How to enrich id_token with roles from Ory Keto?

[Catzilla]

Hi

I want to use Ory Keto for assigning roles to users (regular user, vip, writer, moderator, admin, etc). Each user can have multiple roles.
In my app I use Ory Kratos for authentication, and Ory Oathkeeper for generation JWT token used by backend.
Backend is a third-party solution, that requires user roles to be passed as array in JWT token claims.

Currently I use following Oathkeeper configuration:

authenticators:
  cookie_session:
    enabled: true
    config:
      check_session_url: http://kratos-public.production.svc.cluster.local/sessions/whoami
      preserve_path: true
      extra_from: "@this"
      subject_from: identity.id
      only:
        - ory_kratos_session
  anonymous:
    enabled: true
    config:
      subject: anonymous
authorizers:
  allow:
    enabled: true
mutators:
  id_token:
    enabled: true
    config:
      issuer_url: http://oathkeeper-api.production.svc.cluster.local:4456
      jwks_url: file:///etc/secrets/mutator.id_token.jwks.json
      claims: |
        {
          "roles": {{ if eq .Subject "anonymous" }}["anonymous"]{{ else }}["user"]{{ end }}
        }

How can I request user roles from Ory Keto, and enrich roles token claim with them?

I found hydrator mutator, but it requires specific request/response format, that cannot be changed with jsonnet or something similar.

Can someone point me in the right direction?
Many thanks

[vinckr]

Hello @Catzilla

Check out this example https://github.com/ory/examples/tree/master/oathkeeper/11-kratos-keto

Let me know if it helps.