Hello everyone! I've designed a login flow using Hydra and Kratos that uses my backend as a mediator. My login flows starts at SERVER/auth/login and this route creates an OIDC authorization URL for Hydra and redirects to it. After Hydra is hit it redirects to its login URL SERVER/auth/hydra/login where it now provides a login_challenge as well. This login challenge is given to Kratos self-service login and we redirect to it (UI/self-service/login/browser for the default UI node). The Kratos redirect is also supplied with a return_to for the SERVER/auth/kratos/continue URL where we will return after logging in to Kratos. The SERVER/auth/kratos/continue URL now has the login_challenge and a session cookie from Kratos. These are used to verify the session and accept the login request we initiated at the start. Then we redirect to the URL provided by the accept login request endpoint (usually consent). The consent is skipped by my Hydra client as we are in a first-party app and we don't need it (but I still needed to have a container that provides it - the one used in the Hydra quickstart which contains the logic check to skip over consent). After that we finish the login with the SERVER/auth/callback endpoint where we exchange the authorization code and get OIDC tokens. I've also implemented a custom redirect to allow for redirecting back to where we started or the default page of the frontend (when no redirect is provided). Is my flow adequate and where can it be improved? From what I'm seeing, I'd think that I'm able to skip the SERVER/auth/hydra/login endpoint but then I'm not sure how to redirect to the continue route after Kratos login is done...

Our Implementation

1. User visits /auth/login
2. Initialize Kratos login flow (SDK call)
3. Render Ory login UI
4. User authenticates → Kratos creates session
5. Post-login webhook triggers (configured in Ory)
6. Redirect to app

We don’t use Hydra at all for first-party authentication. Kratos handles session management natively. IMO /Suggestion, improvement can be eliminating one hop by combining

SERVER/auth/hydra/login

logic into either

/auth/login

(extract challenge, redirect to Kratos) or

/auth/callback

(accept challenge after Kratos).

Thank you for the reply! The reason I want to use Hydra is to allow for refresh tokens and not require the user to login after their session expires. Also how could I combine some of these routes? I only get a

login_challenge

after redirecting to Hydra - it doesn't directly provide it to me when I build the authorization URL. I also cannot get my tokens before I go through accepting the Hydra login (done via the `/auth/kratos/continue`endpoint) and I also need the redirects for when I go to the callback or whatever is next (in cases where consent is needed).

The reason I want to use Hydra is to allow for refresh tokens and not require the user to login after their session expires.

If that is the only reason you might not need Ory Hydra at all. I recommend this as reading material: https://www.ory.com/blog/oauth2-openid-connect-do-you-need-use-cases-examples

not require the user to login after their session expires.

you can set the session lifetime higher or extend the session: https://www.ory.com/docs/kratos/session-management/refresh-extend-sessions

@magnificent-energy-493 Sorry if this is a stupid question but does this mean that I won't be able to use Google OAuth2 login in Kratos? I don't remember that being related to Hydra but I'm asking just in case. > Being a consumer of OAuth2 or OpenID Connect: you implement "Sign in with Google," need access to a user's GitHub account and other use cases. Here, OAuth2 makes a ton of sense. This article doesn't cover this use case. > Edit: Currently I'm using OAuth2 introspection in Oathkeeper to provide authentication for my backend API. How would I migrate this for the Kratis session cookie and how would I check whether a session exists on the frontend - should I make a route in the backend for that check or do something else?

Hey @silly-musician-15276 You don't need Hydra to consume OAuth2 flows, you only need it to serve OAuth2 flows. Here is how to add "Login with Google" to your app: https://www.ory.com/docs/kratos/social-signin/google Frontend • When a user signs in / signs up in the browser, Ory issues an Ory Session Cookie and maintains a session object for that user. https://www.ory.com/docs/kratos/session-management/overview • To check who the user is, you call GET /sessions/whoami (toSession()), which returns the full session including the identity. https://www.ory.com/docs/identities/sign-in/check-session-token-cookie-api • You normally do not deal with OAuth2 access tokens or refresh tokens from the browser at all in this pattern. Backend • The browser sends the Ory session cookie to your backend (CORS and cookie domains set up appropriately). • Backend middleware extracts the Cookie header and forwards it to Ory’s /sessions/whoami (toSession) endpoint. • Ory responds with the session and identity, which you use to authenticate and authorize the request. https://www.ory.com/docs/kratos/bring-your-own-ui/custom-ui-basic-integration#session-checks If you need a JWT • Session → JWT: Have your backend call toSession with tokenize_as=template to get a signed JWT representing the current session, using configured JWT templates. https://www.ory.com/docs/identities/session-to-jwt-cors Of course you can still use OAuth2 if you prefer that - but in my opinion it adds a bunch of complexity that is not really needed.

I think you are indeed correct. It does seem more fitting for my use case. Thank you!