Show HN: Oathkeeper – Cloud-Native Identity and Access Proxy (opens in new tab)

Thanks for bringing this up, I would not have looked for it.

anything regarding this? Would also be interested if you plan releasing the console, i.e. allow a fully self-hosted usage.

We're currently starting to work on ORY Hive (project name wip) which is going to be a fully functional identity management service (user registration, login, social sign in, password reset, MFA, ...) sort of along the lines of Auth0 or AWS Cognito, but as an OSS solution.

As part of that service, we will add connectivity adapters for generic OAuth2/OIDC providers as well as (probably) LDAP/AD and SAML integration.

We're still in prototyping phase (building a good API here is really tricky because no open standards exist to our knowledge for this) and it will take some time. But hopefully, it will be something many people can build on!

And thank you so much for the positive feedback :)

That's a really good point! I've tracked this as https://github.com/ory/docs/issues/29

We're a very small team, so it might take a while for us to tackle this (especially because we mostly use k8s with oathkeeper proxy as a sidecar), but that does make this not lesser of an issue!

Yes, ORY Hydra has a flow that allows you to integrate with any identity solution, be it AD/LDAP, SAML, or your custom database-backed app!

Seems like you are describing Ambassador here [0]. I think this could play nice as Ambassador's external auth service [1].

Oathkeeper looks very interesting... Congrats and best of luck!

[0] https://www.getambassador.io

[1] https://www.getambassador.io/reference/services/auth-service

I have not used envoy extensively yet, but there are obviously many more options such as Apache2 + mod_oidc, Kong + oauth2 plugin, and so on.

The main differentiator is that Oathkeeper is capable of performing more sophisticated permission checks (think RBAC / AWS IAM Policies) and is specifically geared towards solving authentication and authorization in front of "your" service.

Most other implementations I saw (and I think this also goes a bit for envoy) is that they solve access control as one of the things in the feature set, while also focusing strongly on routing, load balancing, and other typical API gateway issues.

We're explicitly not trying to build another API gateway but instead something that you deploy alongside your existing API gateway (or maybe as a sidecar) with the sole purpose of checking answering: "is the request that's coming through really allowed to perform that action?".

Hope this clarifies it, if not I'm more than happy to go into more detail :)

> Well you just lost me. You are developing IAM components and you can't get basic password management correct? email has nothing to do with it, we are well past the point where password managers are de rigueur, certainly for anyone involved with security matters.

The password in my password manager is not correct. No idea how that happened, maybe it was overwritten by accident or I copied the wrong one during account creation. Since I had to reset my FF profile it was no longer stored in the FF password manager, so I had to recover it from KeePass, which well - didn't work out so well. Since I do use a password manager, it's impossible to recover it as I have no idea what the password is.

A bit extreme don't you think ? He's human and people lose access to old accounts from time to time...

Has nothing to do with the fact he's developing auth software.

Besides, HN does not do oauth. If it did and he would still lose access then it's a different story ;-)

Getting the wrong password in your password manager happens occasionally. Usually from password resets that somehow don't make it into your password manager. The fact that HN allows accounts without email addresses is the real problem. Also, maybe he just doesn't value his HN account all that much.

Hi, thanks for your reply. I don't mean to insinuate in any way that you or your team support any particular ideology, I merely wanted to make you aware of an unfortunate namespace collision.

For what it's worth, I was unaware of the reference that was used as this project's namesake. That is ignorance on my part.

Furthermore I would like to apologize, as my comment seems to have inspired quite a bit of unproductive ideological bickering.

This is a really unfortunate tangent and not worthy of any time or trouble on your end IMHO. At the very most a footnote somewhere in the site to say that this project is not affiliated with any groups or organizations would be more than adequate.

Any individuals that try to imply that the naming of a proxy server product within a larger software ecosystem indicate an endorsement of the position of an organization with a similar name are displaying pathological behavior and should generally be disregarded.

I would encourage that you not bend to the will of those who would impose upon you what your brand might be or might be associated with. If you make a meaningful product in your space and the origins of the name are easily explained through 1: your aforementioned wordplay and 2: the GoT reference (likely more common), then I think you should fight to keep a name you love and find meaning in.

As one of your potential customers / users, I would not base any judgement of your company or product based on some a shared name with a small fringe organization that some people find unsavory which uses a pretty common term or combination of terms.

Could be worse, you could be this guy - https://www.reddit.com/r/Unity3D/comments/8xn9ta/using_rope_...

:P

I thought it was a reference to the keyblade from Kingdom Hearts, and was awaiting the distributed cloud-based keystore called "Oblivion". :)

Just to clarify, are you speaking for the team to condemn extremism in general, or the specific belief in upholding the U.S. Constitution within the U.S., or something else?

Maybe I should pay attention to the discussion with the community when that occurs, but I'm interested in which "values" you take issue with. Care to share here?

When they say "extremist" they mean "white people", goys.

Oath Keepers is a non-partisan association of current and formerly serving military, police, and first responders, who pledge to fulfill the oath all military and police take to “defend the Constitution against all enemies, foreign and domestic.” That oath, mandated by Article VI of the Constitution itself, is to the Constitution, not to the politicians, and Oath Keepers declare that they will not obey unconstitutional orders, such as orders to disarm the American people, to conduct warrantless searches, or to detain Americans as “enemy combatants” in violation of their ancient right to jury trial. See the Oath Keepers Declaration of Orders We Will Not Obey for details.

https://oathkeepers.org/about/

If we were living in the colonial days, only the British would be calling them "radical" or "extremists". :D

Men of authority pledging not to bow to unconstitutional orders against citizens. Actually seems noble.

I suspect they get the "radical" and "extremist" label from our culture where those who aren't on the "correct" political side are labeled a Nazi or Communist.