Workflow for my use case

[narayanan-ka]

I have a Django blogging app built currently using REST framework. I'm using the authentication & authorization system that ships by default in Django. So Django provides Identity management and authorization both currently. My purpose is to integrate an ecommerce app(third party application so that the ecommerce journey of my users is handled by a third party application) https://github.com/saleor/saleor) , My blogging App users should be able to access Saleor . I shortlisted Ory Hydra for this journey of mine.
Saleor suggested me having an OIDC service, that would allow you to log in with the same JWT token to my Django Blog APP and Saleor instance. They asked me to consider using the OIDC plugin in Saleor for that: https://docs.saleor.io/docs/3.x/developer/available-plugins/openid-connect#saleor-as-a-resource-server
Saleor has an OIDC plugin where they ask me to enter information for JWKS and userinfo endpoints.

I would like to know from how best to integrate Ory Hydra for this :
Here is what I have understood from the docs for Ory Hydra.

1. Django blogging app for authentication and identity management.
2. Ory Hydra for authorization.
3. Saleor for entering details of jwks and userinfo endpoints on their end.

I would need your help in understanding the FLOW in this case. I also don't want my users to have prompts on their Flutter app for asking each user their permission to access Saleor using my Django blogging app credentials(I understand each user ill be prompted whether they give Saleor permission to access information about a user on Django blogging app end which is my API server)

Help appreciated.

[MarkusThielker]

Even though I haven't integrated Hydra with Django before, I hope I can clarify some things for you.

Components

1. Django is your identity management and also your authentication for cookie-based sessions
2. Ory Hydra makes your Django identity management able to communicate with OIDC clients
3. Saleor is the OIDC client, asking your Django app if the user is authenticated and who they are

Prerequisites

• Hydra Instance: You need a running Ory Hydra instance and a database to manage the OAuth 2.0 related data.
• Consent Flow Page: Hydra needs to be configured with the URL of your Django app's consent page. This is where users will grant (or deny) Saleor access to their information.
• OIDC Client Configuration: In Hydra, you must create an OIDC client representing your Saleor instance. This includes providing redirect URLs and any necessary scopes.
• Saleor Configuration: Configure Saleor to use your Hydra instance for authentication. This involves providing Hydra's URL, the client ID, and other relevant OIDC settings.

Flow

1. Saleor Initiates Login: When a user attempts to log in to Saleor, it redirects them to your Ory Hydra instance.
2. Hydra's Login Challenge: Hydra generates a login_challenge (a unique identifier for this authentication request) and redirects the user to your Django app's consent flow page, passing the login_challenge as a query parameter.
3. Django Authentication: If the user isn't already logged in, your Django app should prompt them to authenticate.
4. Consent Screen: Your Django app's consent page displays the requested scopes (e.g., access to user profile, email). The user decides whether to allow or deny Saleor access.
5. Hydra SDK Interaction: Your Django app uses the Hydra SDK or API to provide the user's consent decision along with the login_challenge. Hydra then redirects the user back to Saleor with an authorization code or an error, depending on the user's choice. Saleor will then exchange this code for an access token.

Prompts

Don't take my word on it but I think you can configure the OIDC client to skip the consent flow so users see your Django Apps login or nothing. You will have to test this yourself.

I hope this cleared up some things about the interaction of the components and the consent flow in your scenario.

[narayanan-ka]

Yup. It's a well explained flow. I have a simple question. I currently login using a Bearer token unique to each user in my django api which is issued after he creates an account. Therefore I must use this token when I hit Saleor with Authorization : Bearer "Token details ? Which will get passed on to Hydra and eventually to Django for Authentication ? I don't need to enter the username and password in the consent page and just need to validate it again since it's now coming from Hydra end ?

[MarkusThielker]

Well the OIDC flow always starts from the client, which is Saleor in your case.

The moment when you check if the user is authenticated to accept or reject the consent challenge is in your app, the place where you implement the consent page. This can be a web page or a flutter app or something else. 

  1. Hydra redirects to consent page
  2. Consent page is protected by the applications authentication system
  3. Consent can only be given if a user is authenticated

Which method you use to securely authenticate your user, whether that's via cookie-based sessions or a bearer token, doesn't matter in that moment. 

Your application just tells Hydra "The user xy is authenticated and accepts/rejects the consent request". 
Hydra then issues it's own token to Saleor.
The bearer token used to authenticate your app with the Django server is never transmitted to Hydra or Saleor.

[narayanan-ka]

I missed asking. You mentioned "This can be a web page or a flutter app or something else". I might be missing something here, Because I do have a flutter mobile app to access my backend django api which are currently being built for iOS and Android. I believe you meant - A Flutter Web app deployed on my server for rendering the Login & Consent page or any other Web page built in other languages ?

Meanwhile, Thank you for taking time to write in detail @MarkusThielker . Have a great weekend. 🙏

[MarkusThielker]

A web page / flutter web app is definitely recommended since this makes it irrelevant if your app is installed on the device.

In theory though it doesn't has to be on the web. You could also use deep links into your mobile app.
But in this case the user would have to use Saleor on a phone where the mobile app is installed on.