On-prem instance with SPNEGO/GSSAPI Kerberos authentication

[aiobofh]

Hi masters!

Is there a way to configure Hydra to authenticate users using a Kerberos token, using SPNEGO/GSSAPI as credentials, achieving single-sign-on in an enterprise environment? Sadly I could not see anything regarding this in the docs. However - Hope still lives on!

This would be such a nice thing <3

Kind regards,
AiO

[vinckr]

Hello @aiobofh

I think

authenticating users using a Kerberos token, using SPNEGO/GSSAPI as credentials,

would be something that would fit more in the scope of Ory Kratos.

There is currently an effort underway to implement SAML. Kerberos and other legacy enterprise protocols have been requested once(?) before, but so far not much interest from the community.
If you are up to it feel free to open a Feature Request or Design Document (the latter if you already have an idea how to implement).
Thanks 🤗

edit: if anyone has a way to make this work just with Ory Hydra, please share details in here!