Ory

Feature availability

Feature	Support
User management	✅ Full
Organizations	✅ Ory Network only (requires `ORY_API_KEY`)
Audit logs	❌ Not supported

Setup

Run Ory Kratos (self-hosted) or create an Ory Network project

Self-hosted: Download Ory Kratos from ory.sh/download and run it with your identity schema. The admin API listens on port 4434 by default.
Terminal window
```
# Example: run Kratos with Docker
docker run -d \
  -p 4434:4434 \
  oryd/kratos:latest serve --config /etc/config/kratos/kratos.yml
```
Ory Network: Create a project at console.ory.sh. Your project URL is https://<slug>.projects.oryapis.com.
Create an API key (Ory Network only)

In the Ory Console, go to Project Settings → API Keys and create a new personal access token. This enables AUMS to authenticate and also unlocks organization management.

Configure your identity schema

AUMS expects identities to store the email address in traits.email and optionally the name in traits.name.first / traits.name.last. Use the built-in preset://email schema or a custom schema that follows this structure.

{
  "$id": "https://schemas.ory.sh/presets/kratos/identity.email.schema.json",
  "type": "object",
  "properties": {
    "traits": {
      "type": "object",
      "properties": {
        "email": { "type": "string", "format": "email" },
        "name": {
          "type": "object",
          "properties": {
            "first": { "type": "string" },
            "last": { "type": "string" }
          }
        }
      },
      "required": ["email"]
    }
  }
}

Set environment variables

Self-hosted Kratos:

PROVIDER=ory
ORY_ADMIN_URL=http://localhost:4434

Ory Network:

PROVIDER=ory
ORY_ADMIN_URL=https://<your-slug>.projects.oryapis.com
ORY_API_KEY=ory_pat_XXXXXXXXXXXXXXXX

Optional:

ORY_SCHEMA_ID=default   # identity schema ID used when creating users (default: default)

Organizations

Organizations are available on Ory Network only (set ORY_API_KEY to enable). Self-hosted Ory Kratos does not include the organizations API.

When ORY_API_KEY is set, AUMS maps Ory Network organizations to AUMS organizations:

AUMS operation	Ory Network API call
List orgs	`GET /admin/organizations`
Create org	`POST /admin/organizations`
Update org	`PUT /admin/organizations/{id}`
Delete org	`DELETE /admin/organizations/{id}`

User management notes

Identity state — Blocking a user sets the Ory identity state to inactive. Inactive identities cannot log in.
Email verification — Managed via the verifiable_addresses field on the identity. AUMS can mark emails as verified or unverified on create and update.
Display name — Stored in traits.name.first and traits.name.last. Requires your identity schema to include the name object in traits.
Password — Passwords are set via the credentials.password field on create or update. Leave blank to create a passwordless identity (OIDC/WebAuthn only).
Schema ID — AUMS uses ORY_SCHEMA_ID (default: default) when creating identities. Ensure this schema ID exists in your Ory configuration.
Pagination — List results are cursor-based via Ory’s page_token. Total count reflects the current page size only (Ory does not return a global total on all versions).

To protect the AUMS dashboard with Ory SSO, create an OAuth2 client in Ory and configure it as an OIDC provider:

Self-hosted Kratos + Hydra:

AUTH_CLIENT_OPENID_CONFIGURATION_URL=https://your-hydra-instance/.well-known/openid-configuration
AUTH_CLIENT_ID=your-oidc-client-id
AUTH_CLIENT_SECRET=your-oidc-client-secret