{
 "slug": "ory",
 "name": "Ory",
 "tagline": "OAuth 2.0 / OpenID Connect provider and identity management with Hydra and Kratos",
 "category": "security-identity",
 "use_cases": [
  "oauth2",
  "oidc",
  "identity-provider"
 ],
 "aliases": [
  "ory hydra",
  "ory kratos"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Ory Corp",
  "url": "https://www.ory.com",
  "license": "Apache-2.0",
  "license_url": "https://github.com/ory/hydra/blob/master/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   22,
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "26.2.0",
   "last_build": "2026-09-04",
   "entity_id": "prod-sjqmgip53oypm",
   "ami_alias": "/aws/service/marketplace/prod-sjqmgip53oypm/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-jeineg2v6wlxk",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "26.2.0",
   "last_build": "2026-08-07",
   "offer_id": "ory",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:ory:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.ory?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/ory/",
  "json": "https://lynxroute.com/products/ory/product.json"
 },
 "release_notes": [
  {
   "version": "26.2.0",
   "title": "Ory v26.2.0",
   "notes": "* Re-release of Ory Hydra and Ory Kratos 26.2.0. The application version is unchanged; this build refreshes the underlying operating system image\n* No credentials baked into the image - every secret, both database passwords and the per-instance TLS certificate are generated on this instance at first launch and written to /root/ory-credentials.txt\n* Self-registration closes automatically once the first account is created, so the instance cannot be claimed by a stranger\n* Certbot pre-installed for a trusted certificate in one command\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n* CVE-scanned before release; SBOM (CycloneDX); IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-07"
   }
  },
  {
   "version": "26.2.0",
   "title": "Ory 26.2.0 - Initial release (August 2026)",
   "notes": "* Ory Hydra 26.2.0 and Ory Kratos 26.2.0 on Ubuntu 24.04 LTS - an OpenID Certified OAuth 2.0 and OpenID Connect provider paired with identity and user management, wired together so the identity server drives the OAuth2 login and consent screens\n* Includes the official Ory reference login UI, serving registration, login, account settings, consent and logout on the same origin as the API\n* Bundled PostgreSQL 17 with a separate database and role per service - a complete self-contained deployment, no external database required\n* Database schemas are migrated on this instance at first launch, before either service starts\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* No credentials baked into the image - every secret, both database passwords and the per-instance TLS certificate are generated at first launch and written to /root/ory-credentials.txt\n* Self-registration closes automatically once the first account is created\n* Both administrative APIs bound to the loopback interface and blocked externally, as Ory documents\n* HTTPS perimeter on 443 with a per-instance certificate generated at first launch\n* PostgreSQL bound to 127.0.0.1 only and blocked externally in the firewall\n* Login and consent screens cannot be framed (X-Frame-Options DENY)\n* Anonymous usage reporting switched off in both services\n* Certbot pre-installed for a trusted certificate in one command\n* ory-set-domain moves the instance onto your own hostname so the OpenID Connect issuer follows, and enables passkeys\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-07"
   }
  }
 ],
 "release_history": [
  {
   "version": "26.2.0",
   "aws": "2026-09-04",
   "azure": "2026-08-07"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-sjqmgip53oypm/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer ory --plan payg-gen2\naz vm create -g my-rg -n ory --size Standard_D2s_v3 \\\n  --image lynxroute:ory:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Ory is an open-source identity stack. This image runs two of its servers wired together so they behave as one product. Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider written in Go: it issues access, refresh and ID tokens for your applications and supports the authorization code, client credentials, refresh, device and token-exchange flows, publishing a standard discovery document and JWKS. Hydra holds no user accounts of its own by design. Ory Kratos supplies them - registration, login, account settings, TOTP two-factor, recovery codes and session management, all API-first. The official Ory reference user interface renders the login, registration, settings and consent screens for both, so an application points at one discovery URL and is done. Accounts, OAuth2 clients, tokens and sessions persist in a bundled PostgreSQL 17, with a separate database and role per service. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* No credentials in the image - both database passwords, the token-signing and cookie secrets and the encryption key are generated on your own instance at first launch and written to /root/ory-credentials.txt\n* Both administrative APIs bound to 127.0.0.1 only - Ory ships them without authentication by design, so they are also blocked in the firewall and never exposed through the HTTPS perimeter\n* Self-registration closes itself once the first account exists, so nobody else can claim your identity server\n* Database schemas are migrated on the instance at first launch, before either service starts\n* HTTPS perimeter on 443 with a per-instance certificate generated at first launch; Certbot pre-installed for a CA-signed one\n* PostgreSQL 17 bound to 127.0.0.1 only, scram-sha-256, no trust rule\n* Login and consent screens cannot be framed (X-Frame-Options DENY)\n* Anonymous usage reporting switched off in both services\n* CVE scan - every image is scanned for vulnerabilities before release\n* UFW firewall - only 22, 80 and 443 open; every Ory service port and PostgreSQL blocked\n* fail2ban, AppArmor\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nSIGN-IN METHODS\n\nOn by default: passwords, authenticator-app two-factor and single-use recovery codes.\nPasskeys and WebAuthn are enabled by the included ory-set-domain command once you point a\ndomain name at the instance - the WebAuthn standard requires a domain and does not accept an\nIP address. Email login codes, account recovery and email verification need an SMTP server of\nyour own; social sign-in needs your own provider credentials."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}