snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

oryx/configx/stub/benchmark/benchmark.yaml

@@ -0,0 +1,312 @@
+# Please find the documentation for this file at
+# https://www.ory.com/oathkeeper/docs/configuration
+
+log:
+  level: debug
+  format: json
+
+profiling: cpu
+
+serve:
+  proxy:
+    port: 1234
+    host: 127.0.0.1
+
+    timeout:
+      read: 1s
+      write: 2s
+      idle: 3s
+
+    cors:
+      enabled: true
+      allowed_origins:
+        - https://example.com
+        - https://*.example.com
+      allowed_methods:
+        - POST
+        - GET
+        - PUT
+        - PATCH
+        - DELETE
+      allowed_headers:
+        - Authorization
+        - Content-Type
+      exposed_headers:
+        - Content-Type
+      allow_credentials: true
+      max_age: 10
+      debug: true
+    tls:
+      key:
+        path: /path/to/key.pem
+        base64: LS0tLS1CRUdJTiBFTkNSWVBURUQgUFJJVkFURSBLRVktLS0tLVxuTUlJRkRqQkFCZ2txaGtpRzl3MEJCUTB3...
+      cert:
+        path: /path/to/cert.pem
+        base64: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr...
+
+  api:
+    port: 1235
+    host: 127.0.0.2
+
+    timeout:
+      read: 1s
+      write: 2s
+      idle: 3s
+
+    cors:
+      enabled: true
+      allowed_origins:
+        - https://example.org
+        - https://*.example.org
+      allowed_methods:
+        - GET
+        - PUT
+        - PATCH
+        - DELETE
+      allowed_headers:
+        - Authorization
+        - Content-Type
+      exposed_headers:
+        - Content-Type
+      allow_credentials: true
+      max_age: 10
+      debug: true
+    tls:
+      key:
+        path: /path/to/key.pem
+        base64: LS0tLS1CRUdJTiBFTkNSWVBURUQgUFJJVkFURSBLRVktLS0tLVxuTUlJRkRqQkFCZ2txaGtpRzl3MEJCUTB3...
+      cert:
+        path: /path/to/cert.pem
+        base64: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr...
+
+  prometheus:
+    port: 9000
+    host: localhost
+    metrics_path: /metrics
+    collapse_request_paths: true
+
+# Configures Access Rules
+access_rules:
+  # Locations (list of URLs) where access rules should be fetched from on boot.
+  # It is expected that the documents at those locations return a JSON or YAML Array containing ORY Oathkeeper Access Rules.
+  repositories:
+    # If the URL Scheme is `file://`, the access rules (an array of access rules is expected) will be
+    # fetched from the local file system.
+    - file://path/to/rules.json
+    # If the URL Scheme is `inline://`, the access rules (an array of access rules is expected)
+    # are expected to be a base64 encoded (with padding!) JSON/YAML string (base64_encode(`[{"id":"foo-rule","authenticators":[....]}]`)):
+    - inline://W3siaWQiOiJmb28tcnVsZSIsImF1dGhlbnRpY2F0b3JzIjpbXX1d
+    # If the URL Scheme is `http://` or `https://`, the access rules (an array of access rules is expected) will be
+    # fetched from the provided HTTP(s) location.
+    - https://path-to-my-rules/rules.json
+  # Optional fields describing matching strategy, defaults to "regexp".
+  matching_strategy: glob
+
+errors:
+  fallback:
+    - json
+  handlers:
+    redirect:
+      enabled: true
+      config:
+        to: http://path-to/redirect
+    json:
+      enabled: true
+      config:
+        verbose: true
+        when:
+          - error:
+              - unauthorized
+              - forbidden
+              - internal_server_error
+            request:
+              header:
+                content_type:
+                  - application/json
+                accept:
+                  - application/json
+              cidr:
+                - 127.0.0.0/24
+
+# All authenticators can be configured under this configuration key
+authenticators:
+  # Configures the anonymous authenticator
+  anonymous:
+    # Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
+    enabled: true
+
+    config:
+      # Sets the anonymous username. Defaults to "anonymous". Common names include "guest", "anon", "anonymous", "unknown".
+      subject: guest
+
+  # Configures the cookie session authenticator
+  cookie_session:
+    # Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
+    enabled: true
+
+    config:
+      # Sets the origin to proxy requests to. If the response is a 200 with body `{ "subject": "...", "extra": {} }`
+      # The request will pass the subject through successfully, otherwise it will be marked as unauthorized
+      check_session_url: https://session-store-host
+
+      # Sets a list of possible cookies to look for on incoming requests, and will fallthrough to the next authenticator if
+      # none of the passed cookies are set on the request
+      only:
+        - sessionid
+
+  # Configures the jwt authenticator
+  jwt:
+    # Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
+    enabled: true
+
+    config:
+      # REQUIRED IF ENABLED - The URL where ORY Oathkeeper can retrieve JSON Web Keys from for validating the JSON Web
+      # Token. Usually something like "https://my-keys.com/.well-known/jwks.json". The response of that endpoint must
+      # return a JSON Web Key Set (JWKS).
+      jwks_urls:
+        - https://my-website.com/.well-known/jwks.json
+        - https://my-other-website.com/.well-known/jwks.json
+        - file://path/to/local/jwks.json
+
+      # Sets the strategy to be used to validate/match the scope. Supports "hierarchic", "exact", "wildcard", "none". Defaults
+      # to "none".
+      scope_strategy: wildcard
+
+  # Configures the noop authenticator
+  noop:
+    # Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
+    enabled: true
+
+  # Configures the oauth2_client_credentials authenticator
+  oauth2_client_credentials:
+    # Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
+    enabled: true
+
+    config:
+      # REQUIRED IF ENABLED - The OAuth 2.0 Token Endpoint that will be used to validate the client credentials.
+      token_url: https://my-website.com/oauth2/token
+
+  # Configures the oauth2_introspection authenticator
+  oauth2_introspection:
+    # Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
+    enabled: true
+
+    config:
+      # REQUIRED IF ENABLED - The OAuth 2.0 Token Introspection endpoint.
+      introspection_url: https://my-website.com/oauth2/introspection
+
+      # Sets the strategy to be used to validate/match the token scope. Supports "hierarchic", "exact", "wildcard", "none". Defaults
+      # to "none".
+      scope_strategy: exact
+
+      # Enable pre-authorization in cases where the OAuth 2.0 Token Introspection endpoint is protected by OAuth 2.0 Bearer
+      # Tokens that can be retrieved using the OAuth 2.0 Client Credentials grant.
+      pre_authorization:
+        # Enable pre-authorization. Defaults to false.
+        enabled: true
+
+        # REQUIRED IF ENABLED - The OAuth 2.0 Client ID to be used for the OAuth 2.0 Client Credentials Grant.
+        client_id: some_id
+
+        # REQUIRED IF ENABLED - The OAuth 2.0 Client Secret to be used for the OAuth 2.0 Client Credentials Grant.
+        client_secret: some_secret
+
+        # The OAuth 2.0 Scope to be requested during the OAuth 2.0 Client Credentials Grant.
+        scope:
+          - foo
+          - bar
+
+        # REQUIRED IF ENABLED - The OAuth 2.0 Token Endpoint where the OAuth 2.0 Client Credentials Grant will be performed.
+        token_url: https://my-website.com/oauth2/token
+
+  # Configures the unauthorized authenticator
+  unauthorized:
+    # Set enabled to true if the authenticator should be enabled and false to disable the authenticator. Defaults to false.
+    enabled: true
+
+# All authorizers can be configured under this configuration key
+authorizers:
+  # Configures the allow authorizer
+  allow:
+    # Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
+    enabled: true
+
+  # Configures the deny authorizer
+  deny:
+    # Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
+    enabled: true
+
+  # Configures the keto_engine_acp_ory authorizer
+  keto_engine_acp_ory:
+    # Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
+    enabled: true
+
+    config:
+      # REQUIRED IF ENABLED - The base URL of ORY Keto, typically something like http(s)://<host>[:<port>]/
+      base_url: http://my-keto/
+      required_action: unknown
+      required_resource: unknown
+
+  # Configures the remote authorizer
+  remote:
+    # Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
+    enabled: true
+
+    config:
+      remote: https://host/path
+      headers: {}
+
+  # Configures the remote_json authorizer
+  remote_json:
+    # Set enabled to true if the authorizer should be enabled and false to disable the authorizer. Defaults to false.
+    enabled: true
+
+    config:
+      remote: https://host/path
+      payload: "{}"
+
+# All mutators can be configured under this configuration key
+mutators:
+  header:
+    enabled: true
+    config:
+      headers:
+        foo: bar
+
+  # Configures the cookie mutator
+  cookie:
+    # Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.
+    enabled: true
+    config:
+      cookies:
+        foo: bar
+
+  # Configures the hydrator mutator
+  hydrator:
+    # Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.
+    enabled: true
+
+    config:
+      api:
+        url: https://some-url/
+
+  # Configures the id_token mutator
+  id_token:
+    # Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.
+    enabled: true
+    config:
+      # REQUIRED IF ENABLED - Sets the "iss" value of the ID Token.
+      issuer_url: https://my-oathkeeper/
+      # REQUIRED IF ENABLED - Sets the URL where keys should be fetched from. Supports remote locations (http, https) as
+      # well as local filesystem paths.
+      jwks_url: https://fetch-keys/from/this/location.json
+      # jwks_url: file:///from/this/absolute/location.json
+      # jwks_url: file://../from/this/relative/location.json
+
+      # Sets the time-to-live of the ID token. Defaults to one minute. Valid time units are: s (second), m (minute), h (hour).
+      ttl: 1h
+
+  # Configures the noop mutator
+  noop:
+    # Set enabled to true if the mutator should be enabled and false to disable the mutator. Defaults to false.
+    enabled: true

oryx/configx/stub/benchmark/schema.config.json

@@ -0,0 +1,204 @@
+{
+  "log": {
+    "level": "debug",
+    "format": "json"
+  },
+  "profiling": "cpu",
+  "serve": {
+    "proxy": {
+      "port": 1234,
+      "host": "127.0.0.1",
+      "timeout": {
+        "read": "1s",
+        "write": "2s",
+        "idle": "3s"
+      },
+      "cors": {
+        "enabled": true,
+        "allowed_origins": ["https://example.com", "https://*.example.com"],
+        "allowed_methods": ["POST", "GET", "PUT", "PATCH", "DELETE"],
+        "allowed_headers": ["Authorization", "Content-Type"],
+        "exposed_headers": ["Content-Type"],
+        "allow_credentials": true,
+        "max_age": 10,
+        "debug": true
+      },
+      "tls": {
+        "key": {
+          "path": "/path/to/key.pem",
+          "base64": "LS0tLS1CRUdJTiBFTkNSWVBURUQgUFJJVkFURSBLRVktLS0tLVxuTUlJRkRqQkFCZ2txaGtpRzl3MEJCUTB3..."
+        },
+        "cert": {
+          "path": "/path/to/cert.pem",
+          "base64": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr..."
+        }
+      }
+    },
+    "api": {
+      "port": 1235,
+      "host": "127.0.0.2",
+      "cors": {
+        "enabled": true,
+        "allowed_origins": ["https://example.org", "https://*.example.org"],
+        "allowed_methods": ["GET", "PUT", "PATCH", "DELETE"],
+        "allowed_headers": ["Authorization", "Content-Type"],
+        "exposed_headers": ["Content-Type"],
+        "allow_credentials": true,
+        "max_age": 10,
+        "debug": true
+      },
+      "tls": {
+        "key": {
+          "path": "/path/to/key.pem",
+          "base64": "LS0tLS1CRUdJTiBFTkNSWVBURUQgUFJJVkFURSBLRVktLS0tLVxuTUlJRkRqQkFCZ2txaGtpRzl3MEJCUTB3..."
+        },
+        "cert": {
+          "path": "/path/to/cert.pem",
+          "base64": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr..."
+        }
+      }
+    }
+  },
+  "access_rules": {
+    "repositories": [
+      "file://path/to/rules.json",
+      "inline://W3siaWQiOiJmb28tcnVsZSIsImF1dGhlbnRpY2F0b3JzIjpbXX1d",
+      "https://path-to-my-rules/rules.json"
+    ],
+    "matching_strategy": "glob"
+  },
+  "errors": {
+    "fallback": ["json"],
+    "handlers": {
+      "redirect": {
+        "enabled": true,
+        "config": {
+          "to": "http://path-to/redirect"
+        }
+      },
+      "json": {
+        "enabled": true,
+        "config": {
+          "verbose": true,
+          "when": [
+            {
+              "error": ["unauthorized", "forbidden", "internal_server_error"],
+              "request": {
+                "header": {
+                  "content_type": ["application/json"],
+                  "accept": ["application/json"]
+                },
+                "cidr": ["127.0.0.0/24"]
+              }
+            }
+          ]
+        }
+      }
+    }
+  },
+  "authenticators": {
+    "anonymous": {
+      "enabled": true,
+      "config": {
+        "subject": "guest"
+      }
+    },
+    "cookie_session": {
+      "enabled": true,
+      "config": {
+        "check_session_url": "https://session-store-host",
+        "only": ["sessionid"]
+      }
+    },
+    "jwt": {
+      "enabled": true,
+      "config": {
+        "jwks_urls": [
+          "https://my-website.com/.well-known/jwks.json",
+          "https://my-other-website.com/.well-known/jwks.json",
+          "file://path/to/local/jwks.json"
+        ],
+        "scope_strategy": "wildcard"
+      }
+    },
+    "noop": {
+      "enabled": true
+    },
+    "oauth2_client_credentials": {
+      "enabled": true,
+      "config": {
+        "token_url": "https://my-website.com/oauth2/token"
+      }
+    },
+    "oauth2_introspection": {
+      "enabled": true,
+      "config": {
+        "introspection_url": "https://my-website.com/oauth2/introspection",
+        "scope_strategy": "exact",
+        "pre_authorization": {
+          "enabled": true,
+          "client_id": "some_id",
+          "client_secret": "some_secret",
+          "scope": ["foo", "bar"],
+          "token_url": "https://my-website.com/oauth2/token"
+        }
+      }
+    },
+    "unauthorized": {
+      "enabled": true
+    }
+  },
+  "authorizers": {
+    "allow": {
+      "enabled": true
+    },
+    "deny": {
+      "enabled": true
+    },
+    "keto_engine_acp_ory": {
+      "enabled": true,
+      "config": {
+        "base_url": "http://my-keto/",
+        "required_action": "unknown",
+        "required_resource": "unknown"
+      }
+    }
+  },
+  "mutators": {
+    "header": {
+      "enabled": false,
+      "config": {
+        "headers": {
+          "foo": "bar"
+        }
+      }
+    },
+    "cookie": {
+      "enabled": true,
+      "config": {
+        "cookies": {
+          "foo": "bar"
+        }
+      }
+    },
+    "hydrator": {
+      "enabled": true,
+      "config": {
+        "api": {
+          "url": "https://some-url/"
+        }
+      }
+    },
+    "id_token": {
+      "enabled": true,
+      "config": {
+        "issuer_url": "https://my-oathkeeper/",
+        "jwks_url": "https://fetch-keys/from/this/location.json",
+        "ttl": "1h"
+      }
+    },
+    "noop": {
+      "enabled": true
+    }
+  }
+}