New Ory Agent Security is now live!

Danger

The APIs of Ory open-source Servers don't come with integrated access control. This means that all requests sent to their APIs are considered authenticated, authorized, and will be executed. Leaving the APIs in this state can lead to severe security risks.

When deploying Ory open-source Servers, protect access to their APIs using Ory Oathkeeper or a comparable API Gateway.

If you need help, reach out to the community on Ory Community Slack.

Ory Hydra Enterprise License (OEL) is distributed as a Docker image from Ory's private enterprise Docker registry. Unlike the open source build, it is not available as a public binary download or from GitHub releases, and it requires authentication to pull.

Prerequisites

Before starting the process, ensure you meet the following requirements:

• Valid Ory Enterprise License: You must have purchased an Ory Enterprise License.
• Access to the Ory Enterprise Docker registry: You need access to download the OEL Docker images.
• Backup and Testing: Create a backup of your current Ory database if you are upgrading or migrating and test the process on a test environment to ensure compatibility and minimize risks.

Docker registry

The Ory Hydra OEL image is available from the EU region registry:

europe-docker.pkg.dev/ory-artifacts/ory-enterprise/hydra-oel

Authenticate to the registry

Enterprise Docker images are kept in a private registry that requires authorization. An authorization key is provided for each customer separately. The following steps assume the key is stored in keyfile.json.

gcloud auth activate-service-account --key-file=keyfile.json

gcloud auth configure-docker europe-docker.pkg.dev

Pull the image

Replace <image-tag> with the newest tag from Available image tags at the bottom of this page:

docker pull europe-docker.pkg.dev/ory-artifacts/ory-enterprise/hydra-oel:<image-tag>

Run with Docker

To run Ory Hydra OEL, set the DSN environment variable to your database connection string and provide a configuration file. Pass the configuration file with the -c / --config flag and mount it into the container.

Note: Provide the database connection string through the DSN environment variable. The enterprise build reads DSN from the environment when initializing, and supplying it this way works for both the migration and serve steps.

Before deploying the service, apply the SQL migrations:

docker run \
-e DSN=your_database_connection_string \
europe-docker.pkg.dev/ory-artifacts/ory-enterprise/hydra-oel:<image-tag> \
migrate sql up -e -y

Then start the service:

docker run \
-p 4444:4444 -p 4445:4445 \
-e DSN=your_database_connection_string \
-v /path/to/config:/etc/config/hydra \
europe-docker.pkg.dev/ory-artifacts/ory-enterprise/hydra-oel:<image-tag> \
serve all -c /etc/config/hydra/hydra.yaml

Run on Kubernetes

Ory publishes Helm charts for all enterprise builds. Add the Ory Helm repository:

helm repo add ory https://k8s.ory.com/helm/charts

helm repo update

Create the ory namespace:

kubectl create namespace ory

Create a Kubernetes secret containing the image registry credentials:

kubectl create secret docker-registry ory-oel-gcr-secret \
  --docker-server=europe-docker.pkg.dev \
  --docker-username=_json_key \
  --docker-password="$(cat keyfile.json)" \
  --namespace ory

Create a Kubernetes secret containing the DSN and other secret values:

apiVersion: v1
kind: Secret
metadata:
  name: ory-oel-hydra-secret
  namespace: ory
data:
  dsn:
  # Add any additional secrets required by your configuration, base64-encoded.
  # https://www.ory.com/docs/hydra/reference/configuration

Create a values.yaml file to customize the configuration:

image:
  registry: europe-docker.pkg.dev
  repository: ory-artifacts/ory-enterprise/hydra-oel
  tag: <replace-with-current-image-tag>
imagePullSecrets:
- name: ory-oel-gcr-secret
hydra:
  automigration:
    enabled: true
serviceMonitor:
  enabled: true
secret:
  enabled: false
  nameOverride: "ory-oel-hydra-secret"
config:
  # Ory Hydra config
  # https://www.ory.com/docs/hydra/reference/configuration

Install Ory Hydra:

helm install ory-oel-hydra ory/hydra --namespace ory --create-namespace -f values.yaml

Available image tags

The tags are ordered by date. Pick the newest tag from the top of the list.