{"id":25524719,"url":"https://github.com/comnoco/vault-plugin-auth-ory","last_synced_at":"2026-01-18T03:34:09.582Z","repository":{"id":65403802,"uuid":"557842217","full_name":"comnoco/vault-plugin-auth-ory","owner":"comnoco","description":"A HashiCorp Vault auth plugin for Ory Kratos and Ory Keto.","archived":false,"fork":false,"pushed_at":"2023-06-08T18:28:34.000Z","size":105,"stargazers_count":11,"open_issues_count":2,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-01-05T13:51:37.776Z","etag":null,"topics":["comnoco","hashicorp","keto","kratos","ory","ory-keto","ory-kratos","vault"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/comnoco.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-10-26T12:09:18.000Z","updated_at":"2025-11-24T20:21:16.000Z","dependencies_parsed_at":"2024-06-20T00:16:48.621Z","dependency_job_id":null,"html_url":"https://github.com/comnoco/vault-plugin-auth-ory","commit_stats":{"total_commits":37,"total_committers":3,"mean_commits":"12.333333333333334","dds":0.4054054054054054,"last_synced_commit":"0c66fbfd83688e521ca2258e10d02e0c7eb38d36"},"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/comnoco/vault-plugin-auth-ory","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/comnoco%2Fvault-plugin-auth-ory","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/comnoco%2Fvault-plugin-auth-ory/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/comnoco%2Fvault-plugin-auth-ory/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/comnoco%2Fvault-plugin-auth-ory/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/comnoco","download_url":"https://codeload.github.com/comnoco/vault-plugin-auth-ory/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/comnoco%2Fvault-plugin-auth-ory/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28528313,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-18T00:39:45.795Z","status":"online","status_checked_at":"2026-01-18T02:00:07.578Z","response_time":98,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["comnoco","hashicorp","keto","kratos","ory","ory-keto","ory-kratos","vault"],"created_at":"2025-02-19T20:05:34.053Z","updated_at":"2026-01-18T03:34:09.539Z","avatar_url":"https://github.com/comnoco.png","language":"Go","funding_links":[],"categories":["Projects"],"sub_categories":["Ory Ecosystem"],"readme":"# Ory Kratos + Keto Auth Plugin for HashiCorp Vault\n\nThis repository contains code for a [HashiCorp Vault](https://github.com/hashicorp/vault) Auth [Plugin](https://developer.hashicorp.com/vault/docs/plugins) that authenticates with [Ory Kratos](https://github.com/ory/kratos) and [Ory Keto](https://github.com/ory/keto) APIs.\n\n## Setup\n\nThe setup guide assumes some familiarity with Vault and Vault's plugin\necosystem. You must have a Vault server already running, unsealed, and\nauthenticated.\n\n1. Download and decompress the latest plugin binary from the Releases tab. Alternatively you can compile the plugin from source.\n\n2. Move the compiled plugin into Vault's configured `plugin_directory`:\n\n  ```sh\n  $ mv vault-auth-plugin-ory /etc/vault/plugins/vault-auth-plugin-ory\n  ```\n\n3. Calculate the SHA256 of the plugin and register it in Vault's plugin catalog.\nIf you are downloading the pre-compiled binary, it is highly recommended that\nyou use the published checksums to verify integrity.\n\n  ```sh\n  $ export SHA256=$(shasum -a 256 \"/etc/vault/plugins/vault-auth-plugin-ory\" | cut -d' ' -f1)\n\n  $ vault plugin register \\\n      -sha256=\"${SHA256}\" \\\n      -command=\"vault-auth-plugin-ory\" \\\n      auth vault-plugin-auth-ory\n  ```\n\n4. Mount the auth method:\n\n  ```sh\n  $ vault auth enable \\\n      -path=\"ory\" \\\n      -plugin-name=\"vault-plugin-auth-ory\" plugin\n  ```\n\n## Development Setup\n\n1. Build the plugin for your platform (`os/arch`) e.g.:\n\n  ```sh\n  $ make darwin/arm64\n  ```\n\n  or build for all platforms:\n\n  ```sh\n  $ make build\n  ```\n\n2. Start a Vault server in dev mode pointing to the plugin directory:\n\n  ```sh\n  $ make start\n  ```\n3. Login to Vault as root:\n\n  ```sh\n  $ vault login root\n  ```\n\n4. Enable the plugin in Vault:\n\n  ```sh\n  $ make enable\n  ```\n5. Write the configs:\n\n  ```sh\n  $ make configs\n  ```\n\n6. Authenticate with the plugin:\n\n  ```sh\n  $ vault write auth/ory/login \\\nnamespace=files \\\nobject=c5cc3e28-e3c3-45ca-be86-a0a55953bfca \\\nrelation=editor \\\nkratos_session_cookie=ory_kratos_session=MTY2NzgyMjg2M3xBYVJxa2hmNFlOOFAyZnc3U3VidnZKd1A0VmdyWFgyU3ozbUNvRG4zeC1oNU1DS3Z6dkc1ODllTHdua0s5aFdpcW1ZZ0pveVNBVVM3ZXBIRWdQdlJGWXN0aS1iVU5tenVFbUw1WE1QNDRVcms5eWZZRk52R3dOdTJKLVcxYVlFWFU4ajNFUmc0bnc9PXyq29KzMQjNDdZLeJAuNLUBeU1g1-iD7l31nahltn4mZg==\n  ```\n\n7. Add a policy that matches the naming convention `namespace_relation` (e.g. `files_editor`) using the example policy found below, replacing the accessor string with the contents returned by:\n\n  ```sh\n  $ make accessor\n  ```\n\n8. Login with the token provided after running the `write` command:\n\n  ```sh\n  $ vault login [token]\n  ```\n\n9. Attempt to read secrets:\n\n  ```sh\n  $ vault read secret/files/c5cc3e28-e3c3-45ca-be86-a0a55953bfca/some_secret\n  ```\n\n## Authenticating with Ory Kratos and Keto\n\nTo authenticate, the user supplies a valid Ory Kratos session cookie, along with the namespace,\nobject, and relation to check against Keto.\n\n```sh\n$ vault write auth/ory/login namespace=[namespace] object=[object] relation=[relation] kratos_session_cookie=[full kratos_session_cookie=[...] string]\n```\n\nThe response will be a standard auth response with some token metadata:\n\n```text\nKey                     Value\n--------------------------------\ntoken                   [token]\ntoken_accessor          [accessor]\ntoken_duration          [TTL]\ntoken_renewable         false\ntoken_policies          [\"default\" \"[namespace]_[relation]\"]\nidentity_policies       []\npolicies                [\"default\" \"[namespace]_[relation]\"]\n```\n\n## Policy Template\n\nWhen a token is successfully created, the plugin attach a policy that follows the naming schema of `[namespace]_[relation]`.\n\nYou must then create a policy with that name in Vault that utilises the metadata stored in the alias. The following policy template will allow access to a KV secret at the path `secret/data/[namespace]/[object]*`:\n\n```hcl\npath \"secret/data/{{identity.entity.aliases.auth_vault-plugin-auth-ory_e40b77a0.metadata.object}}*\" {\n  capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\n\npath \"secret/metadata/{{identity.entity.aliases.auth_vault-plugin-auth-ory_e40b77a0.metadata.object}}/*\" {\n  capabilities = [\"delete\", \"list\"]\n}\n```\n\nBeing sure to replace `auth_vault-plugin-auth-ory_e40b77a0` with the accessor of the auth plugin found by running `vault auth list`.\n\nAlternatively, you can find the accessor by running the following command:\n\n```sh\n$ export MOUNT_ACCESSOR=$(vault auth list -format=json | jq -r '.\"ory/\".accessor')\n```\n\nAs we already know the namespace at this point, you can also simply use the path:\n\n`secret/data/[known namespace]/{{identity.entity.metadata.object}}*`\n\n## License\n\nThis code is licensed under the MPLv2 license.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcomnoco%2Fvault-plugin-auth-ory","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcomnoco%2Fvault-plugin-auth-ory","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcomnoco%2Fvault-plugin-auth-ory/lists"}