Keto endpoints

[paulfairless]

Hi,

I've started an Ory cloud project, planning to use Kratos and Keto via oathkeeper.

I've successfully managed to ket Kratos integration working but struggling with Keto. I can use the endpoint to create namespaces and relation tuples, but I don't seem to be able to hit the /check endpoint with error Requested url does not match any rules. Is this currently available in Ory Cloud? Tried everything I can think of, any advice how to get this up and running?

Best,
Paul

[aeneasr]

@zepatrik could you lend a hand on Monday? :)

[zepatrik]

In the cloud we have a more recent version running than the latest released. Especially, it already comes with ory/keto@d29d42c
Therefore you have to use the path /relation-tuples/check.

[zepatrik]

keto_engine_acp_ory is compatible with Keto before the zanzibar rewrite, therefore you should use remote_json.

[paulfairless]

Do i need to pass my PAT to that endpoint in oathkeeper call? Getting 401 in oathkeeper. The request works in curl only if i pass my Ory Clout PAT in Authorization header.

Are there any examples for using Oathkeeper with Ory Cloud?

Many Thanks

[aeneasr]

Yes, you'll need to add the PAT to the request, you can set it using the headers config key, see: https://www.ory.sh/docs/oathkeeper/pipeline/authz#remote-configuration

Probably something along the lines of:

# Global configuration file oathkeeper.yml
authorizers:
  remote:
    # Set enabled to "true" to enable the authenticator, and "false" to disable the authenticator. Defaults to "false".
    enabled: true

    config:
      remote: http://my-remote-authorizer/authorize
      headers:
        Authorization: Bearer <your-pat>

[paulfairless]

I don't think that option is available on remote_json? Or do they work together?

[aeneasr]

Oh, my bad, I mixed that up. You're right, that's not available for remote_json. But we can for sure add this option. If you know some Go, this might be a perfect contribution :) If not, we'll set up an issue to track this request!