I didn't find any documentation how to implement my own userinfo endpoint. I have found this (https://www.ory.sh/docs/oauth2-oidc/userinfo-oidc) but don't see how to implement it. Something like request xyz is the input and a response with the format abc is expected. Has anyone implemented a custom userinfo endpoint before and can help?

It’s not a stupid question, there is no such documentation at the moment. What are you trying to achieve?

Thanks for replying @high-optician-2097 🙂 I want to create a design with identity management (Kratos) and OIDC (Hydra), where OIDC clients are connected to certain roles of users that are allowed to access it (with the respective role). I want to a) Include the role information (which is not global for one user, he might have different roles depending on the client) -> here I need a custom userinfo endpoint b) I want to be able to deny access to users who do not have a role that can access the client. It is actually rather similar to the organization/user management that Zitadel has, if you are familiar with it. That might be easier to understand than my explanation... Can I do such a design with Ory Hydra/kratos/keto or the Ory Network?

Hm, it sounds like you need three things: • Identity Management • OAuth2 / OpenID Connect • Permissions Regarding roles and OIDC mapping, I’m not sure if I understand the context correctly - generally speaking it’s much easier to go with Ory Network. Most businesses that self-host in the end migrate to Ory Network because it’s easier, convenient, and more powerful (plus we do zero downtime migrations for you)

I'm aware that things are easier with Ory Network.. I'm not 100% convinced of this structure that Ory network is kind of really different than the isolated open source components, as we then have to learn two things to get involved in Ory. Anyway, I was also including Ory Network in what I said! I didn't find an option to do this with Ory Network either, until now. I want to have a) OIDC clients that only give access to users with a certain role b) a custom user endpoint that gives any information to the clients that I want (primarily about the user's roles)

I think you’ll need to write a bit of code for that. For example, a custom consent endpoint that does this logic, and a custom endpoint to return the roles. You may also use Ory Permission for the second part, but the consent endpoint you probably won’t get around. With Ory Network you’ll save a lot of time just setting up databases, reverse proxies, …

Sounds good that this looks feasible to you! Do you have any resources about this? I haven't found anything around Hydra with customized user endpoint and something with role-based access to clients

I don’t think we have docs for that specific case - but we have docs for modifying consent in general

If the userinfo endpoint is standardized I guess it would be okay to test. This other thing is much harder. I literally have no idea how to configure Hydra or where to extend Hydra so that users get the access tokens based on their respective roles... If there are no docs or examples for that, I wouldn't know where to start

Okay, from this diagram here (https://www.ory.sh/docs/oauth2-oidc/custom-login-consent/flow#sequence-diagram) I understand that we would have to deny the login with our login endpoint. This is somewhat different than flows in other apps, where we first have the authorization code flow and then in a second step the token is requested. We would use the second step to deny a user that has not the proper role then. With Hydra/Ory, I understand that we would have to deny it in the first step with the login endpoint. Did I understand this correctly?

You can also deny it during consent phase