Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Heyo, I’m wondering if I am experiencing a bug in hydra.

I was reading <https://www.ory.sh/docs/hydra/guides/jwt#using-jwts-as-authorization-grants> and there is no mention of a client being a requirement here. I’m getting errors if I don’t include client_id and client_secret, but shouldn’t the grant work without a client too?

It looks like fosite itself would support skipping client auth: <https://github.com/ory/fosite/blob/master/access_request_handler.go#L88>

It looks like this might have been an unintended change? <https://github.com/ory/hydra/blame/fbf39dd3a43acd624b08eb4e4dc306f6c339dddf/driver/config/provider_test.go#L491>

I was able to get it working locally by setting the value back to true and by removing the client_id FK and NOT NULL constraints from the table

Hello Hendrik, opening a github issue is probably the best way to go :slightly_smiling_face: