Where is the ory keto endpoint on ory network?

[SvenPVoigt]

Hi all,

On ory network: I am trying to get a webhook working that retrieves groups from ory keto permissions and puts it into the JWT payload.

I have this relationship: Group:foo#members@User:ecf284

Webhooks documentation says that a request payload gets forwarded to some endpoint.

1. Which request payload would have user id?

On the authentication > webhooks dashboard I have options:

Flow: [login,registration,settings,recovery,verification]
Execution: [before,after]
Url: text input
Method: [get,post,...]
Action HTTP body: text input

2. For url, how do I get the webhook to request something from the permissions endpoint? And where is the permissions endpoint?

Dashboard doesn't show the REST endpoint and neither does the keto documentation.

[vinckr]

request payload gets forwarded to some endpoint

This is an endpoint on your side, so you can decide where it sits. It's not an Ory Action webhooks, which is the one that you configure in the Ory Console.

Customize the token response by registering a webhook endpoint in your OAuth2 configuration.

As in the example code snippet it can be anywhere really https://my-example.app/token-hook

See the API docs for Ory Network, not self-hosted Ory Keto: https://www.ory.com/docs/reference/api#tag/permission/operation/checkPermissionOrError

e.g. https://{project_slug}.projects.oryapis.com/relation-tuples/check

[SvenPVoigt]

So keto is a user database that doesn't integrate with hydra? Seems like a separate product that needs to be compared to hosting another database of user info.

[vinckr]

Hydra and Keto solve different problems and are usually used together, not instead of each other:

• Ory Hydra (OAuth2 & OpenID Connect)

Purpose: Acts as an OAuth2 / OIDC server (authorization server / identity provider) to issue and validate access tokens and ID tokens.

It does not manage users itself; it connects to an existing identity system (for example Ory Identities/Kratos). [Hydra intro; Hydra overview]

• Ory Keto (Permissions)

Purpose: A permission / authorization engine that answers “is subject X allowed to do Y on object Z?” using relationships and permission rules (Zanzibar-style).

It is not a user database and isn’t an OAuth2 server; it stores only relationship/permission data and exposes APIs to check access. [Keto intro; Permissions overview]

In Ory Network the OAuth2 and Identities part is integrated, but Permissions are separate.
You can of course reference the user_id from Identities in the Permissions to integrate them, but ultimately it's up to you if you use them together or not.

[SvenPVoigt]

Just seems like the opportunity is to add arbitrary claims to JWTs like orgs/groups/read/write using a dynamic database instead of only having them available at registration.

[vinckr]

Not sure if I follow you.
What is the use case you are trying to solve / what do you use "arbitrary claims" for?

[SvenPVoigt]

I'm just referring to JWTs allowing arbitrary claims