求Ory Hydra 2.0与Kratos集成配置示例，实现Kratos作为身份提供商

Ory Hydra 2.0 正式支持与 Ory Kratos 集成，仅需少量配置即可让 Kratos 作为 Hydra 的登录提供商，打通身份系统与 OAuth2 登录/授权流程。以下是基于 Docker Compose 环境的完整配置示例：

1. 配置 Ory Hydra #

通过配置文件或环境变量，将 Hydra 的登录、授权同意及登出端点指向 Kratos，并启用 Kratos 身份提供商集成：

方式一：YAML 配置文件 #

# hydra-config.yaml
serve:
  public:
    host: 0.0.0.0
    port: 4444
  admin:
    host: 0.0.0.0
    port: 4445

dsn: postgres://hydra:secret@postgres:5432/hydra?sslmode=disable

oauth2:
  consent_url: http://kratos:4433/self-service/login/browser?request={{request.id}}
  login_url: http://kratos:4433/self-service/login/browser?request={{request.id}}
  logout_url: http://kratos:4433/self-service/logout/browser

identity_providers:
  enabled: true
  kratos:
    enabled: true
    config:
      base_url: http://kratos:4433

方式二：Docker 环境变量（适配 Docker Compose） #

HYDRA_DSN=postgres://hydra:secret@postgres:5432/hydra?sslmode=disable
HYDRA_OAUTH2_CONSENT_URL=http://kratos:4433/self-service/login/browser?request={{request.id}}
HYDRA_OAUTH2_LOGIN_URL=http://kratos:4433/self-service/login/browser?request={{request.id}}
HYDRA_OAUTH2_LOGOUT_URL=http://kratos:4433/self-service/logout/browser
HYDRA_IDENTITY_PROVIDERS_ENABLED=true
HYDRA_IDENTITY_PROVIDERS_KRATOS_ENABLED=true
HYDRA_IDENTITY_PROVIDERS_KRATOS_CONFIG_BASE_URL=http://kratos:4433

2. 配置 Ory Kratos #

启用 Kratos 的 OAuth2 身份验证器，配置回调地址指向 Hydra，并关联提前创建的 Hydra 客户端：

# kratos-config.yaml
serve:
  public:
    host: 0.0.0.0
    port: 4433
  admin:
    host: 0.0.0.0
    port: 4434

dsn: postgres://kratos:secret@postgres:5432/kratos?sslmode=disable

selfservice:
  methods:
    oauth2:
      enabled: true
      config:
        providers:
          - id: hydra
            provider: generic
            label: Hydra
            client_id: kratos-client
            client_secret: kratos-secret-123
            issuer_url: http://hydra:4444
            scope:
              - openid
              - profile
              - email
            redirect_uri: http://kratos:4433/self-service/methods/oauth2/callback/hydra

创建 Hydra 客户端 #

先通过 Hydra Admin API 创建供 Kratos 使用的 OAuth2 客户端：

curl -X POST http://localhost:4445/clients \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "kratos-client",
    "client_secret": "kratos-secret-123",
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code", "id_token"],
    "scope": "openid profile email",
    "redirect_uris": ["http://kratos:4433/self-service/methods/oauth2/callback/hydra"]
  }'

3. 调整 Docker Compose 配置 #

确保 Hydra、Kratos 与 Postgres 处于同一网络，可互相访问：

# docker-compose.yaml
version: '3.8'
services:
  postgres:
    image: postgres:14-alpine
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: secret
      POSTGRES_DB: postgres
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - ory-network

  hydra:
    image: oryd/hydra:v2.0.0
    environment:
      - HYDRA_DSN=postgres://hydra:secret@postgres:5432/hydra?sslmode=disable
      - HYDRA_OAUTH2_CONSENT_URL=http://kratos:4433/self-service/login/browser?request={{request.id}}
      - HYDRA_OAUTH2_LOGIN_URL=http://kratos:4433/self-service/login/browser?request={{request.id}}
      - HYDRA_OAUTH2_LOGOUT_URL=http://kratos:4433/self-service/logout/browser
      - HYDRA_IDENTITY_PROVIDERS_ENABLED=true
      - HYDRA_IDENTITY_PROVIDERS_KRATOS_ENABLED=true
      - HYDRA_IDENTITY_PROVIDERS_KRATOS_CONFIG_BASE_URL=http://kratos:4433
    command: serve all --dev
    depends_on:
      - postgres
    ports:
      - "4444:4444"
      - "4445:4445"
    networks:
      - ory-network

  kratos:
    image: oryd/kratos:latest
    environment:
      - KRATOS_DSN=postgres://kratos:secret@postgres:5432/kratos?sslmode=disable
    volumes:
      - ./kratos-config.yaml:/etc/kratos/kratos.yaml
    command: serve all --dev
    depends_on:
      - postgres
    ports:
      - "4433:4433"
      - "4434:4434"
    networks:
      - ory-network

volumes:
  postgres-data:

networks:
  ory-network:
    driver: bridge

验证集成效果 #

启动所有服务后，访问 Hydra 的 OAuth2 授权端点（示例）：

http://localhost:4444/oauth2/auth?client_id=your-test-client&redirect_uri=http://localhost:3000/callback&response_type=code&scope=openid

页面会自动跳转到 Kratos 登录界面，完成登录后返回 Hydra 授权页面，最终可获取 OAuth2 授权码，证明集成成功。

内容的提问来源于stack exchange，提问作者Dany