oathkeeper

A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go.

3,505

390

3,505

View on GitHub

Top Related Projects

keycloak

32,172

Open Source Identity and Access Management For Modern Applications and Services

hydra

16,662

The only web-scale, fully customizable OpenID Certified™ OpenID Connect and OAuth2 Provider in the world. Become an OpenID Connect and OAuth2 Provider over night. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters. Relied upon by OpenAI and others for web-scale security.

casbin

19,698

An authorization library that supports access control models like ACL, RBAC, ABAC in Golang: https://discord.gg/S5UjpzGZjN

cas

11,266

Apereo CAS - Identity & Single Sign On for all earthlings and beyond.

authelia

25,784

The Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™

Quick Overview

Ory Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of rules. It acts as a reverse proxy, can be used as a Kubernetes sidecar, and is capable of authenticating and authorizing incoming HTTP requests using various methods.

Pros

Highly flexible and customizable authentication and authorization system
Supports multiple authentication methods (e.g., OAuth2, JWT, COOKIE)
Can be easily integrated into existing infrastructure as a reverse proxy or sidecar
Provides a RESTful API for programmatic access and management

Cons

Steep learning curve due to its complex configuration options
Limited documentation for advanced use cases
May introduce additional latency in the request/response cycle
Requires careful setup to avoid security misconfigurations

Getting Started

To get started with Ory Oathkeeper, follow these steps:

Install Ory Oathkeeper:
```
brew install ory/tap/oathkeeper
```

Create a configuration file config.yaml:

serve:
  proxy:
    port: 4455

access_rules:
  repositories:
    - file:///path/to/rules.json

authenticators:
  anonymous:
    enabled: true
  noop:
    enabled: true

authorizers:
  allow:
    enabled: true

mutators:
  noop:
    enabled: true

Create a rules file rules.json:

[
  {
    "id": "example-rule",
    "upstream": {
      "url": "http://my-backend-service"
    },
    "match": {
      "url": "http://my-app/<**>",
      "methods": ["GET"]
    },
    "authenticators": [{ "handler": "anonymous" }],
    "authorizer": { "handler": "allow" },
    "mutators": [{ "handler": "noop" }]
  }
]

Start Oathkeeper:
```
oathkeeper serve --config config.yaml
```

This basic setup creates an Oathkeeper instance that proxies requests to a backend service, allowing anonymous access to GET requests. Adjust the configuration and rules to fit your specific use case.

Competitor Comparisons

keycloak

32,172

Open Source Identity and Access Management For Modern Applications and Services

Pros of Keycloak

More comprehensive identity and access management solution with built-in user management, authentication, and authorization features
Extensive documentation and large community support
Offers a user-friendly admin console for easier configuration and management

Cons of Keycloak

Heavier and more resource-intensive compared to Oathkeeper's lightweight design
Steeper learning curve due to its broader feature set
Less flexibility for integration into existing systems compared to Oathkeeper's modular approach

Code Comparison

Oathkeeper configuration example:

access_rules:
  - id: "my-rule"
    match:
      url: "http://<**>/api/<**>"
      methods:
        - GET
    authenticators:
      - handler: jwt
    authorizer:
      handler: allow
    mutators:
      - handler: noop

Keycloak configuration example:

{
  "realm": "my-realm",
  "auth-server-url": "http://localhost:8080/auth",
  "ssl-required": "external",
  "resource": "my-client",
  "public-client": true,
  "confidential-port": 0
}

Both projects offer robust security solutions, but Keycloak provides a more comprehensive suite of identity management features, while Oathkeeper focuses on lightweight, flexible access control and API security.

hydra

16,662

Pros of Hydra

More comprehensive OAuth2 and OpenID Connect server implementation
Supports advanced features like JSON Web Key rotation and OAuth2 Token Exchange
Higher adoption rate and more active community

Cons of Hydra

More complex setup and configuration
Steeper learning curve for beginners
Potentially overkill for simpler authentication scenarios

Code Comparison

Hydra (Go):

import "github.com/ory/hydra/client"

c := client.NewHTTPClientWithConfig(nil, &client.TransportConfig{
    Schemes:  []string{"http", "https"},
    Host:     "localhost:4444",
    BasePath: "/",
})

Oathkeeper (Go):

import "github.com/ory/oathkeeper/sdk/go/oathkeeper"

configuration := oathkeeper.NewConfiguration()
configuration.Host = "localhost:4456"
client := oathkeeper.NewAPIClient(configuration)

Both Hydra and Oathkeeper are part of the Ory ecosystem, but they serve different purposes. Hydra is a full-featured OAuth2 and OpenID Connect server, while Oathkeeper is an Identity & Access Proxy. Hydra is more suitable for complex authentication scenarios, while Oathkeeper excels at API access control and request authorization. The choice between them depends on the specific requirements of your project and the level of authentication complexity you need.

casbin

19,698

An authorization library that supports access control models like ACL, RBAC, ABAC in Golang: https://discord.gg/S5UjpzGZjN

Pros of Casbin

More flexible and customizable authorization model
Supports multiple programming languages and frameworks
Easier to integrate into existing systems due to its lightweight nature

Cons of Casbin

Requires more manual configuration and setup
Less built-in features for API security and identity management
May require additional components for complete access control solution

Code Comparison

Casbin policy definition:

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = r.sub == p.sub && r.obj == p.obj && r.act == p.act

Oathkeeper rule configuration:

- id: "rule-1"
  match:
    url: "<http://my-app.com/api/users>"
    methods:
      - GET
  authenticators:
    - handler: jwt
  authorizer:
    handler: allow
  mutators:
    - handler: noop

Casbin focuses on defining flexible authorization policies, while Oathkeeper provides a more comprehensive API security solution with built-in authentication, authorization, and request/response mutation capabilities. Casbin's approach allows for more granular control over access rules, but Oathkeeper offers a more streamlined setup for API gateway scenarios.

cas

11,266

Apereo CAS - Identity & Single Sign On for all earthlings and beyond.

Pros of CAS

More comprehensive authentication and authorization solution with a wider range of features
Extensive documentation and community support
Built-in support for various authentication protocols (SAML, OAuth, CAS)

Cons of CAS

Steeper learning curve due to its complexity
Heavier resource footprint compared to Oathkeeper
May be overkill for simpler authentication scenarios

Code Comparison

CAS (Java):

@Bean
public AuthenticationHandler myAuthenticationHandler() {
    return new MyCustomAuthenticationHandler();
}

Oathkeeper (Go):

func (a *Authenticator) Authenticate(r *http.Request) (*authn.Info, error) {
    // Custom authentication logic
}

Both projects allow for custom authentication handlers, but CAS typically requires more configuration and setup due to its comprehensive nature. Oathkeeper's approach is more lightweight and focused on API security.

CAS offers a more feature-rich solution with built-in support for various authentication protocols, making it suitable for complex enterprise environments. However, this comes at the cost of increased complexity and resource usage.

Oathkeeper, on the other hand, provides a more streamlined approach to API security and access control. It's lighter and easier to integrate into microservices architectures but may lack some of the advanced features found in CAS.

authelia

25,784

The Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™

Pros of Authelia

More comprehensive authentication solution with built-in 2FA, single sign-on, and password policies
User-friendly web portal for self-service account management
Supports multiple storage backends (SQL, LDAP) for user information

Cons of Authelia

Less flexible in terms of customization and extensibility
May be overkill for simpler authentication scenarios
Steeper learning curve due to more features and configuration options

Code Comparison

Oathkeeper (Go):

func (a *AuthenticatorNoOp) Authenticate(r *http.Request, session *authn.AuthenticationSession, config json.RawMessage) error {
    return nil
}

Authelia (Go):

func (provider *FileUserProvider) CheckUserPassword(username string, password string) (bool, error) {
    user, err := provider.GetDetails(username)
    if err != nil {
        return false, err
    }
    return CheckPasswordHash(password, user.HashedPassword), nil
}

Both projects use Go, but Authelia's code tends to be more focused on user management and authentication specifics, while Oathkeeper's code is more oriented towards request handling and middleware-style operations.

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

Chat Â· Discussions Â· Newsletter Â· Docs Â· Try Ory Network Â· Jobs

Ory Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. It follows the BeyondCorp model designed by Google and secures applications in Zero-Trust networks.

What is Ory Oathkeeper?
- Why Ory Oathkeeper
Deployment options
- Installation
Quickstart
Who is using Ory Oathkeeper
Ecosystem
Documentation
Developing Ory Oathkeeper
Security
- Disclosing vulnerabilities
Telemetry

What is Ory Oathkeeper?

Ory Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API. It follows cloud architecture best practices and focuses on:

Authenticating and authorizing HTTP requests
Acting as a reverse proxy or decision API
Mutating requests with identity information
Integrating with existing API gateways and proxies
Supporting multiple authentication and authorization strategies
Working in Zero-Trust network architectures

We recommend starting with the Ory Oathkeeper introduction docs to learn more about its architecture, feature set, and how it compares to other systems.

Why Ory Oathkeeper

Ory Oathkeeper is designed to:

Decouple authentication and authorization from application code
Work as an API Gateway plugin or standalone proxy
Support flexible access rules for different endpoints
Integrate with Ambassador, Envoy, AWS API Gateway, Nginx, and more
Provide both proxy and sidecar deployment modes
Scale without effort in cloud native environments

Oathkeeper works with:

Ambassador via auth service
Envoy via the External Authorization HTTP Filter
AWS API Gateway via Custom Authorizers
Nginx via Authentication Based on Subrequest Result

Deployment options

You can run Ory Oathkeeper in two main ways:

As a managed service on the Ory Network
As a self hosted service under your own control, with or without the Ory Enterprise License

Installation

You can run Ory Oathkeeper yourself for full control over infrastructure, deployment, and customization.

The install guide explains how to:

Install Oathkeeper on Linux, macOS, Windows, and Docker
Configure access rules and authentication strategies
Deploy to Kubernetes and other orchestration systems

This guide uses the open source distribution to get you started without license requirements. It is a great fit for individuals, researchers, hackers, and companies that want to experiment, prototype, or run unimportant workloads without SLAs. You get the full core engine, and you are free to inspect, extend, and build it from source.

If you run Oathkeeper as part of a business-critical system, you should use a commercial agreement to reduce operational and security risk. The Ory Enterprise License (OEL) layers on top of self-hosted Oathkeeper and provides:

Additional enterprise features that are not available in the open source version
Regular security releases, including CVE patches, with service level agreements
Support for advanced scaling, multi-tenancy, and complex deployments
Premium support options with SLAs, direct access to engineers, and onboarding help
Access to a private Docker registry with frequent and vetted, up-to-date enterprise builds

For guaranteed CVE fixes, current enterprise builds, advanced features, and support in production, you need a valid Ory Enterprise License and access to the Ory Enterprise Docker registry. To learn more, contact the Ory team.

Quickstart

Head over to the Ory Developer Documentation to learn how to install Ory Oathkeeper on Linux, macOS, Windows, and Docker and how to build Ory Oathkeeper from source.

Who is using Ory Oathkeeper

The Ory community stands on the shoulders of individuals, companies, and maintainers. The Ory team thanks everyone involved - from submitting bug reports and feature requests, to contributing patches and documentation. The Ory community counts more than 50.000 members and is growing. The Ory stack protects 7.000.000.000+ API requests every day across thousands of companies. None of this would have been possible without each and everyone of you!

The following list represents companies that have accompanied us along the way and that have made outstanding contributions to our ecosystem. If you think that your company deserves a spot here, reach out to office@ory.sh now!

Name	Website	Case Study
OpenAI	openai.com	OpenAI Case Study
Fandom	fandom.com	Fandom Case Study
Lumin	luminpdf.com	Lumin Case Study
Sencrop	sencrop.com	Sencrop Case Study
OSINT Industries	osint.industries	OSINT Industries Case Study
HGV	hgv.it	HGV Case Study
Maxroll	maxroll.gg	Maxroll Case Study
Zezam	zezam.io	Zezam Case Study
T.RowePrice	troweprice.com
Mistral	mistral.ai
Axel Springer	axelspringer.com
Hemnet	hemnet.se
Cisco	cisco.com
Presidencia de la RepÃºblica Dominicana	presidencia.gob.do
Moonpig	moonpig.com
Booster	choosebooster.com
Zaptec	zaptec.com
Klarna	klarna.com
Raspberry PI Foundation	raspberrypi.org
Tulip	tulip.com
Hootsuite	hootsuite.com
Segment	segment.com
Arduino	arduino.cc
Sainsbury's	sainsburys.co.uk
Contraste	contraste.com
inMusic	inmusicbrands.com
Buhta	buhta.com
Amplitude	amplitude.com

Many thanks to all individual contributors

Ecosystem

We build Ory on several guiding principles when it comes to our architecture design:

Minimal dependencies
Runs everywhere
Scales without effort
Minimize room for human and network errors

Ory's architecture is designed to run best on a Container Orchestration system such as Kubernetes, CloudFoundry, OpenShift, and similar projects. Binaries are small (5-15MB) and available for all popular processor types (ARM, AMD64, i386) and operating systems (FreeBSD, Linux, macOS, Windows) without system dependencies (Java, Node, Ruby, libxml, ...).

Ory Kratos: Identity and User Infrastructure and Management

Ory Kratos is an API-first Identity and User Management system that is built according to cloud architecture best practices. It implements core use cases that almost every software application needs to deal with: Self-service Login and Registration, Multi-Factor Authentication (MFA/2FA), Account Recovery and Verification, Profile, and Account Management.

Ory Hydra: OAuth2 & OpenID Connect Server

Ory Hydra is an OpenID Certifiedâ¢ OAuth2 and OpenID Connect Provider which easily connects to any existing identity system by writing a tiny "bridge" application. It gives absolute control over the user interface and user experience flows.

Ory Oathkeeper: Identity & Access Proxy

Ory Oathkeeper is a BeyondCorp/Zero Trust Identity & Access Proxy (IAP) with configurable authentication, authorization, and request mutation rules for your web services: Authenticate JWT, Access Tokens, API Keys, mTLS; Check if the contained subject is allowed to perform the request; Encode resulting content into custom headers (X-User-ID), JSON Web Tokens and more!

Ory Keto: Access Control Policies as a Server

Ory Keto is a policy decision point. It uses a set of access control policies, similar to AWS IAM Policies, in order to determine whether a subject (user, application, service, car, ...) is authorized to perform a certain action on a resource.

Documentation

The full Ory Oathkeeper documentation is available at www.ory.sh/docs/oathkeeper, including:

For upgrading and changelogs, check UPGRADE.md and CHANGELOG.md.

Developing Ory Oathkeeper

See DEVELOP.md for information on:

Contribution guidelines
Prerequisites
Install from source
Running tests
Build Docker image

Security

Disclosing vulnerabilities

If you think you found a security vulnerability, please refrain from posting it publicly on the forums, the chat, or GitHub. You can find all info for responsible disclosure in our security.txt.

Telemetry

Our services collect summarized, anonymized data that can optionally be turned off. Click here to learn more.

Top Related Projects

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot