{ "slug": "Ory-Hydra-Hello-world-581ee5c1f023", "title": "Ory Hydra Hello world", "subtitle": "Run ORY HYDRA service", "excerpt": "Run ORY HYDRA service", "date": "2023-02-03", "tags": [], "readingTime": "2 min", "url": "https://medium.com/@mobinshaterian/ory-hydra-hello-world-581ee5c1f023", "hero": "https://cdn-images-1.medium.com/max/800/1*TFFE6_dhJeQkxnUnE_cWIA.png", "content": [ { "type": "heading", "level": 2, "text": "Ory Hydra Hello world" }, { "type": "embed", "provider": "youtube", "url": "https://www.youtube.com/embed/tlO9p2E501A?feature=oembed" }, { "type": "image", "src": "https://cdn-images-1.medium.com/max/800/1*TFFE6_dhJeQkxnUnE_cWIA.png", "alt": "https://www.ory.sh/", "caption": "https://www.ory.sh/", "width": 1439, "height": 649 }, { "type": "code", "lang": "bash", "code": "git clone\nhttps://github.com/ory/hydra" }, { "type": "heading", "level": 2, "text": "Run ORY HYDRA service" }, { "type": "code", "lang": "bash", "code": "docker-compose -f quickstart.yml \\\n -f quickstart-postgres.yml \\\n up --build" }, { "type": "paragraph", "html": "We will get Thank you in terminal:" }, { "type": "code", "lang": "text", "code": "Thank you for using Ory Hydra v2.0.3!" }, { "type": "heading", "level": 2, "text": "Give authentication to the customer or third party" }, { "type": "paragraph", "html": "The OAuth 2.0 client uses port 4444 and 4445. The former is Ory Hydra's public endpoint, the latter its administrative endpoint. For more information head over to Exposing Administrative and Public API Endpoints." }, { "type": "heading", "level": 3, "text": "Exposing administrative and public API endpoints" }, { "type": "paragraph", "html": "Ory Hydra serves APIs via two ports:" }, { "type": "list", "ordered": false, "items": [ "Public port (default 4444)", "Administrative port (default 4445)" ] }, { "type": "paragraph", "html": "The public port can and should be exposed to public internet traffic. That port handles requests to:" }, { "type": "code", "lang": "text", "code": "/.well-known/jwks.json\n/.well-known/openid-configuration\n/oauth2/auth\n/oauth2/token\n/oauth2/revoke\n/oauth2/fallbacks/consent\n/oauth2/fallbacks/error\n/oauth2/sessions/logout\n/userinfo" }, { "type": "paragraph", "html": "The administrative port shouldn’t be exposed to public internet traffic. If you want to expose certain endpoints, such as the /clients endpoint for OpenID Connect Dynamic Client Registry, you can do so but you need to properly secure these endpoints with an API Gateway or Authorization Proxy. Administrative endpoints include:" }, { "type": "code", "lang": "text", "code": "All /clients endpoints.All /keys endpoints.All /health, /metrics, /version endpoints.All\n/oauth2/auth/requests endpoints.Endpoint /oauth2/introspect.Endpoint /oauth2/flush." }, { "type": "paragraph", "html": "Let’s create the OAuth 2.0 Client: (administrative)" }, { "type": "code", "lang": "bash", "code": "docker-compose -f quickstart.yml exec hydra \\\n hydra create client \\\n --endpoint http://127.0.0.1:4445/ \\\n --format json \\\n --grant-type client_credentials" }, { "type": "paragraph", "html": "response (administrative)" }, { "type": "code", "lang": "json", "code": "{\n \"client_id\": \"f95a8d96-9d15-471a-8f7b-b37fbab3c1f1\",\n \"client_name\": \"\",\n \"client_secret\": \"B~~zBRuoBpdAByNhq8fMkq_d2C\",\n \"client_secret_expires_at\": 0,\n \"client_uri\": \"\",\n \"created_at\": \"2023-01-30T07:50:43Z\",\n \"grant_types\": [\n \"client_credentials\"\n ],\n \"jwks\": {},\n \"logo_uri\": \"\",\n \"metadata\": {},\n \"owner\": \"\",\n \"policy_uri\": \"\",\n \"registration_access_token\": \"ory_at_3BY4izdL2AuYCXyT-g_B5nPUZp2RiGTzY-itCztfViI.TFOwoqKQlnSlzpw1PZ9blQuCSFVw50DLxQA1zY3RueI\",\n \"registration_client_uri\": \"http://127.0.0.1:4444/oauth2/register/f95a8d96-9d15-471a-8f7b-b37fbab3c1f0\",\n \"request_object_signing_alg\": \"RS256\",\n \"response_types\": [\n \"code\"\n ],\n \"scope\": \"offline_access offline openid\",\n \"subject_type\": \"public\",\n \"token_endpoint_auth_method\": \"client_secret_basic\",\n \"tos_uri\": \"\",\n \"updated_at\": \"2023-01-30T07:50:43.099053Z\",\n \"userinfo_signed_response_alg\": \"none\"\n}" }, { "type": "paragraph", "html": "Let’s perform the client credentials grant: (public)" }, { "type": "code", "lang": "bash", "code": "docker-compose -f quickstart.yml exec hydra \\\n hydra perform client-credentials \\\n --endpoint http://127.0.0.1:4444/ \\\n --client-id $client_id \\\n --client-secret $client_secret" }, { "type": "code", "lang": "bash", "code": "docker-compose -f quickstart.yml exec hydrahydra perform client-credentials--endpoint\nhttp://127.0.0.1:4444/--client-id f95a8d96-9d15-471a-8f7b-b37fbab3c1f0 --client-secret\nY~~zBRuoBpdAByNhq8fMkq_d2CACCESS TOKEN\nory_at_HjvbarTv4ZngKuhF0JhM4AhdnReXJfT0Fb__8MFc5uA.qftzDg6vfqoT46fQqJPGmSSWSH8YG6ZxHLsrTIZznH4\nREFRESH TOKEN ID TOKEN EXPIRY 2023-01-30 08:58:16 +0000 UTC" }, { "type": "paragraph", "html": "Let’s perform token introspection on that token. Make sure to copy the token you just got and not the dummy value. ( administrative )" }, { "type": "code", "lang": "bash", "code": "docker-compose -f quickstart.yml exec hydra \\\n hydra introspect token \\\n --format json-pretty \\\n --endpoint http://127.0.0.1:4445/ \\\n ory_at_HjvbarTv4ZngKuhF5JhM4AhdnReXJfT0Fb__8MFc5uA.qftzDg6vfqoT46fQqJPGmSSWSH8YG8ZxHLsrTIZznH4{\n \"active\": true, \"client_id\": \"f95a8d96-9d15-471a-8f7b-b37fbab3c1f0\", \"exp\": 1675069097, \"iat\":\n 1675065497, \"iss\": \"http://127.0.0.1:4444\", \"nbf\": 1675065497, \"sub\":\n \"f95a8d96-9d15-471a-8f7b-b37fbab3c1f0\", \"token_type\": \"Bearer\", \"token_use\": \"access_token\"}" }, { "type": "paragraph", "html": "install jq on ubuntu" }, { "type": "code", "lang": "bash", "code": "sudo\napt install -y jq" }, { "type": "paragraph", "html": "[ client of administrative ]" }, { "type": "paragraph", "html": "Next, we will perform the OAuth 2.0 Authorization Code Grant. For that, we must first create a client that’s capable of performing that grant: (administrative)" }, { "type": "code", "lang": "bash", "code": "code_client=$(\ndocker-compose -f quickstart.yml exec hydra \\ hydra create client \\ --endpoint\nhttp://127.0.0.1:4445 \\ --grant-type authorization_code,refresh_token \\ --response-type\ncode,id_token \\ --format json \\ --scope openid --scope offline \\ --redirect-uri\nhttp://127.0.0.1:5555/callback)code_client_id=$(echo $code_client | jq -r\n'.client_id')code_client_secret=$(echo $code_client | jq -r '.client_secret')" }, { "type": "code", "lang": "bash", "code": "docker-compose -f quickstart.yml exec hydra \\\n hydra create client \\\n --endpoint http://127.0.0.1:4445 \\\n --grant-type authorization_code,refresh_token \\\n --response-type code,id_token \\\n --format json \\\n --scope openid --scope offline \\\n --redirect-uri http://127.0.0.1:5555/callback" }, { "type": "code", "lang": "json", "code": "{\n \"client_id\": \"9184ee7f-ffb1-4f0b-af5a-99ce52d8f324\",\n \"client_name\": \"\",\n \"client_secret\": \"rt1tpaWDiZwCetWDROH-LFpN.t\",\n \"client_secret_expires_at\": 0,\n \"client_uri\": \"\",\n \"created_at\": \"2023-01-30T08:31:38Z\",\n \"grant_types\": [\n \"authorization_code\",\n \"refresh_token\"\n ],\n \"jwks\": {},\n \"logo_uri\": \"\",\n \"metadata\": {},\n \"owner\": \"\",\n \"policy_uri\": \"\",\n \"redirect_uris\": [\n \"http://127.0.0.1:5555/callback\"\n ],\n \"registration_access_token\": \"ory_at_qM2EmFkLsHUI_YjTe0uuJhkr2LiB8_VK04ilYIxXLe8.gLywrTZ4YGA8w8ziSV_ttm_9VP5mDoBME-Iki3kdo18\",\n \"registration_client_uri\": \"http://127.0.0.1:4444/oauth2/register/9184ee7f-ffb1-4f0b-af5a-99ce52d8f324\",\n \"request_object_signing_alg\": \"RS256\",\n \"response_types\": [\n \"code\",\n \"id_token\"\n ],\n \"scope\": \"openid offline\",\n \"subject_type\": \"public\",\n \"token_endpoint_auth_method\": \"client_secret_basic\",\n \"tos_uri\": \"\",\n \"updated_at\": \"2023-01-30T08:31:37.725833Z\",\n \"userinfo_signed_response_alg\": \"none\"\n}" } ] }