Dynamic MFA needed for Hydra with Kratos about hydra HOT 3 OPEN

Maybe this is an option too: instead of a separate instance, make it configurable per client: #3205

from hydra.

Have you seen this: https://www.ory.sh/docs/kratos/mfa/step-up-authentication

Maybe your use case would be much easier if you leave out the OAuth2 part.

What is the reason to involve Hydra? IMHO OAuth2 is overkill for most projects.

Assume we know nothing about what you are trying to do, only thing we know is that you are building a new project in education.

from hydra.

@vinckr Yes I know :).
We will use Kratos as a "federation" hub and the user should be able to choose between Office365 (teachers or employees of our customer), our own legacy IDP and 2 educational OIDC providers (students) so we have one single "identity" server. Our customer has several (external) web apps which needs an identity on a standardized way so they choose OIDC with PKCE.
AFAIK Kratos can connect with OIDC providers but we need Hydra so others can connect to us using OIDC?
For another project, we use Kratos + oauthkeeper but there we have internal apps (behind the api gateway).

from hydra.