[apitman]

The Ory stack looks to be very high quality for sure. But so far in this thread there's been mentioned Hydra, Kratos, and Oathkeeper in order to run an OIDC server. You say Hydra is as barebones as you can get, but by itself it has 58 direct dependencies. I'm sorry, it just seems to be targeted at a completely different demographic.

[hatf0]

When has the number of dependencies ever directly correlated with the feature set of an application? Have you ever looked at a node_modules folder? More over, how is that relevant in any way? This argument against dependencies has always felt like weird NIH-ism spawned out of the same crowd who still thinks that C is a good programming language. Have fun reinventing the wheel, but I’ll take my dependencies to go.

Additionally, you’re conflating an OIDC server with a full IdP, which Hydra explicitly is not. I don’t need a full identity provider with support for user profile pictures and a pretty UI if all I’m doing is controlling access to API endpoints via OAuth2 client credentials. I already have an identity provider, and I’m not foolish enough to think that I should host one myself.

You’re completely correct in that you are not the intended demographic if you don’t understand the utility of the Ory stack, and that’s okay.

[apitman]

Dependencies are correlated with complexity in my mind. This is based on my experience, which may be different from yours. My experience with node_modules is actually where I started to become wary of dependencies and try to minimize them in my code. You definitely to be careful of NIH. I find sometimes a better approach is just to cut features.

I think I understand the utilty of the Ory stack. Looks like some excellent kit doing excellent work for a lot of people. But it didn't solve my problems.