Hi friends, I am currently building an application where I wrote the whole authentication and authorization logic in golang, jwt access tokens with claims for company, user, role and refresh token cookies for secure access token refreshs and all this with redis as the intermediate database for refresh token validation, rate limiting based on IP and Email etc. I thought about using oxy kratos instead since developing this any further costs to much time. My usecase is like this: everyone can signup. At signup each and every user gets a separate companyID and can invite other people into the app with the same companyID. The next step would be to make it possible for the users to add azure ad auth instead. So in the end every user who has signed up from the frontend will be an admin and should be able to create an azure connection for auth. Is this possible with ory kratos (self hosted for now)?

Hello @acoustic-shampoo-32095 Yes, it is possible to implement your use case with Ory Kratos. Here’s how: - User Management: Ory Kratos provides a secure and straightforward way to implement user management, login, and registration. It handles common flows such as login and logout, account activation, multi-factor authentication, profile and session management, user-facing errors, and account recovery methods. You can customize these flows to suit your requirements (source). - Multi-tenancy: While Ory Kratos doesn’t implement multi-tenancy in its application logic, it’s possible to implement multi-tenancy with Ory Kratos. The recommended approach is to run one or more SQL databases and create one database schema per tenant in these database instances. Ory Kratos itself should run as one instance per tenant with a configuration tailored for that specific tenant (source). - Social Sign-in: Ory Kratos supports social sign-in, including Azure AD. You can add a social sign-in provider by defining the redirect URL, creating a client at your provider to get the Client ID and Client Secret, setting the redirect URI, creating a Jsonnet code snippet to map the desired claims to the Ory Identity schema, and adding the configuration for your social sign-in provider to the Ory Kratos configuration (source). - Role-based Access Control: Ory provides another project called Ory Keto (aka Permissions), which is a policy decision point. It uses policies to determine whether a subject (user) is authorized to perform a certain action on a resource. You can use Ory Keto alongside Ory Kratos to implement role-based access control in your application. Can you share your reasons to go self-hosting now?

@magnificent-energy-493 Hi, thanks for the response. I am currently evaluating how kratos can be used. Starting with self hosting and then evaluating the benefits of a hosted version will be the route to take. I am thinking about solving the multi tenancy with my current logic: I have a column called companyId in almost every database table. I extract this companyId from the user and add it to the kratos identity. I do not think that there is any reason for the identities to be separated. I already managed to create the registration as mentioned with the admin api but you said in another thread to use the frontend api and hooks instead. I would like to use the logic in my backend so the frontend does not get involved. Is there any disadvantages using the admin api instead of the frontend one in the long run? It is kind of hard to use the documentation… I use golang microservies in the backend. Do you have specific documentations for these things to follow along with instead of searching randomly and checking source code?