Plugin system for Kartos

[harnash]

Hi!

I wanted to start discussion about possible way to extend Kratos functionality through some plugin system. Best approach seem to be using native Golang plugin mechanism. Currently I see few areas that could benefit from such system:

1. hashers - useful to implement legacy hash algorithms during migration to Kratos from older systems
2. flow hooks - add some integrations that cannot be achieved through hooks
3. others?

For this to work we would need to come up with:

1. API for each type of plugin
2. API versioning?
3. Way to integrate plugins with configuration and perhaps with OpenAPI
4. Changes needed to the build system?
5. More?

I would prefer to keep things simple and perhaps expand to keep Kratos compact and relatively simple while allow to be quite flexible.

[aeneasr]

Thank you for your ideas! Have you seen the new web hook system we have? It is basically like what you propose but without the go plugin system. Go plugins are difficult because they need CGO and also it makes it difficult to keep backwards compatibility. If you want, check out webhooks and if it is not enough we can revisit go plugins

[TorinAsakura]

I see, the problem usually with plugin systems is that people find use cases where plug ins make sense, and then a system is put in place to address that :) That is often work and maintenance intense so we would really like to avoid such a situation. Regarding interfaces, we too heavily rely on this pattern. To implement a Hasher, you need to implement this.

So this is already possible even if not documented (because we can't let people rely on that right now). For migrating users that is definitely a pain at the moment but we would like to find a general nicer solution. I think a kick-ass migration process would be much preferable than writing a hashing plugin :)

Okay. What about our custom providers? I had to make a fork of Kratos and based on it make my own image to connect Vkontakte and Yandex. It's terrible practice

[aeneasr]

Why not just contribute VKontakte and Yandex to the project?

[TorinAsakura]

Why not just contribute VKontakte and Yandex to the project?

Someone’s tried it before, but it didn’t work. We’ll throw it today.

[harnash]

I see, the problem usually with plugin systems is that people find use cases where plug ins make sense, and then a system is put in place to address that :) That is often work and maintenance intense so we would really like to avoid such a situation. Regarding interfaces, we too heavily rely on this pattern. To implement a Hasher, you need to implement this.

aaaand this https://github.com/ory/kratos/blob/master/hash/hash_comparator.go

I can imagine this getting out of hand and there is potential for misuse - thus this discussion.

So this is already possible even if not documented (because we can't let people rely on that right now). For migrating users that is definitely a pain at the moment but we would like to find a general nicer solution. I think a kick-ass migration process would be much preferable than writing a hashing plugin :)

Could you elaborate on how in general this process might look like? When one has a legacy system to deal with and unsupported hashing algorithm in place? I am familiar with approaches that are used in "other" projects but I'm not 100% sure those would fit well with Kratos.

[TorinAsakura]

@aeneasr #1339 done