You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/migrate-to-ory/migrate/index.mdx
+38-30Lines changed: 38 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,22 +4,24 @@ title: Understand your current IAM system
4
4
sidebar_label: Understand your current IAM system
5
5
sidebar_position: 1
6
6
---
7
+
7
8
# Understand your current IAM system
8
9
9
-
Before you can migrate smoothly, you need a complete picture of how your identity management system works today. This step ensures
10
-
nothing gets missed—from everyday login flows to rare edge cases—and sets the foundation for mapping existing functionality to
11
-
Ory Network's equivalent capabilities.
10
+
Before you can migrate smoothly, you need a complete picture of how your identity management system works today. This step ensures
11
+
nothing gets missed—from everyday login flows to rare edge cases—and sets the foundation for mapping existing functionality to Ory
12
+
Network's equivalent capabilities.
12
13
13
14
:::info Why it matters
14
15
15
-
Mapping your full login lifecycle is the best way to de-risk migration. Your current IAM system may be abstracting away key
16
+
Mapping your full login lifecycle is the best way to de-risk migration. Your current IAM system may be abstracting away key
16
17
functionality without you realizing it. With Ory Network, you gain full control to shape and optimize every flow to your needs.
17
18
:::
18
19
19
20
## Identify your IAM scenario
20
-
Below are example IAM scenarios supported by Ory Network. Use them to identify which scenario best fits your specific IAM needs and
21
-
understand the unique requirements of each approach. Each scenario differs in complexity and implementation needs. Use these IAM
22
-
scenarios to map the identity flows for your application.
21
+
22
+
Below are example IAM scenarios supported by Ory Network. Use them to identify which scenario best fits your specific IAM needs
23
+
and understand the unique requirements of each approach. Each scenario differs in complexity and implementation needs. Use these
24
+
IAM scenarios to map the identity flows for your application.
23
25
24
26
<Tabs
25
27
defaultValue="CIAM"
@@ -36,6 +38,7 @@ scenarios to map the identity flows for your application.
36
38
Your company sells products or services directly to individual consumers.
37
39
38
40
#### Key IAM requirements
41
+
39
42
- Self-service registration, login, and profile management for end users
40
43
- Social login, multi-factor passwordless options, and robust account recovery
41
44
- Privacy compliance (GDPR, CCPA)
@@ -46,8 +49,8 @@ Your company sells products or services directly to individual consumers.
46
49
47
50
### B2B (Business-to-Business)
48
51
49
-
Your company sells products or services directly to other businesses rather than individual consumers. Your customers are organizations
50
-
that use these products or services to run their own operations.
52
+
Your company sells products or services directly to other businesses rather than individual consumers. Your customers are
53
+
organizations that use these products or services to run their own operations.
51
54
52
55
#### Key IAM requirements
53
56
@@ -57,16 +60,18 @@ that use these products or services to run their own operations.
57
60
- Role-based permissions and API controls
58
61
- Privacy compliance (GDPR, CCPA)
59
62
- High-scale performance for millions of users
60
-
</TabItem>
63
+
</TabItem>
61
64
<TabItemvalue="Workforce">
62
65
63
66
### Workforce (Business-to-Enterprise)
64
67
65
-
Your company provides products or services. Your company wants to manage access for a single organization's extended workforce. You want to
66
-
consolidate employee user accounts and identities across multi-tenant brands, applications and systems. You need to seamlessly connect with
67
-
existing enterprise identity providers and other 3rd party systems, and streamline user onboarding, offboarding, and permission management.
68
+
Your company provides products or services. Your company wants to manage access for a single organization's extended workforce.
69
+
You want to consolidate employee user accounts and identities across multi-tenant brands, applications and systems. You need to
70
+
seamlessly connect with existing enterprise identity providers and other 3rd party systems, and streamline user onboarding,
71
+
offboarding, and permission management.
68
72
69
73
#### Key IAM requirements
74
+
70
75
- Streamline onboarding/offboarding of employee, contractor, and temporary workers
71
76
- Role-based access aligned with organizational hierarchy
72
77
- HR system integration with flexible identity schemas
@@ -75,39 +80,42 @@ existing enterprise identity providers and other 3rd party systems, and streamli
75
80
- Zero-trust security, MFA, and SSO for enterprise applications
76
81
- Privacy compliance (GDPR, CCPA)
77
82
- High-scale performance for millions of users
78
-
</TabItem>
83
+
</TabItem>
79
84
<TabItemvalue="Agentic AI">
80
85
81
86
### Agentic AI
82
87
83
-
Your company wants to enable AI applications to securely connect to data sources and tools. For example, servers that host resources and
84
-
clients (AI applications) that discover and use those resources.
88
+
Your company wants to enable AI applications to securely connect to data sources and tools. For example, servers that host
89
+
resources and clients (AI applications) that discover and use those resources.
85
90
86
91
#### Key IAM requirements
92
+
87
93
- Standardized protocol that works across many tools and data sources
88
94
- Built-in authentication and access control
89
-
</TabItem>
95
+
</TabItem>
90
96
</Tabs>
91
97
92
98
## Map all identity flows in your application
93
99
94
-
Document every identity-related (authentication and authorization) process in your system. Use your IAM scenario’s Key IAM requirements to identify
95
-
these flows. This ensures you don’t miss critical flows during migration.
100
+
Document every identity-related (authentication and authorization) process in your system. Use your IAM scenario’s Key IAM
101
+
requirements to identify these flows. This ensures you don’t miss critical flows during migration.
96
102
97
-
1. Identify all entry points where an identity-related process occurs (e.g., web app login, mobile app sign-in, API tokens, social or enterprise sign-ins).
103
+
1. Identify all entry points where an identity-related process occurs (e.g., web app login, mobile app sign-in, API tokens, social
104
+
or enterprise sign-ins).
98
105
1. Create a comprehensive inventory of flows, for example:
99
-
- Registration
100
-
- Sign-in and sign-out
101
-
- Multi-Factor Authentication (MFA)
102
-
- Password reset and account recovery
103
-
- Account linking (social, enterprise logins)
104
-
- User profile management
105
-
- Token refresh and session handling
106
-
- Recovery flows, consent screens, or partner-specific integrations
106
+
- Registration
107
+
- Sign-in and sign-out
108
+
- Multi-Factor Authentication (MFA)
109
+
- Password reset and account recovery
110
+
- Account linking (social, enterprise logins)
111
+
- User profile management
112
+
- Token refresh and session handling
113
+
- Recovery flows, consent screens, or partner-specific integrations
107
114
1. Create flow diagrams (sequence diagrams or flow charts) to surface dependencies and hidden complexity.
108
115
1. Note where identity-related processes interact with other systems (databases, CRMs, partner apps, or external APIs).
109
116
110
-
At the end of this process you should have a living document (one that you'll update as you discover more) with diagrams that capture:
117
+
At the end of this process you should have a living document (one that you'll update as you discover more) with diagrams that
118
+
capture:
111
119
112
120
- All identity-related flows
113
121
- Your system's existing functionality
@@ -120,4 +128,4 @@ This will serve as your blueprint for planning, designing, testing, and validati
120
128
import Help from '@site/docs/_common/need-help.mdx'
Copy file name to clipboardExpand all lines: docs/migrate-to-ory/migrate/integrate-backend.mdx
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ When the frontend makes an API call to your backend, it will include the necessa
9
9
cookies when calling the Ory API to validate the session. For example, in a Go backend, you could use a
10
10
[middleware](../../getting-started/integrate-auth/go#validate-and-login) to intercept API requests and validate the session by
11
11
calling Ory’s `toSession()` method. Ensure that the cookies received from the frontend are forwarded in this call. Since backend
12
-
calls to Ory’s API won’t automatically include cookies, you must manually attach the relevant cookies to these requests. This
12
+
calls to Ory’s API won’t automatically include cookies, you must manually attach the relevant cookies to these requests. This
13
13
allows the backend to validate the session.
14
14
15
15
When using Ory to manage identities, it is best practice to store business logic in your application database and keep only
@@ -21,9 +21,9 @@ authentication-relevant data in Ory. Here’s a general approach:
21
21
link Ory-managed identities with your business logic.
22
22
1. Establish a connection between the Ory identity and the user record in your database by storing the `user.id` in
23
23
`identity.metadata_public.id`. This ensures that subsequent API calls can easily map the Ory identity to the correct internal
24
-
user. See [Identity metadata & traits ](../../kratos/manage-identities/managing-users-identities-metadata) documentation for details.
24
+
user. See [Identity metadata & traits ](../../kratos/manage-identities/managing-users-identities-metadata) documentation for
25
+
details.
25
26
1. When the frontend makes API calls containing the Ory cookie or token, the backend should verify the session using the
26
-
[`whoami`](https://www.ory.com/docs/kratos/reference/api#tag/frontend/operation/toSession) API endpoint. This endpoint returns the session details, including the identity, allowing the backend to authenticate
27
-
the request and link it to the internal user record.
28
-
29
-
27
+
[`whoami`](https://www.ory.com/docs/kratos/reference/api#tag/frontend/operation/toSession) API endpoint. This endpoint returns
28
+
the session details, including the identity, allowing the backend to authenticate the request and link it to the internal user
0 commit comments