Limiting access to Registration

[Mshivam2409]

Hi All!
I am currently using ORY Kratos for my organization. Currently, only a selected list of people would be allowed to register, i.e. I have a list of email addresses that can be registered. All others must be rejected. Is it possible to do the same currently?

[Benehiko]

Hi,
So you want them to manually register, but you already have the list of emails?

[Mshivam2409]

Yup!! Only who want to avail the service can register.
To give more reference, only "students" of our college should be allowed to register. We already have their mail list.

[Benehiko]

So why not have a script which calls the Admin API to create all the accounts (since you have the emails) and then allow the end-user to complete the registration using the recovery link flow (such as setting a password). This way you won't have a "register" page asking the user for their email - the email will be implied by the session cookie.

[Mshivam2409]

I thought exactly about that. I just wanted to remove all the auth/signup logic from my service.

[Mshivam2409]

Also, I had a bit of confusion why kratos gives port 4433 in the LoginFlow Result
Kratos Config

session:
  lifespan: 24h
serve:
  public:
    base_url: http://127.0.0.1:3001/.ory/kratos/public
  admin:
    base_url: http://kratos:4434/
selfservice:
  default_browser_return_url: http://127.0.0.1:3000/
  whitelisted_return_urls:
    - http://127.0.0.1:3000
  flows:
    error:
      ui_url: http://127.0.0.1:3000/error
    settings:
      ui_url: http://127.0.0.1:3000/settings
      privileged_session_max_age: 15m
    recovery:
      enabled: true
      ui_url: http://127.0.0.1:3000/recovery
    verification:
      enabled: true
      ui_url: http://127.0.0.1:3000/verify
      after:
        default_browser_return_url: http://127.0.0.1:3000/
    logout:
      after:
        default_browser_return_url: http://127.0.0.1:3000/
    login:
      ui_url: http://127.0.0.1:3000/login
    registration:
      ui_url: http://127.0.0.1:3000/registration
      after:
        password:
          hooks:
            - hook: session
log:
  level: debug
  leak_sensitive_values: true
secrets:
  cookie:
    - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
hashers:
  argon2:
    parallelism: 1
    memory: 131072
    iterations: 2
    salt_length: 16
    key_length: 16
identity:
  default_schema_url: file:///etc/config/kratos/identity.traits.schema.json
courier:
  smtp:
    connection_uri: smtps://test:test@mailslurper:1025/?skip_ssl_verify=true

Oathkeeper Rules

- id: "ory:kratos:public"
  upstream:
    preserve_host: true
    url: "http://kratos:4433"
    strip_path: /.ory/kratos/public
  match:
    url: "http://<**>/.ory/kratos/public/<**>"
    methods:
      - GET
      - POST
      - PUT
      - DELETE
      - PATCH
  authenticators:
    - handler: noop
  authorizer:
    handler: allow
  mutators:
    - handler: noop

NGINX Conf

server {
    listen 3001;
    proxy_hide_header "Access-Control-Allow-Origin";
    add_header 'Access-Control-Allow-Origin' 'http://127.0.0.1:3000' always;
    add_header 'Access-Control-Allow-Credentials' 'true' always;
    add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range' always;
    add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH' always;

    location / {
        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Max-Age' 1728000;
            add_header 'Content-Type' 'text/plain; charset=utf-8';
            add_header 'Content-Length' 0;
            return 204;
        }
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_cache_bypass $http_upgrade;
        proxy_pass http://oathkeeper:4455;
    }

    access_log /var/log/nginx/gateway.access.log main;
    error_log /var/log/nginx/gateway.error.log;
}

However when I do curl http://127.0.0.1:3001/.ory/kratos/public/self-service/login/flows?id=e5a83f6f-a0c2-4cd0-b65f-d4ca31670981 I get

{"id":"e5a83f6f-a0c2-4cd0-b65f-d4ca31670981","type":"browser","expires_at":"2021-02-19T07:41:04.8308516Z","issued_at":"2021-02-19T06:41:04.8308516Z","request_url":"http://127.0.0.1/self-service/login/browser","messages":null,"methods":{"password":{"method":"password","config":{"action":"http://127.0.0.1:4433/self-service/login/methods/password?flow=e5a83f6f-a0c2-4cd0-b65f-d4ca31670981","method":"POST","fields":[{"name":"identifier","type":"text","required":true,"value":""},{"name":"password","type":"password","required":true},{"name":"csrf_token","type":"hidden","required":true,"value":"uVgJR+JwAeyrqOWtnCynutfkVCYECVvxlZh9wzohTZEJ8OLfuL3uHmzlJt/A34AxudmLAGOaZ89P5lq+6som7w=="}]}}},"forced":false}

How do I get the action URL to point to the right place?

[Benehiko]

can you give me your oathkeeper rules file as well?
nvm saw it now

[vinckr]

I believe this is the culprit
(from your docker-compose):

  kratos:
    depends_on:
      - kratos-migrate
    image: oryd/kratos:v0.5.5-alpha.1-sqlite
    ports:
      - "4433:4433" # public   <--- port for your public endpoint
      - "4434:4434" # admin
    restart: unless-stopped

[Benehiko]

Maybe instead of wildcards for the host + port in oathkeeper, try the actual oathkeeper server host and port?
Gonna be honest, this is a tricky one to find.

- id: "ory:kratos:public"
  upstream:
    preserve_host: true
    url: "http://kratos:4433"
    strip_path: /.ory/kratos/public
  match:
    url: "http://127.0.0.1:4455/.ory/kratos/public/<**>"
    methods:
      - GET
      - POST
      - PUT
      - DELETE
      - PATCH
  authenticators:
    - handler: noop
  authorizer:
    handler: allow
  mutators:
    - handler: noop

[Mshivam2409]

Disabling the port on docker worked for me! Thanks a lot! @Benehiko @vinckr
I wanted to add I would be building a react app for my , is there someway I could contribute to implementing a sample react app for kratos?

[vinckr]

Actually yes, we have an issue open for this:
Implement React SPA sample app: #668
Happy to help out if you get stuck or need clarification on something, you can contact me in the Slack or via email.

Ps:
Would you mind posting your solution as a reply and marking it as answer?