, HTTP authentication or client side SSL certificates.",
"default": true
},
"options_passthrough": {
"type": "boolean",
"description": "TODO",
"default": false
},
"max_age": {
"type": "integer",
"description": "Sets how long (in seconds) the results of a preflight request can be cached. If set to 0, every request is preceded by a preflight request.",
"default": 0,
"minimum": 0
},
"debug": {
"type": "boolean",
"description": "Adds additional log output to debug server side CORS issues.",
"default": false
}
}
},
"pem_file": {
"type": "object",
"oneOf": [
{
"properties": {
"path": {
"type": "string",
"description": "The path to the pem file.",
"examples": ["/path/to/file.pem"]
}
},
"additionalProperties": false,
"required": ["path"]
},
{
"properties": {
"base64": {
"type": "string",
"description": "The base64 encoded string (without padding).",
"contentEncoding": "base64",
"contentMediaType": "application/x-pem-file",
"examples": ["b3J5IGh5ZHJhIGlzIGF3ZXNvbWUK"]
}
},
"additionalProperties": false,
"required": ["base64"]
}
]
},
"duration": {
"type": "string",
"pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
"examples": ["1h"]
}
},
"properties": {
"log": {
"type": "object",
"additionalProperties": false,
"description": "Configures the logger",
"properties": {
"level": {
"type": "string",
"description": "Sets the log level.",
"enum": ["panic", "fatal", "error", "warn", "info", "debug", "trace"],
"default": "info"
},
"leak_sensitive_values": {
"type": "boolean",
"description": "Logs sensitive values such as cookie and URL parameter.",
"default": false
},
"redaction_text": {
"type": "string",
"title": "Sensitive log value redaction text",
"description": "Text to use, when redacting sensitive log value."
},
"format": {
"type": "string",
"description": "Sets the log format.",
"enum": ["json", "json_pretty", "text"],
"default": "text"
}
}
},
"serve": {
"type": "object",
"additionalProperties": false,
"description": "Controls the configuration for the http(s) daemon(s).",
"properties": {
"public": {
"type": "object",
"additionalProperties": false,
"description": "Controls the public daemon serving public API endpoints like /oauth2/auth, /oauth2/token, /.well-known/jwks.json",
"properties": {
"port": {
"default": 4444,
"allOf": [
{
"$ref": "#/definitions/port_number"
}
]
},
"host": {
"type": "string",
"description": "The interface or unix socket ORY Hydra should listen and handle public API requests on. Use the prefix \"unix:\" to specify a path to a unix socket. Leave empty to listen on all interfaces.",
"default": "",
"examples": ["localhost"]
},
"cors": {
"$ref": "#/definitions/cors"
},
"socket": {
"$ref": "#/definitions/socket"
},
"access_log": {
"type": "object",
"additionalProperties": false,
"description": "Access Log configuration for public server.",
"properties": {
"disable_for_health": {
"type": "boolean",
"description": "Disable access log for health endpoints.",
"default": false
}
}
}
}
},
"admin": {
"type": "object",
"additionalProperties": false,
"properties": {
"port": {
"default": 4445,
"allOf": [
{
"$ref": "#/definitions/port_number"
}
]
},
"host": {
"type": "string",
"description": "The interface or unix socket ORY Hydra should listen and handle administrative API requests on. Use the prefix \"unix:\" to specify a path to a unix socket. Leave empty to listen on all interfaces.",
"default": "",
"examples": ["localhost"]
},
"cors": {
"$ref": "#/definitions/cors"
},
"socket": {
"$ref": "#/definitions/socket"
},
"access_log": {
"type": "object",
"additionalProperties": false,
"description": "Access Log configuration for admin server.",
"properties": {
"disable_for_health": {
"type": "boolean",
"description": "Disable access log for health endpoints.",
"default": false
}
}
}
}
},
"tls": {
"type": "object",
"additionalProperties": false,
"description": "Configures HTTPS (HTTP over TLS). If configured, the server automatically supports HTTP/2.",
"properties": {
"key": {
"description": "Configures the private key (pem encoded).",
"allOf": [
{
"$ref": "#/definitions/pem_file"
}
]
},
"cert": {
"description": "Configures the private key (pem encoded).",
"allOf": [
{
"$ref": "#/definitions/pem_file"
}
]
},
"allow_termination_from": {
"type": "array",
"description": "Whitelist one or multiple CIDR address ranges and allow them to terminate TLS connections. Be aware that the X-Forwarded-Proto header must be set and must never be modifiable by anyone but your proxy / gateway / load balancer. Supports ipv4 and ipv6. Hydra serves http instead of https when this option is set.",
"items": {
"type": "string",
"oneOf": [
{
"pattern": "^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8])$"
},
{
"pattern": "^([0-9]{1,3}\\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$"
}
],
"examples": ["127.0.0.1/32"]
}
}
}
},
"cookies": {
"type": "object",
"additionalProperties": false,
"properties": {
"same_site_mode": {
"type": "string",
"description": "Specify the SameSite mode that cookies should be sent with.",
"enum": ["Strict", "Lax", "None"],
"default": "None"
},
"same_site_legacy_workaround": {
"type": "boolean",
"description": "Some older browser versions don’t work with SameSite=None. This option enables the workaround defined in https://web.dev/samesite-cookie-recipes/ which essentially stores a second cookie without SameSite as a fallback.",
"default": false,
"examples": [true]
}
}
}
}
},
"dsn": {
"type": "string",
"description": "Sets the data source name. This configures the backend where ORY Hydra persists data. If dsn is \"memory\", data will be written to memory and is lost when you restart this instance. ORY Hydra supports popular SQL databases. For more detailed configuration information go to: https://www.ory.sh/docs/hydra/dependencies-environment#sql"
},
"webfinger": {
"type": "object",
"additionalProperties": false,
"description": "Configures ./well-known/ settings.",
"properties": {
"jwks": {
"type": "object",
"additionalProperties": false,
"description": "Configures the /.well-known/jwks.json endpoint.",
"properties": {
"broadcast_keys": {
"type": "array",
"description": "A list of JSON Web Keys that should be exposed at that endpoint. This is usually the public key for verifying OpenID Connect ID Tokens. However, you might want to add additional keys here as well.",
"items": {
"type": "string"
},
"default": ["hydra.openid.id-token"],
"examples": ["hydra.jwt.access-token"]
}
}
},
"oidc_discovery": {
"type": "object",
"additionalProperties": false,
"description": "Configures OpenID Connect Discovery (/.well-known/openid-configuration).",
"properties": {
"jwks_url": {
"type": "string",
"description": "Overwrites the JWKS URL",
"format": "uri",
"examples": ["https://my-service.com/.well-known/jwks.json"]
},
"token_url": {
"type": "string",
"description": "Overwrites the OAuth2 Token URL",
"format": "uri",
"examples": ["https://my-service.com/oauth2/token"]
},
"auth_url": {
"type": "string",
"description": "Overwrites the OAuth2 Auth URL",
"format": "uri",
"examples": ["https://my-service.com/oauth2/auth"]
},
"client_registration_url": {
"description": "Sets the OpenID Connect Dynamic Client Registration Endpoint",
"type": "string",
"format": "uri",
"examples": ["https://my-service.com/clients"]
},
"supported_claims": {
"type": "array",
"description": "A list of supported claims to be broadcasted. Claim \"sub\" is always included.",
"items": {
"type": "string"
},
"examples": [["email", "username"]]
},
"supported_scope": {
"type": "array",
"description": "The scope OAuth 2.0 Clients may request. Scope `offline`, `offline_access`, and `openid` are always included.",
"items": {
"type": "string"
},
"examples": [["email", "whatever", "read.photos"]]
},
"userinfo_url": {
"type": "string",
"description": "A URL of the userinfo endpoint to be advertised at the OpenID Connect Discovery endpoint /.well-known/openid-configuration. Defaults to ORY Hydra's userinfo endpoint at /userinfo. Set this value if you want to handle this endpoint yourself.",
"format": "uri",
"examples": ["https://example.org/my-custom-userinfo-endpoint"]
}
}
}
}
},
"oidc": {
"type": "object",
"additionalProperties": false,
"description": "Configures OpenID Connect features.",
"properties": {
"subject_identifiers": {
"type": "object",
"additionalProperties": false,
"description": "Configures the Subject Identifier algorithm. For more information please head over to the documentation: https://www.ory.sh/docs/hydra/advanced#subject-identifier-algorithms",
"properties": {
"enabled": {
"type": "array",
"description": "A list of algorithms to enable.",
"items": {
"type": "string",
"enum": ["public", "pairwise"]
}
},
"pairwise": {
"type": "object",
"additionalProperties": false,
"description": "Configures the pairwise algorithm.",
"properties": {
"salt": {
"type": "string"
}
},
"required": ["salt"]
}
},
"if": {
"properties": {
"enabled": {
"contains": {
"const": "pairwise"
}
}
}
},
"then": {
"required": ["pairwise"]
},
"else": {
"properties": {
"pairwise": {
"$comment": "This enforces pairwise to not be set if 'enabled' does not contain 'pairwise'",
"not": {}
}
}
},
"examples": [
{
"enabled": ["public", "pairwise"],
"pairwise": {
"salt": "some-random-salt"
}
}
]
},
"dynamic_client_registration": {
"type": "object",
"additionalProperties": false,
"description": "Configures OpenID Connect Dynamic Client Registration (exposed as admin endpoints /clients/...).",
"properties": {
"default_scope": {
"type": "array",
"description": "The OpenID Connect Dynamic Client Registration specification has no concept of whitelisting OAuth 2.0 Scope. If you want to expose Dynamic Client Registration, you should set the default scope enabled for newly registered clients. Keep in mind that users can overwrite this default by setting the \"scope\" key in the registration payload, effectively disabling the concept of whitelisted scopes.",
"items": {
"type": "string"
},
"examples": [["openid", "offline", "offline_access"]]
}
}
}
}
},
"urls": {
"type": "object",
"additionalProperties": false,
"properties": {
"self": {
"type": "object",
"additionalProperties": false,
"properties": {
"issuer": {
"type": "string",
"description": "This value will be used as the \"issuer\" in access and ID tokens. It must be specified and using HTTPS protocol, unless --dangerous-force-http is set. This should typically be equal to the public value.",
"format": "uri",
"examples": ["https://localhost:4444/"]
},
"public": {
"type": "string",
"description": "This is the base location of the public endpoints of your ORY Hydra installation. This should typically be equal to the issuer value. If left unspecified, it falls back to the issuer value.",
"format": "uri",
"examples": ["https://localhost:4444/"]
}
}
},
"login": {
"type": "string",
"description": "Sets the login endpoint of the User Login & Consent flow. Defaults to an internal fallback URL showing an error.",
"format": "uri",
"examples": ["https://my-login.app/login"]
},
"consent": {
"type": "string",
"description": "Sets the consent endpoint of the User Login & Consent flow. Defaults to an internal fallback URL showing an error.",
"format": "uri",
"examples": ["https://my-consent.app/consent"]
},
"logout": {
"type": "string",
"description": "Sets the logout endpoint. Defaults to an internal fallback URL showing an error.",
"format": "uri",
"examples": ["https://my-logout.app/logout"]
},
"error": {
"type": "string",
"description": "Sets the error endpoint. The error ui will be shown when an OAuth2 error occurs that which can not be sent back to the client. Defaults to an internal fallback URL showing an error.",
"format": "uri",
"examples": ["https://my-error.app/error"]
},
"post_logout_redirect": {
"type": "string",
"description": "When a user agent requests to logout, it will be redirected to this url afterwards per default.",
"format": "uri",
"examples": ["https://my-example.app/logout-successful"]
}
}
},
"strategies": {
"type": "object",
"additionalProperties": false,
"properties": {
"scope": {
"type": "string",
"description": "Defines how scopes are matched. For more details have a look at https://github.com/ory/fosite#scopes",
"enum": [
"exact",
"wildcard",
"DEPRECATED_HIERARCHICAL_SCOPE_STRATEGY"
],
"default": "wildcard"
},
"access_token": {
"type": "string",
"description": "Defines access token type. jwt is a bad idea, see https://www.ory.sh/docs/hydra/advanced#json-web-tokens",
"enum": ["opaque", "jwt"]
}
}
},
"ttl": {
"type": "object",
"additionalProperties": false,
"description": "Configures time to live.",
"properties": {
"login_consent_request": {
"description": "Configures how long a user login and consent flow may take.",
"default": "1h",
"allOf": [
{
"$ref": "#/definitions/duration"
}
]
},
"access_token": {
"description": "Configures how long access tokens are valid.",
"default": "1h",
"allOf": [
{
"$ref": "#/definitions/duration"
}
]
},
"refresh_token": {
"description": "Configures how long refresh tokens are valid. Set to -1 for refresh tokens to never expire.",
"default": "720h",
"oneOf": [
{
"$ref": "#/definitions/duration"
},
{
"enum": ["-1", -1]
}
]
},
"id_token": {
"description": "Configures how long id tokens are valid.",
"default": "1h",
"allOf": [
{
"$ref": "#/definitions/duration"
}
]
},
"auth_code": {
"description": "Configures how long auth codes are valid.",
"default": "10m",
"allOf": [
{
"$ref": "#/definitions/duration"
}
]
}
}
},
"oauth2": {
"type": "object",
"additionalProperties": false,
"properties": {
"expose_internal_errors": {
"type": "boolean",
"description": "Set this to true if you want to share error debugging information with your OAuth 2.0 clients. Keep in mind that debug information is very valuable when dealing with errors, but might also expose database error codes and similar errors.",
"default": false,
"examples": [true]
},
"session": {
"type": "object",
"properties": {
"encrypt_at_rest": {
"type": "boolean",
"default": true,
"title": "Encrypt OAuth2 Session",
"description": "If set to true (default) ORY Hydra encrypt OAuth2 and OpenID Connect session data using AES-GCM and the system secret before persisting it in the database."
}
}
},
"include_legacy_error_fields": {
"type": "boolean",
"description": "Set this to true if you want to include the `error_hint` and `error_debug` legacy fields in error responses. We recommend to set this to `false` unless you have clients using these fields.",
"default": false,
"examples": [true]
},
"hashers": {
"type": "object",
"additionalProperties": false,
"description": "Configures hashing algorithms. Supports only BCrypt at the moment.",
"properties": {
"bcrypt": {
"type": "object",
"additionalProperties": false,
"description": "Configures the BCrypt hashing algorithm used for hashing Client Secrets.",
"properties": {
"cost": {
"type": "integer",
"description": "Sets the BCrypt cost. The higher the value, the more CPU time is being used to generate hashes.",
"default": 10,
"minimum": 4,
"maximum": 31
}
}
}
}
},
"pkce": {
"type": "object",
"additionalProperties": false,
"properties": {
"enforced": {
"type": "boolean",
"description": "Sets whether PKCE should be enforced for all clients.",
"examples": [true]
},
"enforced_for_public_clients": {
"type": "boolean",
"description": "Sets whether PKCE should be enforced for public clients.",
"examples": [true]
}
}
},
"client_credentials": {
"type": "object",
"additionalProperties": false,
"properties": {
"default_grant_allowed_scope": {
"type": "boolean",
"description": "Defines how scopes are added if the request doesn't contains any scope",
"examples": [false]
}
}
}
}
},
"secrets": {
"type": "object",
"additionalProperties": false,
"description": "The secrets section configures secrets used for encryption and signing of several systems. All secrets can be rotated, for more information on this topic go to: https://www.ory.sh/docs/hydra/advanced#rotation-of-hmac-token-signing-and-database-and-cookie-encryption-keys",
"properties": {
"system": {
"description": "The system secret must be at least 16 characters long. If none is provided, one will be generated. They key is used to encrypt sensitive data using AES-GCM (256 bit) and validate HMAC signatures. The first item in the list is used for signing and encryption. The whole list is used for verifying signatures and decryption.",
"type": "array",
"items": {
"type": "string",
"minLength": 16
},
"examples": [
[
"this-is-the-primary-secret",
"this-is-an-old-secret",
"this-is-another-old-secret"
]
]
},
"cookie": {
"type": "array",
"description": "A secret that is used to encrypt cookie sessions. Defaults to secrets.system. It is recommended to use a separate secret in production. The first item in the list is used for signing and encryption. The whole list is used for verifying signatures and decryption.",
"items": {
"type": "string",
"minLength": 16
},
"examples": [
[
"this-is-the-primary-secret",
"this-is-an-old-secret",
"this-is-another-old-secret"
]
]
}
}
},
"profiling": {
"type": "string",
"description": "Enables profiling if set. For more details on profiling, head over to: https://blog.golang.org/profiling-go-programs",
"enum": ["cpu", "mem"],
"examples": ["cpu"]
},
"tracing": {
"$ref": "ory://tracing-config"
},
"version": {
"type": "string",
"title": "The Hydra version this config is written for.",
"description": "SemVer according to https://semver.org/ prefixed with `v` as in our releases.",
"pattern": "^v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$"
},
"cgroups": {
"type": "object",
"additionalProperties": false,
"description": "ORY Hydra can respect Linux container CPU quota",
"properties": {
"v1": {
"type": "object",
"additionalProperties": false,
"description": "Configures parameters using cgroups v1 hierarchy",
"properties": {
"auto_max_procs_enabled": {
"type": "boolean",
"description": "Set GOMAXPROCS automatically according to cgroups limits",
"default": false,
"examples": [true]
}
}
}
}
}
},
"required": ["dsn"]
}

122
oryx/configx/stub/hydra/expected.json Normal file
View File

@@ -0,0 +1,122 @@
{
"cgroups": {
"v1": {
"auto_max_procs_enabled": false
}
},
"dsn": "sqlite:///var/lib/sqlite/db.sqlite?_fk=true",
"log": {
"format": "text",
"leak_sensitive_values": false,
"level": "info"
},
"oauth2": {
"expose_internal_errors": false,
"hashers": {
"bcrypt": {
"cost": 10
}
},
"include_legacy_error_fields": false,
"session": {
"encrypt_at_rest": true
}
},
"oidc": {
"subject_identifiers": {
"enabled": ["pairwise", "public"],
"pairwise": {
"salt": "youReallyNeedToChangeThis"
}
}
},
"secrets": {
"system": ["youReallyNeedToChangeThis"]
},
"serve": {
"admin": {
"access_log": {
"disable_for_health": false
},
"cors": {
"allow_credentials": true,
"allowed_headers": ["Authorization", "Content-Type"],
"allowed_methods": ["POST", "GET", "PUT", "PATCH", "DELETE"],
"allowed_origins": ["*"],
"debug": false,
"enabled": false,
"exposed_headers": ["Content-Type"],
"max_age": 0,
"options_passthrough": false
},
"host": "",
"port": 4445,
"socket": {
"group": "",
"mode": 493,
"owner": ""
}
},
"cookies": {
"same_site_legacy_workaround": false,
"same_site_mode": "Lax"
},
"public": {
"access_log": {
"disable_for_health": false
},
"cors": {
"allow_credentials": true,
"allowed_headers": ["Authorization", "Content-Type"],
"allowed_methods": ["POST", "GET", "PUT", "PATCH", "DELETE"],
"allowed_origins": ["*"],
"debug": false,
"enabled": false,
"exposed_headers": ["Content-Type"],
"max_age": 0,
"options_passthrough": false
},
"host": "",
"port": 4444,
"socket": {
"group": "",
"mode": 493,
"owner": ""
}
}
},
"strategies": {
"scope": "wildcard"
},
"tracing": {
"provider": "jaeger",
"providers": {
"jaeger": {
"local_agent_address": "jaeger:6831",
"sampling": {
"server_url": "http://jaeger:5778/sampling"
}
}
}
},
"ttl": {
"access_token": "1h",
"auth_code": "10m",
"id_token": "1h",
"login_consent_request": "1h",
"refresh_token": "720h"
},
"urls": {
"consent": "http://127.0.0.1:3000/consent",
"login": "http://127.0.0.1:3000/login",
"logout": "http://127.0.0.1:3000/logout",
"self": {
"issuer": "http://127.0.0.1:4444"
}
},
"webfinger": {
"jwks": {
"broadcast_keys": ["hydra.openid.id-token"]
}
}
}

22
oryx/configx/stub/hydra/hydra.yaml Normal file
View File

@@ -0,0 +1,22 @@
serve:
cookies:
same_site_mode: Lax
urls:
self:
issuer: http://127.0.0.1:4444
consent: http://127.0.0.1:3000/consent
login: http://127.0.0.1:3000/login
logout: http://127.0.0.1:3000/logout
secrets:
system:
- youReallyNeedToChangeThis
oidc:
subject_identifiers:
enabled:
- pairwise
- public
pairwise:
salt: youReallyNeedToChangeThis

1085
oryx/configx/stub/kratos/config.schema.json Normal file
View File

File diff suppressed because it is too large Load Diff

135
oryx/configx/stub/kratos/expected.json Normal file
View File

@@ -0,0 +1,135 @@
{
"courier": {
"smtp": {
"connection_uri": "smtps://test:test@mailslurper:1025/?skip_ssl_verify=true",
"from_address": "no-reply@ory.kratos.sh"
}
},
"dsn": "sqlite:///var/lib/sqlite/db.sqlite?_fk=true",
"hashers": {
"argon2": {
"iterations": 2,
"key_length": 16,
"memory": 131072,
"parallelism": 1,
"salt_length": 16
}
},
"identity": {
"default_schema_url": "file:///etc/config/kratos/identity.schema.json"
},
"log": {
"format": "text",
"leak_sensitive_values": true,
"level": "debug"
},
"secrets": {
"cookie": ["PLEASE-CHANGE-ME-I-AM-VERY-INSECURE"]
},
"selfservice": {
"default_browser_return_url": "http://127.0.0.1:4455/",
"flows": {
"error": {
"ui_url": "http://127.0.0.1:4455/error"
},
"login": {
"lifespan": "10m",
"ui_url": "http://127.0.0.1:4455/auth/login"
},
"logout": {
"after": {
"default_browser_return_url": "http://127.0.0.1:4455/auth/login"
}
},
"recovery": {
"enabled": true,
"lifespan": "1h",
"ui_url": "http://127.0.0.1:4455/recovery"
},
"registration": {
"after": {
"password": {
"hooks": [
{
"hook": "session"
}
]
}
},
"lifespan": "10m",
"ui_url": "http://127.0.0.1:4455/auth/registration"
},
"settings": {
"lifespan": "1h",
"privileged_session_max_age": "15m",
"ui_url": "http://127.0.0.1:4455/settings"
},
"verification": {
"after": {
"default_browser_return_url": "http://127.0.0.1:4455/"
},
"enabled": true,
"lifespan": "1h",
"ui_url": "http://127.0.0.1:4455/verify"
}
},
"methods": {
"link": {
"enabled": true
},
"oidc": {
"enabled": true,
"config": {
"providers": [
{
"id": "google",
"provider": "google",
"mapper_url": "file:///etc/config/kratos/oidc.google.jsonnet",
"client_id": "client@example.com",
"client_secret": "secret"
}
]
}
},
"password": {
"enabled": true
},
"profile": {
"enabled": true
}
},
"whitelisted_return_urls": ["http://127.0.0.1:4455"]
},
"serve": {
"admin": {
"base_url": "http://kratos:4434/",
"host": "0.0.0.0",
"port": 4434
},
"public": {
"base_url": "http://127.0.0.1:4433/",
"cors": {
"allow_credentials": true,
"allowed_headers": ["Authorization", "Content-Type", "X-Session-Token"],
"allowed_methods": ["POST", "GET", "PUT", "PATCH", "DELETE"],
"allowed_origins": ["*"],
"debug": false,
"enabled": true,
"exposed_headers": ["Content-Type"],
"max_age": 0,
"options_passthrough": false
},
"host": "0.0.0.0",
"port": 4433
}
},
"session": {
"cookie": {
"path": "/",
"persistent": true,
"same_site": "Lax"
},
"lifespan": "24h"
},
"version": "v0.5.3-alpha.1"
}

76
oryx/configx/stub/kratos/kratos.yaml Normal file
View File

@@ -0,0 +1,76 @@
version: v0.5.3-alpha.1
dsn: memory
serve:
public:
base_url: http://127.0.0.1:4433/
cors:
enabled: true
admin:
base_url: http://kratos:4434/
selfservice:
default_browser_return_url: http://127.0.0.1:4455/
whitelisted_return_urls:
- http://127.0.0.1:4455
methods:
password:
enabled: true
oidc:
enabled: true
flows:
error:
ui_url: http://127.0.0.1:4455/error
settings:
ui_url: http://127.0.0.1:4455/settings
privileged_session_max_age: 15m
recovery:
enabled: true
ui_url: http://127.0.0.1:4455/recovery
verification:
enabled: true
ui_url: http://127.0.0.1:4455/verify
after:
default_browser_return_url: http://127.0.0.1:4455/
logout:
after:
default_browser_return_url: http://127.0.0.1:4455/auth/login
login:
ui_url: http://127.0.0.1:4455/auth/login
lifespan: 10m
registration:
lifespan: 10m
ui_url: http://127.0.0.1:4455/auth/registration
log:
level: debug
format: text
leak_sensitive_values: true
secrets:
cookie:
- PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
hashers:
argon2:
parallelism: 1
memory: 131072
iterations: 2
salt_length: 16
key_length: 16
identity:
default_schema_url: file:///etc/config/kratos/identity.schema.json
courier:
smtp:
connection_uri: smtps://test:test@mailslurper:1025/?skip_ssl_verify=true

27
oryx/configx/stub/multi/a.yaml Normal file
View File

@@ -0,0 +1,27 @@
version: v0.5.3-alpha.1
dsn: memory
serve:
public:
base_url: http://127.0.0.1:4433/
cors:
enabled: true
admin:
base_url: http://kratos:4434/
selfservice:
default_browser_return_url: http://127.0.0.1:4455/
whitelisted_return_urls:
- http://127.0.0.1:4455
methods:
password:
enabled: true
flows:
error:
ui_url: http://127.0.0.1:4455/error
settings:
ui_url: http://127.0.0.1:4455/settings

54
oryx/configx/stub/multi/b.yaml Normal file
View File

@@ -0,0 +1,54 @@
selfservice:
flows:
settings:
privileged_session_max_age: 15m
recovery:
enabled: true
ui_url: http://127.0.0.1:4455/recovery
verification:
enabled: true
ui_url: http://127.0.0.1:4455/verify
after:
default_browser_return_url: http://127.0.0.1:4455/
logout:
after:
default_browser_return_url: http://127.0.0.1:4455/auth/login
login:
ui_url: http://127.0.0.1:4455/auth/login
lifespan: 10m
registration:
lifespan: 10m
ui_url: http://127.0.0.1:4455/auth/registration
after:
password:
hooks:
- hook: session
log:
level: debug
format: text
leak_sensitive_values: true
secrets:
cookie:
- PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
hashers:
argon2:
parallelism: 1
memory: 131072
iterations: 2
salt_length: 16
key_length: 16
identity:
default_schema_url: file:///etc/config/kratos/identity.schema.json
courier:
smtp:
connection_uri: smtps://test:test@mailslurper:1025/?skip_ssl_verify=true

1085
oryx/configx/stub/multi/config.schema.json Normal file
View File

File diff suppressed because it is too large Load Diff

124
oryx/configx/stub/multi/expected.json Normal file
View File

@@ -0,0 +1,124 @@
{
"courier": {
"smtp": {
"connection_uri": "smtps://test:test@mailslurper:1025/?skip_ssl_verify=true",
"from_address": "no-reply@ory.kratos.sh"
}
},
"dsn": "sqlite:///var/lib/sqlite/db.sqlite?_fk=true",
"hashers": {
"argon2": {
"iterations": 2,
"key_length": 16,
"memory": 131072,
"parallelism": 1,
"salt_length": 16
}
},
"identity": {
"default_schema_url": "file:///etc/config/kratos/identity.schema.json"
},
"log": {
"format": "text",
"leak_sensitive_values": true,
"level": "debug"
},
"secrets": {
"cookie": ["PLEASE-CHANGE-ME-I-AM-VERY-INSECURE"]
},
"selfservice": {
"default_browser_return_url": "http://127.0.0.1:4455/",
"flows": {
"error": {
"ui_url": "http://127.0.0.1:4455/error"
},
"login": {
"lifespan": "10m",
"ui_url": "http://127.0.0.1:4455/auth/login"
},
"logout": {
"after": {
"default_browser_return_url": "http://127.0.0.1:4455/auth/login"
}
},
"recovery": {
"enabled": true,
"lifespan": "1h",
"ui_url": "http://127.0.0.1:4455/recovery"
},
"registration": {
"after": {
"password": {
"hooks": [
{
"hook": "session"
}
]
}
},
"lifespan": "10m",
"ui_url": "http://127.0.0.1:4455/auth/registration"
},
"settings": {
"lifespan": "1h",
"privileged_session_max_age": "15m",
"ui_url": "http://127.0.0.1:4455/settings"
},
"verification": {
"after": {
"default_browser_return_url": "http://127.0.0.1:4455/"
},
"enabled": true,
"lifespan": "1h",
"ui_url": "http://127.0.0.1:4455/verify"
}
},
"methods": {
"link": {
"enabled": true
},
"oidc": {
"enabled": false
},
"password": {
"enabled": true
},
"profile": {
"enabled": true
}
},
"whitelisted_return_urls": ["http://127.0.0.1:4455"]
},
"serve": {
"admin": {
"base_url": "http://kratos:4434/",
"host": "0.0.0.0",
"port": 4434
},
"public": {
"base_url": "http://127.0.0.1:4433/",
"cors": {
"allow_credentials": true,
"allowed_headers": ["Authorization", "Content-Type", "X-Session-Token"],
"allowed_methods": ["POST", "GET", "PUT", "PATCH", "DELETE"],
"allowed_origins": ["*"],
"debug": false,
"enabled": true,
"exposed_headers": ["Content-Type"],
"max_age": 0,
"options_passthrough": false
},
"host": "0.0.0.0",
"port": 4433
}
},
"session": {
"cookie": {
"path": "/",
"persistent": true,
"same_site": "Lax"
},
"lifespan": "24h"
},
"version": "v0.5.3-alpha.1"
}

105
oryx/configx/stub/nested-array/config.schema.json Normal file
View File

@@ -0,0 +1,105 @@
{
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"providers": {
"title": "OpenID Connect and OAuth2 Providers",
"description": "A list and configuration of OAuth2 and OpenID Connect providers ORY Kratos should integrate with.",
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string",
"examples": ["google"]
},
"provider": {
"title": "Provider",
"description": "Can be one of github, gitlab, generic, google, microsoft, discord.",
"type": "string",
"enum": [
"github",
"gitlab",
"generic",
"google",
"microsoft",
"discord"
],
"examples": ["google"]
},
"client_id": {
"type": "string"
},
"client_secret": {
"type": "string"
},
"issuer_url": {
"type": "string",
"format": "uri",
"examples": ["https://accounts.google.com"]
},
"auth_url": {
"type": "string",
"format": "uri",
"examples": ["https://accounts.google.com/o/oauth2/v2/auth"]
},
"token_url": {
"type": "string",
"format": "uri",
"examples": ["https://www.googleapis.com/oauth2/v4/token"]
},
"mapper_url": {
"title": "Jsonnet Mapper URL",
"description": "The URL where the jsonnet source is located for mapping the provider's data to ORY Kratos data.",
"type": "string",
"format": "uri",
"examples": [
"file://path/to/oidc.jsonnet",
"https://foo.bar.com/path/to/oidc.jsonnet",
"base64://bG9jYWwgc3ViamVjdCA9I..."
]
},
"scope": {
"type": "array",
"items": {
"type": "string",
"examples": ["offline_access", "profile"]
}
},
"tenant": {
"title": "Azure AD Tenant",
"description": "The Azure AD Tenant to use for authentication.",
"type": "string",
"examples": [
"common",
"organizations",
"consumers",
"8eaef023-2b34-4da1-9baa-8bc8c9d6a490",
"contoso.onmicrosoft.com"
]
}
},
"additionalProperties": false,
"required": [],
"if": {
"properties": {
"provider": {
"const": "microsoft"
}
},
"required": ["provider"]
},
"then": {
"required": ["tenant"]
},
"else": {
"not": {
"properties": {
"tenant": {}
},
"required": ["tenant"]
}
}
}
}
}
}

11
oryx/configx/stub/nested-array/expected.json Normal file
View File

@@ -0,0 +1,11 @@
{
"providers": [
{
"id": "google",
"client_id": "client@example.com"
},
{
"client_id": "some@example.com"
}
]
}

2
oryx/configx/stub/nested-array/kratos.yaml Normal file
View File

@@ -0,0 +1,2 @@
providers:
- id: google

19
oryx/configx/stub/watch/config.schema.json Normal file
View File

@@ -0,0 +1,19 @@
{
"$id": "https://example.com/config.schema.json",
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "config",
"type": "object",
"properties": {
"dsn": {
"type": "string"
},
"foo": {
"const": "bar"
},
"bar": {
"type": "string",
"enum": ["foo", "bar", "baz"]
}
},
"required": ["dsn"]
}