keto

README

Chat | Forums | Newsletter

Guide | API Docs | Code Docs

Support this project!

This service is a policy decision point. It uses a set of access control policies, similar to AWS IAM Policies, in order to determine whether a subject (user, application, service, car, ...) is authorized to perform a certain action on a resource.

---

• Introduction
  • Installation
    • Download binaries
    • Using Docker
    • Building from source
• Ecosystem
  • ORY Security Console: Administrative User Interface
  • ORY Hydra: OAuth2 & OpenID Connect Server
  • ORY Oathkeeper: Identity & Access Proxy
• Security
  • Disclosing vulnerabilities
• Telemetry
  • Guide
  • HTTP API documentation
  • Upgrading and Changelog
  • Command line documentation
• Backers
• Sponsors

Introduction

With ORY Keto, you can model Access Control Lists, Role Based Access Control, and fine-grained permission sets. This server implementation uses ORY Ladon as the decision engine.

ORY Keto is possible to resolve credentials using various authentication mechanisms:

• OAuth 2.0 Access Tokens using the OAuth 2.0 Introspection standard.
• Plaintext when you already know the user ID.
• JSON Web Tokens (coming soon).
• SAML (coming soon).

Installation

There are various ways of installing ORY keto on your system.

Download binaries

The client and server binaries are downloadable at releases. There is currently no installer available. You have to add the ORY keto binary to the PATH environment variable yourself or put the binary in a location that is already in your path (/usr/bin, ...). If you do not understand what that all of this means, ask in our chat channel. We are happy to help.

Using Docker

Starting the host is easiest with docker. The host process handles HTTP requests and is backed by a database. Read how to install docker on Linux, OSX or Windows. ORY keto is available on Docker Hub.

You can use ORY keto without a database, but be aware that restarting, scaling or stopping the container will lose all data:

$ docker run -e "DATABASE_URL=memory" -d --name my-keto -p 4466:4466 oryd/keto
ec91228cb105db315553499c81918258f52cee9636ea2a4821bdb8226872f54b

Building from source

If you wish to compile ORY keto yourself, you need to install and set up Go 1.10+ and add $GOPATH/bin to your $PATH as well as golang/dep.

The following commands will check out the latest release tag of ORY keto and compile it and set up flags so that keto version works as expected. Please note that this will only work with a linux shell like bash or sh.

go get -d -u github.com/ory/keto
cd $(go env GOPATH)/src/github.com/ory/keto
keto_LATEST=$(git describe --abbrev=0 --tags)
git checkout $keto_LATEST
dep ensure -vendor-only
go install \
    -ldflags "-X github.com/ory/keto/cmd.Version=$keto_LATEST -X github.com/ory/keto/cmd.BuildTime=`TZ=UTC date -u '+%Y-%m-%dT%H:%M:%SZ'` -X github.com/ory/keto/cmd.GitHash=`git rev-parse HEAD`" \
    github.com/ory/keto
git checkout master
keto help

Ecosystem

ORY Security Console: Administrative User Interface

The ORY Security Console is a visual admin interface for managing ORY Hydra, ORY Oathkeeper, and ORY Keto.

ORY Hydra: OAuth2 & OpenID Connect Server

ORY Hydra ORY Hydra is a hardened OAuth2 and OpenID Connect server optimized for low-latency, high throughput, and low resource consumption. ORY Hydra is not an identity provider (user sign up, user log in, password reset flow), but connects to your existing identity provider through a consent app.

ORY Oathkeeper: Identity & Access Proxy

ORY Oathkeeper is a BeyondCorp/Zero Trust Identity & Access Proxy (IAP) built on top of OAuth2 and ORY Hydra.

Security

Disclosing vulnerabilities

If you think you found a security vulnerability, please refrain from posting it publicly on the forums, the chat, or GitHub and send us an email to hi@ory.am instead.

Telemetry

Our services collect summarized, anonymized data which can optionally be turned off. Click here to learn more.

Guide

The Guide is available here.

HTTP API documentation

The HTTP API is documented here.

Upgrading and Changelog

New releases might introduce breaking changes. To help you identify and incorporate those changes, we document these changes in UPGRADE.md and CHANGELOG.md.

Command line documentation

Run keto -h or keto help.

Backers

Thank you to all our backers! 🙏 [Become a backer]

We would also like to thank (past & current) supporters (in alphabetical order) on Patreon: Alexander Alimovs, Chancy Kennedy, Drozzy, Oz Haven, TheCrealm

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]

A special thanks goes out to Wayne Robinson for supporting this ecosystem with $200 every month since Oktober 2016 on Patreon.

Documentation

Overview

Package main ORY Keto

Schemes: http, https
Host:
BasePath: /
Version: Latest
License: Apache 2.0 https://github.com/ory/keto/blob/master/LICENSE
Contact: ORY <hi@ory.am> https://www.ory.sh

Consumes:
- application/json

Produces:
- application/json

swagger:meta