The list is really helpful for people to navigate, and here is additional context to the complexity topic :)
If you use our managed services (https://console.ory.sh), it is easy to set up and scale because we have a bunch of defaults, UIs, and the security stuff all set up already.
If you run it completely on your own, which does require some skill especially in terms of (security) incident response, it is more work because you have to figure out a few pieces yourself (the stack is agnostic to the environment).
We have an option for self hosting with all the stuff we have built for the SaaS, but it only makes sense for businesses of a certain size.
Complexity also depends on how many services you combine, some people try to use everything at once and it's overwhelming.
What’s making Ory complex for people who do it by themselves, is that Ory is 3 different API first products that work stand alone or in concert. To wire this up, one requires understanding of every service. Here it is easier to spin up a cloud account, or use an alternate project which is e.g. just one docker container.
EDIT: For the record, I'm grateful Ory is open source and wish you all the success in the world. My comments below are specifically for the indiehosting case.
For indiehosting, my threat model is "what are my options if the team behind this software takes it in a direction I don't like?"
For some projects (Redis, Terraform), the answer is that a high quality fork pops up (Valkey, OpenTofu). For others (MongoDB), there's still not a FLOSS alternative included in major package managers.
But even if a fork does appear, they are relatively likely to eventually fall prey to the same incentives that impacted the original.
I try to cut this off at the root, and prefer software I would be confident forking myself. All of the options marked "simple" on my list fall under that category.
Sometimes you can't avoid complicated software, but you often can. For an indiehosted identity server, 5,000-10,000 lines of code provides pretty much all the features I need. I don't think the extra ~100,000-900,000k lines of code of the major players is worth the risk.
Funny, OpenAI is one site where I've noticed that the login is kinda wonky. Every so often it just randomly fails, gets stuck, gets caught in a redirect loop... That may not be Ory's fault, but unfortunately this may not be the ringing endorsement they were hoping for.
If you could share a HAR file (stripped of credentials of course) or a screenshot of your network tab when it happens, we'd love to take a look and figure out what's going on! If it's reproducible even better.
You can send it to aeneas at ory.sh. It may not be OAuth2 related, and I'd like to make sure.
What is going on with the continuous redirects? I think they are pushing users to either sign up and/or pay up and/or disable ublock. What kind of BS is that?
No worries - It forces me to use claude more and I’m cool with that.
Not as bad as their payment provider. So many problems... One of the worst integration I've ever seen. But who knows, maybe it was generated by their chat. That would explain a lot.
My gosh yes please! This is so annoying. Last time I checked it’s impossible to disconnect your email address from Google auth if you used that to sign up. And no way to delete the account and recreate with that email address.
Yeah, the case study is a little hand-wavey, but from hints on the ChatGPT login page, it seems like they still use Auth0 (at least for the free, consumer facing application that I use).
"OpenAI is rapidly building its new identity experiences, having already enabled unprecedented logins per second with levels of data transparency and infrastructure flexibility that were not possible with other vendor solutions."
Maybe they are using Ory for new auth experiences?
I'll be interested to see what pops up here, but you'd probably have better luck joining their slack community and asking there: https://www.ory.sh/community/
If you're looking for something a bit simpler to work with for indiehosting use cases, I maintain a list here:
https://github.com/lastlogin-net/obligator?tab=readme-ov-fil...