Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Is it possible to combine Hydra with Kratos and Keto to implement the following:
1. User A is in organization A and tries to log into OIDC client A that belongs to organization A. This works. At the same time, the user has no access to client B that belongs to organization B. The user might also log into client C which belongs to organization A. 
2. User A has different roles in client A and client C. These roles are returned as information in the token.
I'd really appreciate any feedback! I'm both interested in knowing whether this is possible with the open-source software as well as with Ory Network.

This is also possible with just Kratos, Hydra and using the metadata in Kratos identity with some business level logic to check which user belongs to which organization :)

Thanks <@U02S03C0LH5>! Sounds really promising. I'm a bit less familiar with Hydra as with the other tools and I haven't found anything there in this direction. How would this work that only a certain group of users is able to get a token for a client?