Skip to content

Commit fd08091

Browse files
bsanchez-the-roachbsanchez-the-roach
committed
Add more detail to Test Ory Hydra section
1 parent 6ac3fce commit fd08091

File tree

1 file changed

+77
-63
lines changed

1 file changed

+77
-63
lines changed

‎src/current/v25.4/ory-integration-guide.md‎

Lines changed: 77 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,9 @@ This section describes how to deploy Ory on a self-hosted Kubernetes cluster in
167167
~~~ shell
168168
$ helm repo add ory https://k8s.ory.sh/helm/charts
169169
~~~
170-
170+
171+
You should get the following message, confirming the repository was added:
172+
171173
~~~
172174
"ory" has been added to your repositories
173175
~~~
@@ -509,78 +511,90 @@ crdb-cluster-public-ips = [
509511

510512
## Test the CockroachDB/Ory Integration
511513

512-
Once both CockroachDB and Ory are provisioned, configured, and network-accessible, the next crucial step is to validate that all components work together as intended.
514+
Once both CockroachDB and Ory are provisioned, configured, and network-accessible, the next step is to validate that all components work together as intended.
513515

514516
Below is a practical guide for testing and debugging each part of this integration.
515517

516518
### Test Ory Hydra
517519

518-
To test Ory Hydra, you can create an OAuth2 client, generate an access token, then introspect it using the following Hydra commands:
520+
To test Ory Hydra, create an OAuth2 client, generate an access token, then introspect it. These steps use the `$HYDRA_ADMIN_URL` and `$HYDRA_PUBLIC_URL` that you exported at the end of the [Ory Hydra deployment](?filters=hydra#step-4-deploy-ory-services-on-kubernetes).
519521

520-
{% include_cached copy-clipboard.html %}
521-
~~~ shell
522-
$ hydra create oauth2-client --endpoint $HYDRA_ADMIN_URL --format json --grant-type client_credentials
523-
~~~
522+
1. Create the OAuth2 client:
524523

525-
~~~ json
526-
{
527-
"client_id": "9692d3f9-fcdc-4526-80c4-fc667d959a5f",
528-
"client_name": "",
529-
"client_secret": "F-~KQ8bKSeTxBKdZSS6woHSs9C",
530-
"client_secret_expires_at": 0,
531-
"client_uri": "",
532-
"created_at": "2025-06-11T16:43:07Z",
533-
"grant_types": ["client_credentials"],
534-
"jwks": {},
535-
"logo_uri": "",
536-
"metadata": {},
537-
"owner": "",
538-
"policy_uri": "",
539-
"registration_access_token": "ory_at_8xQlVk7rA_MX1yenToVmA7Wr7MLOLXJZdhh9iYHDEAQ.xGPfP4-AiGuOxAKkX-ZIdSntOJo8fy3a4b75ckE_V-g",
540-
"registration_client_uri": "http://public.hydra.localhost:4444/oauth2/register/",
541-
"request_object_signing_alg": "RS256",
542-
"response_types": ["code"],
543-
"scope": "offline_access offline openid",
544-
"skip_consent": false,
545-
"skip_logout_consent": false,
546-
"subject_type": "public",
547-
"token_endpoint_auth_method": "client_secret_basic",
548-
"tos_uri": "",
549-
"updated_at": "2025-06-11T16:43:07.320505Z",
550-
"userinfo_signed_response_alg": "none"
551-
}
552-
~~~
524+
{% include_cached copy-clipboard.html %}
525+
~~~ shell
526+
$ hydra create oauth2-client --endpoint $HYDRA_ADMIN_URL --format json --grant-type client_credentials
527+
~~~
528+
529+
Once you have created the OAuth2 client, you can parse the JSON response to get the `client_id` and `client_secret`:
530+
531+
~~~ json
532+
{
533+
"client_id": "9692d3f9-fcdc-4526-80c4-fc667d959a5f",
534+
"client_name": "",
535+
"client_secret": "F-~KQ8bKSeTxBKdZSS6woHSs9C",
536+
"client_secret_expires_at": 0,
537+
"client_uri": "",
538+
"created_at": "2025-06-11T16:43:07Z",
539+
"grant_types": ["client_credentials"],
540+
"jwks": {},
541+
"logo_uri": "",
542+
"metadata": {},
543+
"owner": "",
544+
"policy_uri": "",
545+
"registration_access_token": "ory_at_8xQlVk7rA_MX1yenToVmA7Wr7MLOLXJZdhh9iYHDEAQ.xGPfP4-AiGuOxAKkX-ZIdSntOJo8fy3a4b75ckE_V-g",
546+
"registration_client_uri": "http://public.hydra.localhost:4444/oauth2/register/",
547+
"request_object_signing_alg": "RS256",
548+
"response_types": ["code"],
549+
"scope": "offline_access offline openid",
550+
"skip_consent": false,
551+
"skip_logout_consent": false,
552+
"subject_type": "public",
553+
"token_endpoint_auth_method": "client_secret_basic",
554+
"tos_uri": "",
555+
"updated_at": "2025-06-11T16:43:07.320505Z",
556+
"userinfo_signed_response_alg": "none"
557+
}
558+
~~~
559+
560+
2. Generate an access token. Replace `<client_id>` and `<client_secret>` with the values you found in the JSON response:
553561

554-
{% include_cached copy-clipboard.html %}
555-
~~~ shell
556-
$ hydra perform client-credentials --endpoint $HYDRA_PUBLIC_URL --client-id 9692d3f9-fcdc-4526-80c4-fc667d959a5f --client-secret F-~KQ8bKSeTxBKdZSS6woHSs9C
557-
~~~
562+
{% include_cached copy-clipboard.html %}
563+
~~~ shell
564+
$ hydra perform client-credentials --endpoint $HYDRA_PUBLIC_URL --client-id <client_id> --client-secret <client_secret>
565+
~~~
558566

559-
~~~ shell
560-
ACCESS TOKEN ory_at_A2TpIR394rnUOtA0PLhvARKQyODmLIH7Fer5Y8clwe8.J61E8kR3ZH2w529D-5HOkuqoaTZy-CNLlNtvunYpdjg
561-
REFRESH TOKEN <empty>
562-
ID TOKEN <empty>
563-
EXPIRY 2025-06-11 19:49:39 +0200 CEST
564-
~~~
567+
This will generate an access token for Ory Hydra. Copy the string beside `ACCESS TOKEN`.
565568

566-
{% include_cached copy-clipboard.html %}
567-
~~~ shell
568-
$ hydra introspect token --format json-pretty --endpoint $HYDRA_ADMIN_URL ory_at_A2TpIR394rnUOtA0PLhvARKQyODmLIH7Fer5Y8clwe8.J61E8kR3ZH2w529D-5HOkuqoaTZy-CNLlNtvunYpdjg
569-
~~~
569+
~~~ shell
570+
ACCESS TOKEN ory_at_A2TpIR394rnUOtA0PLhvARKQyODmLIH7Fer5Y8clwe8.J61E8kR3ZH2w529D-5HOkuqoaTZy-CNLlNtvunYpdjg
571+
REFRESH TOKEN <empty>
572+
ID TOKEN <empty>
573+
EXPIRY 2025-06-11 19:49:39 +0200 CEST
574+
~~~
570575

571-
~~~ shell
572-
{
573-
"active": true,
574-
"client_id": "9692d3f9-fcdc-4526-80c4-fc667d959a5f",
575-
"exp": 1749664180,
576-
"iat": 1749660580,
577-
"iss": "http://public.hydra.localhost:4444",
578-
"nbf": 1749660580,
579-
"sub": "9692d3f9-fcdc-4526-80c4-fc667d959a5f",
580-
"token_type": "Bearer",
581-
"token_use": "access_token"
582-
}
583-
~~~
576+
3. Perform a token introspection to confirm the validity of this new token. Replace `<access_token>` with the string that you just copied:
577+
578+
{% include_cached copy-clipboard.html %}
579+
~~~ shell
580+
$ hydra introspect token --format json-pretty --endpoint $HYDRA_ADMIN_URL <access_token>
581+
~~~
582+
583+
This should generate a JSON response that includes your `client_id`, `"active": true`, an expiration timestamp (`exp`), and [other data](https://www.ory.com/docs/hydra/reference/api#tag/oAuth2/operation/introspectOAuth2Token):
584+
585+
~~~ json
586+
{
587+
"active": true,
588+
"client_id": "9692d3f9-fcdc-4526-80c4-fc667d959a5f",
589+
"exp": 1749664180,
590+
"iat": 1749660580,
591+
"iss": "http://public.hydra.localhost:4444",
592+
"nbf": 1749660580,
593+
"sub": "9692d3f9-fcdc-4526-80c4-fc667d959a5f",
594+
"token_type": "Bearer",
595+
"token_use": "access_token"
596+
}
597+
~~~
584598

585599
### Test Ory Kratos
586600

@@ -755,7 +769,7 @@ The server typically responds with HTTP 400 Bad Request and the Login Flow in th
755769
"state": "choose_method"
756770
}
757771
~~~
758-
772+
759773
Let's try with a valid password and submit the login flow:
760774
761775
{% include_cached copy-clipboard.html %}

0 commit comments

Comments
 (0)