ory polis as a sso service provider and ory kratos for session management

[Sourabh19Avalara]

I want to know whether we can use Ory Polis as an SSO service provider and Ory Kratos for session management.?

• From what I see, Ory Kratos only supports login_hint, hd, prompt, and auth_type as upstream parameters, but Polis requires tenant/product or client_id for the authorize API call.

• Let’s say I add Polis as an OIDC provider in Kratos. In that case, I need to pass tenant/product in the scope, which means I would need to hardcode the tenant and product. This contradicts the multi-tenancy feature of Polis.

• Another option is to register every tenant separately, but in that case, I would need to restart Kratos after every update, which I don’t want to do.

How can we resolve this issue?

[vinckr]

Hello @Sourabh19Avalara

the easiest way to solve it is using Ory Kratos Organizations - this is a feature that is only available on Ory Network - the managed service - or the Ory Enterprise License - the commercial self-hosted version of Ory.
This way no Kratos restart is needed — connections are added via API, each tenant is isolated via Kratos Organizations, and Polis handles the SAML complexity.

If you are interested please reach out at https://www.ory.com/contact