---
id: w4/m9/t001
title: Kratos↔Hydra native bridge — oauth2_provider.url + Hydra urls.login/consent
worker: worker4
status: done
estimate: 45m
depends_on: []
---

## Objective

Wire the official Kratos↔Hydra integration so **Kratos itself** handles Hydra's
login challenges: set `oauth2_provider.url` (→ hydra-admin) in Kratos's config,
and point Hydra's `urls.login` at the dashboard login page and `urls.consent`
at the consent acceptor (t003) — in both the base (prod) and local overlays.

## Context

- Kratos native integration: `oauth2_provider.url: http://hydra-admin.auth.svc:4445`
  (+ `override_return_to: true`) makes Kratos fetch/accept Hydra login requests
  itself when a flow carries `login_challenge`; with an existing session and
  `skip=true` it accepts without showing UI.
- Hydra: `urls.login: https://dashboard.bex.co/auth/login`,
  `urls.consent: https://dashboard.bex.co/auth/consent` (t003's route); local
  overlay uses the local hosts.
- Files: `deploy/gitops/base/values/kratos.values.yaml`,
  `deploy/gitops/overlays/local/values/kratos.values.yaml`,
  `deploy/gitops/base/values/hydra.values.yaml`,
  `deploy/gitops/overlays/local/values/hydra.values.yaml`.
- Guardrail: no custom login provider anywhere (`DO_NOT_DO.md`).

## Steps

1. Add `oauth2_provider.url` (+ `override_return_to: true`) to Kratos base values; local overlay override if the admin DNS differs.
2. Add Hydra `urls.login`/`urls.consent` pointing at the dashboard (base = prod hosts, local overlay = local hosts).
3. Sanity: helm-template/kustomize render both overlays; values parse.

## Files

- `deploy/gitops/base/values/{kratos,hydra}.values.yaml`
- `deploy/gitops/overlays/local/values/{kratos,hydra}.values.yaml`

## Acceptance criteria

- [x] Rendered Kratos config carries `oauth2_provider.url`; Hydra carries the dashboard `urls.login`/`urls.consent` in both overlays.
- [x] No new services/providers introduced — config only.

## Out of scope

- Dashboard param passthrough (t002); the consent route itself (t003).
