Ory Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision
API that authorizes HTTP requests based on sets of Access Rules. It follows the
BeyondCorp model designed by Google and secures applications in Zero-Trust
networks.
What is Ory Oathkeeper?
Ory Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision
API. It follows
cloud architecture best practices
and focuses on:
- Authenticating and authorizing HTTP requests
- Acting as a reverse proxy or decision API
- Mutating requests with identity information
- Integrating with existing API gateways and proxies
- Supporting multiple authentication and authorization strategies
- Working in Zero-Trust network architectures
We recommend starting with the
Ory Oathkeeper introduction docs to learn
more about its architecture, feature set, and how it compares to other systems.
Why Ory Oathkeeper
Ory Oathkeeper is designed to:
- Decouple authentication and authorization from application code
- Work as an API Gateway plugin or standalone proxy
- Support flexible access rules for different endpoints
- Integrate with Ambassador, Envoy, AWS API Gateway, Nginx, and more
- Provide both proxy and sidecar deployment modes
- Scale without effort in cloud native environments
Oathkeeper works with:
Deployment options
You can run Ory Oathkeeper in two main ways:
- As a managed service on the Ory Network
- As a self hosted service under your own control, with or without the Ory
Enterprise License
Installation
You can run Ory Oathkeeper yourself for full control over infrastructure,
deployment, and customization.
The install guide explains how
to:
- Install Oathkeeper on Linux, macOS, Windows, and Docker
- Configure access rules and authentication strategies
- Deploy to Kubernetes and other orchestration systems
This guide uses the open source distribution to get you started without license
requirements. It is a great fit for individuals, researchers, hackers, and
companies that want to experiment, prototype, or run unimportant workloads
without SLAs. You get the full core engine, and you are free to inspect, extend,
and build it from source.
If you run Oathkeeper as part of a business-critical system, you should use a
commercial agreement to reduce operational and security risk. The Ory
Enterprise License (OEL) layers on top of self-hosted Oathkeeper and provides:
- Additional enterprise features that are not available in the open source
version
- Regular security releases, including CVE patches, with service level
agreements
- Support for advanced scaling, multi-tenancy, and complex deployments
- Premium support options with SLAs, direct access to engineers, and onboarding
help
- Access to a private Docker registry with frequent and vetted, up-to-date
enterprise builds
For guaranteed CVE fixes, current enterprise builds, advanced features, and
support in production, you need a valid
Ory Enterprise License and access
to the Ory Enterprise Docker registry. To learn more,
contact the Ory team.
Quickstart
Head over to the
Ory Developer Documentation to
learn how to install Ory Oathkeeper on Linux, macOS, Windows, and Docker and how
to build Ory Oathkeeper from source.
Who is using Ory Oathkeeper
The Ory community stands on the shoulders of individuals, companies, and
maintainers. The Ory team thanks everyone involved - from submitting bug reports
and feature requests, to contributing patches and documentation. The Ory
community counts more than 50.000 members and is growing. The Ory stack protects
7.000.000.000+ API requests every day across thousands of companies. None of
this would have been possible without each and everyone of you!
The following list represents companies that have accompanied us along the way
and that have made outstanding contributions to our ecosystem. If you think
that your company deserves a spot here, reach out to
[email protected] now!
Many thanks to all individual contributors
Ecosystem
We build Ory on several guiding principles when it comes to our architecture
design:
- Minimal dependencies
- Runs everywhere
- Scales without effort
- Minimize room for human and network errors
Ory’s architecture is designed to run best on a Container Orchestration system
such as Kubernetes, CloudFoundry, OpenShift, and similar projects. Binaries are
small (5-15MB) and available for all popular processor types (ARM, AMD64, i386)
and operating systems (FreeBSD, Linux, macOS, Windows) without system
dependencies (Java, Node, Ruby, libxml, …).
Ory Kratos: Identity and User Infrastructure and Management
Ory Kratos is an API-first Identity and User
Management system that is built according to
cloud architecture best practices.
It implements core use cases that almost every software application needs to
deal with: Self-service Login and Registration, Multi-Factor Authentication
(MFA/2FA), Account Recovery and Verification, Profile, and Account Management.
Ory Hydra: OAuth2 & OpenID Connect Server
Ory Hydra is an OpenID Certified™ OAuth2 and
OpenID Connect Provider which easily connects to any existing identity system by
writing a tiny “bridge” application. It gives absolute control over the user
interface and user experience flows.
Ory Oathkeeper: Identity & Access Proxy
Ory Oathkeeper is a BeyondCorp/Zero Trust
Identity & Access Proxy (IAP) with configurable authentication, authorization,
and request mutation rules for your web services: Authenticate JWT, Access
Tokens, API Keys, mTLS; Check if the contained subject is allowed to perform the
request; Encode resulting content into custom headers (X-User-ID), JSON Web
Tokens and more!
Ory Keto: Access Control Policies as a Server
Ory Keto is a policy decision point. It uses a
set of access control policies, similar to AWS IAM Policies, in order to
determine whether a subject (user, application, service, car, …) is authorized
to perform a certain action on a resource.
Documentation
The full Oathkeeper documentation is available at
www.ory.com/docs/oathkeeper, including:
For upgrading and changelogs, check UPGRADE.md and
CHANGELOG.md.
Developing Ory Oathkeeper
See DEVELOP.md for information on:
- Contribution guidelines
- Prerequisites
- Install from source
- Running tests
- Build Docker image
Security
Disclosing vulnerabilities
If you think you found a security vulnerability, please refrain from posting it
publicly on the forums, the chat, or GitHub. You can find all info for
responsible disclosure in our
security.txt.
Telemetry
Our services collect summarized, anonymized data that can optionally be turned
off. Click here to learn more.
评论