ory / defcon-30-ctf

Ory

Ory is the next-gen auth* SaaS - global, data-driven, affordable, and backed by popular and proven open source. Raise issues or have discussions, ask questions and more. The documentation GitHub repository is located at github.com/ory/docs.

defcon-30-ctf's Issues

Networking

• Oathkeeper as API gateway
• sessions are checked with Kratos and encoded down the line as JWT
• UI is accessible from world
• Backend only accessible with session
• Keto not accessible (except self check?)
• Kratos Public accessible from world
• Kratos Admin not accessible
• Backend does authz checks with Keto (consider doing that in Oathkeeper)

Frontend

• login/registration form, no reset or settings flow
• display already submitted results (overall and all submissions?)
• submit new result (form can always be displayed but shows 401 errors)

Backend

• allows to get results (simple counter of votes) for all registered users
• allows to submit new result only for users with special permission on location XYZ, and only for that location
• CTF backdoor somewhere (not to be disclosed up-front!)

Persistence

Options we have:

1. deploy DB (postgres?) for local and remote
2. deploy DB only for local, use Ory Cloud for remote

Authentication

• set up basic username & pw (webauthn?) Kratos
• basic login/registration UI

Authorization

• model permissions
• set up Keto with rewrites