Ferrum VS Ory Oathkeeper

Personally, I like KeyCloak and use it where it is possible. About 2 years ago I had to expand my technology stack and I started to write apps using Golang. These apps are WEB API that use Authorization on KeyCloak server. When API grows and become more complicated, it is very important to make automated integration tests. For authorization we using separate from demo/production server, and it is important to make code portable to any machine, therefore the most convenient way is to start all infrastructure before any test and stop when test ends with any persistent data cleanup at the end. Such approach can't be easily and fast implemented using Keycloak. Therefore, we created Ferrum authorization server that could be run and stopped from code and with API compatible with KeyCloak (with similar behavior and endpoints). Ferrum could be used not only for tests purposes but also like a full-fledged authorization server.

Hydra feels mature. I think it's their longest-developed product so far. Besides breaking changes during big upgrades(v0 -> v1beta -> v1), everything has been painless:

- It runs anywhere with or without containers

- API makes sense, good SDKs are available in all my used languages

- RAM usage is surprisingly low compared to usage and has been great for resource-constrained environments

- Stateless means horizontal scaling is as easy as `replicas++`

- Sub-millisecond response times for some calls, much faster than our previous setup

With Hydra, I know it's the client's fault when OAuth calls fail and not just a buggy server implementation. This is reinforced in dev mode with great errors like:

- The authorization code has already been used

- The request is missing the response_type parameter

- Parameter "nonce" must be set when using the implicit flow

- Redirect URL "https://example.com/callback" does not match

On the flipside, Oathkeeper is not a mature product and has not yet reached v1. There are breaking changes planned [1]. It lacks support for at least one popular usecase (mine) out of the box [2]. Rules can be hard to create and debug. I wouldn't recommend Oathkeeper in its current state unless you're ready to dive in and fix things yourself. Once configured it sticks with the Ory trend: fast, lean, and stable.

Depending on your usecase, Oathkeeper could be swapped out with any IAP like Pomerium or just with your reverse proxy's auth request support + some small custom shim.

I haven't tried Keto (access control) or Kratos (user management) yet. Kratos is on my todo list.

[1] https://github.com/ory/oathkeeper/issues/441