July 2023 Summaries

Ory Hydra, an open-source OAuth2 and OpenID Connect server, has undergone significant performance optimization to handle high authorization loads, as evidenced by a popular service provider's experience. The enhancements focused on re-engineering Hydra's persistence layer by adopting a transient OAuth2 flow, thus reducing database write traffic by passing AEAD-encoded state between parties instead of storing it in the database. This shift, alongside the introduction of improved database indices, resulted in a dramatic decrease in CPU usage and a reduction in database interactions by 4-5 times while halving database writes. Benchmarks on Microsoft Azure demonstrated that these changes enable Hydra to handle up to 1090 logins per second at peak times, showcasing the server's increased scalability and responsiveness. The Ory team plans to continue optimizing the software to further boost throughput on single PostgreSQL nodes, making Ory Hydra an attractive option for building scalable OAuth2 servers.

Ory offers a suite of open-source solutions aimed at empowering SaaS products to become enterprise-ready by addressing security, scalability, and compliance challenges. Initially developed to alleviate the burden on developers who face increasing responsibilities and cybersecurity threats, Ory's tools help startups meet enterprise demands without diverting focus from core product development. Key offerings include SAML Single Sign-On (SSO), Directory Sync, and Audit Logs, which streamline user management, enhance security, and ensure compliance by centralizing access control and monitoring user actions. Additionally, the Privacy Vault secures sensitive data, and the Admin Portal facilitates management of these features through a user-friendly interface. By integrating these off-the-shelf solutions, companies can reduce engineering costs and accelerate time to market, making them more attractive to enterprise clients who prioritize security and compliance.

Ory has launched a major upgrade to its Ory Console, the central administration tool of Ory Network, featuring a visual redesign, improved navigation, and a suite of new functionalities aimed at optimizing administrative tasks. The updated console introduces a stats and metrics feature that offers insights into customer events and user interactions, with future plans to expand these metrics for enhanced data-driven decision-making. Enhancements in the onboarding process include simplified configuration of authentication settings, social sign-in, and Account Experience theming, facilitating the development of secure applications. Additionally, users can now configure Ory Actions, such as webhooks, directly through the console to customize workflows, implement additional validation, and integrate with other systems, promising a transformative impact on identity management processes.

Ory Kratos v1.0 has been released as a major update to the identity and authentication system, reflecting its stability, reliability, and extensive real-world use, including processing over 100 million API requests daily. The release introduces features like social login and single-sign-on support via OpenID Connect, enhanced session management, support for multi-region deployments, and improved performance and stability. It guarantees backwards compatibility within the v1 series, ensuring seamless integration for developers and organizations. The system has gained trust from notable adopters such as Back Market and OVHcloud, showcasing its capability to handle complex authentication needs. The Ory community's contributions have been pivotal in reaching this milestone, and the release promises a robust and feature-rich authentication solution for developers and businesses, with dedicated support for self-hosted solutions and a commitment to user feedback.

Ory Network Edge Sessions optimize application performance and scalability by leveraging Cloudflare's global network infrastructure, which reduces latency through smart caching strategies that validate sessions at the nearest geographical node, resulting in low response times and a seamless user experience. This approach is particularly beneficial for identity management and access control, offering a P95 latency of approximately 60ms and a P99 latency of 70ms globally. Designed to handle increasing traffic and concurrent sessions, Ory Network enhances scalability by distributing session data across multiple nodes, thus eliminating performance bottlenecks and supporting organizational growth. Security is fortified through encrypted smart caching, reducing the need for frequent database access, while robust expiration and invalidation mechanisms protect against unauthorized access and session hijacking. Additionally, by storing session data at edge nodes, the load on servers and databases is minimized, leading to optimized resource utilization and improved system performance, even during peak usage periods. Ory Network offers a comprehensive identity management solution that excels in performance, scalability, and security, available on all its paid plans.

Ory's Security Building Blocks for Developers are designed to address the growing challenges of application security in a landscape increasingly complicated by no-code and low-code applications, as well as generative AI. By focusing on the concept of Minimum Viable Security (MVS), Ory provides developers with open-source tools that simplify the integration of essential security measures, allowing for the rapid development and deployment of secure software. These building blocks facilitate comprehensive security frameworks by combining various components such as secure authentication, real-time synchronization, compliant logging, and encrypted storage, which collectively strengthen the security posture of applications. Ory's innovative approach not only accelerates time-to-market but also democratizes secure development, enabling developers to meet compliance standards while implementing robust security measures. By bridging the gap between compliance and security, Ory empowers businesses to protect sensitive data and systems, ultimately contributing to a safer internet environment.