othala.dunn.dev

dunn.dev

Othala

Othala is one family's single sign-on. One passkey gets each person into every app in the house, and their groups decide what they can do there.

Ory Kratos and Hydra hold identity and issue tokens; Othala is the login, consent and access-gate code Ory leaves to the integrator, published as a worked example.

Per-app OIDCArchitecture
1 · passkey sign-in
2 · every app they can open
WHY · ONE PASSKEY GETS EACH PERSON INTO EVERY APP; THEIR GROUPS DECIDE WHAT THEY CAN DOACTORSOUTSIDEOTHALA · ONE TRUST DOMAIN1234567open an appproxiesredirectshands overchecksissuesasksproxiesin a browserto authorizelogin, consentid_token, groupsallow or deny?if allowedadminsmembersportalHydraKratosOIDC appsforward-authappsedgepasskey, admin markermanage people overthe internal networkone passkey eachlogin, consent, gatethe only callerof the admin APIsOAuth2, OIDCpasskey sessionssign in by redirectno OIDC neededCaddy, in front of every app, ends TLSadmin listenerWHY · ONE PASSKEY GETS EACH PERSON INTOEVERY APP; THEIR GROUPS DECIDE WHAT THEY CAN DOACTORSOUTSIDEOTHALA · ONE TRUST DOMAIN1234567open an appproxiesredirectshands overchecksissuesasksproxiesin a browserto authorizelogin, consentid_token, groupsallow or deny?if allowedmembersadminsKratosportalHydraOIDC appsforward-authappsedgeone passkey eachpasskey, admin markermanage people overthe internal networkpasskey sessionslogin, consent, gatethe only caller of the admin APIsOAuth2, OIDCsign in by redirectno OIDC neededCaddy, in front of every app, ends TLSadmin listener

Ory holds identity and issues tokens; Othala's portal makes every decision in between, from login and consent to the access gate.

How it works

01 · sign in

One passkey, every app

Kratos runs the passkey ceremony once. Every app that speaks OIDC sends people to Hydra, and the portal answers Hydra's login and consent challenges for all of them.

02 · decide

Groups decide the rest

Each app's manifest names one group that grants entry and maps others to roles. The portal admits on the first and puts the role in the token.

03 · gate

Apps without OIDC still ask

For an app that cannot redirect, the edge asks the portal about each request before it is proxied, and gets back allow or deny.

One file per appe2e/content/apps/grafana.yaml, abridged

Every app Othala fronts is one manifest file: what its tile says, which OAuth2 client Hydra sees, and which group grants entry versus which grants a role. Adding an app is a file drop, not an image rebuild.

The whole thing is public because most of what makes an Ory integration hard has no complete worked example in the open. This one keeps the reasoning next to the code: read it, copy it, lift a file out whole. It is not a pitch: no roadmap, no adoption path, one maintainer.

presentation:
  name: Grafana
  url: https://grafana.othala.test
  access:
    - grafana-access

oidc:
  client_id: grafana
  redirect_uris:
    - https://grafana.othala.test/login/generic_oauth

consent:
  group_role_map:
    grafana-admin: admin
    grafana-access: viewer

Where next

Architecture

How Kratos, Hydra, the portal and the edge fit together, told through six diagrams and the reasoning between them.

Guides

The integration commitments that keep an Ory deployment durable across upgrades, how applications are connected over OIDC, how requests are denied, and how the substrate is hardened.

Source ↗

The code, the tests and the decisions log this site is a reading copy of.