SumUp's Self service OIDC for with Ory Hydra and Terraform
summary
SumUp runs Ory Hydra on a highly available Kubernetes cluster (AWS EKS), fronted by Cloudflare and an ingress proxy, and replaces a decentralized ROPC/Opaque-token system with OpenID Connect JWTs. Engineers build a custom Terraform provider that exposes two resources — OAuth2 clients and JWKS keysets — enabling GitOps-style provisioning, automated JWKS rotation via Terraform keepers, Vault-backed secrets, and a Hydra fork adding per-client token TTLs and refresh-token reuse detection.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:44Legacy OIDC server issues
- 3:36Switching to Hydra OIDC
- 8:30Self-service with Terraform
- 14:11Key rotation with Terraform
- 16:00Client metadata tips
- 18:27Terraform module abstraction
- 19:50Conclusion and resources
- 20:12Q&A
related talks
30mRight Place at the Right Time With the Right Token
28mIdentity: From Legacy to Microservices
18mCodify Your JWT-OIDC Vault Auth Method with Terraform
21mCentralized Authentication with Apache APISIX and Ory
21mAutomating Secure OIDC-Based Cross-Cloud Authentication
29mUnify Your OpenStack with Your Identity Provider
54mProtecting API Workloads Against OWASP and Programming Language CVE's
54mWho's your user? OpenID from the ground-up