You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
### CIAM (Customer Identity and Access Management)
32
35
@@ -38,6 +41,9 @@ Your company sells products or services directly to individual consumers.
38
41
- Privacy compliance (GDPR, CCPA)
39
42
- High-scale performance for millions of users
40
43
44
+
</TabItem>
45
+
<TabItemvalue="B2B">
46
+
41
47
### B2B (Business-to-Business)
42
48
43
49
Your company sells products or services directly to other businesses rather than individual consumers. Your customers are organizations
@@ -51,6 +57,8 @@ that use these products or services to run their own operations.
51
57
- Role-based permissions and API controls
52
58
- Privacy compliance (GDPR, CCPA)
53
59
- High-scale performance for millions of users
60
+
</TabItem>
61
+
<TabItemvalue="Workforce">
54
62
55
63
### Workforce (Business-to-Enterprise)
56
64
@@ -67,6 +75,8 @@ existing enterprise identity providers and other 3rd party systems, and streamli
67
75
- Zero-trust security, MFA, and SSO for enterprise applications
68
76
- Privacy compliance (GDPR, CCPA)
69
77
- High-scale performance for millions of users
78
+
</TabItem>
79
+
<TabItemvalue="Agentic AI">
70
80
71
81
### Agentic AI
72
82
@@ -76,28 +86,30 @@ clients (AI applications) that discover and use those resources.
76
86
#### Key IAM requirements
77
87
- Standardized protocol that works across many tools and data sources
78
88
- Built-in authentication and access control
89
+
</TabItem>
90
+
</Tabs>
79
91
80
92
## Map all identity flows in your application
81
93
82
-
Build a complete picture of every identity-related process in your system. Use your IAM scenario’s Key IAM requirements to identify
94
+
Document every identity-related (authentication and authorization) process in your system. Use your IAM scenario’s Key IAM requirements to identify
83
95
these flows. This ensures you don’t miss critical flows during migration.
84
96
85
97
1. Identify all entry points where an identity-related process occurs (e.g., web app login, mobile app sign-in, API tokens, social or enterprise sign-ins).
86
98
1. Create a comprehensive inventory of flows, for example:
87
-
- Registration/sign-up
88
-
- Sign-in/sign-out
99
+
- Registration
100
+
- Sign-in and sign-out
89
101
- Multi-Factor Authentication (MFA)
90
102
- Password reset and account recovery
91
103
- Account linking (social, enterprise logins)
92
104
- User profile management
93
105
- Token refresh and session handling
94
106
- Recovery flows, consent screens, or partner-specific integrations
95
107
1. Create flow diagrams (sequence diagrams or flow charts) to surface dependencies and hidden complexity.
96
-
1. Note where identity-related (authentication and authorization) processes interact with other systems (databases, CRMs, partner apps, or external APIs).
108
+
1. Note where identity-related processes interact with other systems (databases, CRMs, partner apps, or external APIs).
97
109
98
-
At the end of this process you should have a living document with diagrams that capture:
110
+
At the end of this process you should have a living document (one that you'll update as you discover more) with diagrams that capture:
99
111
100
-
- All identity-related (authentication and authorization) flows
Copy file name to clipboardExpand all lines: docs/migrate-to-ory/migrate/integrate-backend.mdx
+10-9Lines changed: 10 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,11 +6,11 @@ sidebar_position: 1
6
6
---
7
7
8
8
When the frontend makes an API call to your backend, it will include the necessary cookies. Your backend must then forward these
9
-
cookies when calling the Ory API to validate the session. For example in a Go backend, you could use a
9
+
cookies when calling the Ory API to validate the session. For example, in a Go backend, you could use a
10
10
[middleware](../../getting-started/integrate-auth/go#validate-and-login) to intercept API requests and validate the session by
11
-
calling Ory’s toSession() method. Ensure that the cookies received from the front end are forwarded in this call. Since backend
12
-
calls to Ory’s API won’t automatically include cookies, you must manually attach the relevant cookies to these requests. This is
13
-
important for the backend to be able to check the session.
11
+
calling Ory’s `toSession()` method. Ensure that the cookies received from the frontend are forwarded in this call. Since backend
12
+
calls to Ory’s API won’t automatically include cookies, you must manually attach the relevant cookies to these requests. This
13
+
allows the backend to validate the session.
14
14
15
15
When using Ory to manage identities, it is best practice to store business logic in your application database and keep only
16
16
authentication-relevant data in Ory. Here’s a general approach:
@@ -21,8 +21,9 @@ authentication-relevant data in Ory. Here’s a general approach:
21
21
link Ory-managed identities with your business logic.
22
22
1. Establish a connection between the Ory identity and the user record in your database by storing the `user.id` in
23
23
`identity.metadata_public.id`. This ensures that subsequent API calls can easily map the Ory identity to the correct internal
24
-
user. More about metadata in the [Identity metadata & traits ](../../kratos/manage-identities/managing-users-identities-metadata)
25
-
documentation.
26
-
1. Now when the frontend makes API calls containing the Ory cookie or token, the backend should verify the session using the
27
-
whoami API endpoint. This endpoint returns the session details, including the identity, allowing the backend to authenticate
28
-
the request and link it to the internal user record.
24
+
user. See [Identity metadata & traits ](../../kratos/manage-identities/managing-users-identities-metadata) documentation for details.
25
+
1. When the frontend makes API calls containing the Ory cookie or token, the backend should verify the session using the
26
+
[`whoami`](https://www.ory.com/docs/kratos/reference/api#tag/frontend/operation/toSession) API endpoint. This endpoint returns the session details, including the identity, allowing the backend to authenticate
27
+
the request and link it to the internal user record.
0 commit comments