ory / defcon-30-ctf Goto Github PK

• allows to get results (simple counter of votes) for all registered users
• allows to submit new result only for users with special permission on location XYZ, and only for that location
• CTF backdoor somewhere (not to be disclosed up-front!)

• Oathkeeper as API gateway
• sessions are checked with Kratos and encoded down the line as JWT
• UI is accessible from world
• Backend only accessible with session
• Keto not accessible (except self check?)
• Kratos Public accessible from world
• Kratos Admin not accessible
• Backend does authz checks with Keto (consider doing that in Oathkeeper)

• set up basic username & pw (webauthn?) Kratos
• basic login/registration UI

Options we have:

1. deploy DB (postgres?) for local and remote
2. deploy DB only for local, use Ory Cloud for remote

• login/registration form, no reset or settings flow
• display already submitted results (overall and all submissions?)
• submit new result (form can always be displayed but shows 401 errors)

• model permissions
• set up Keto with rewrites