Correct, it's not that it's limited, it's just different components of ORY stack. Kratos only does identity management and authentication (including being OIDC client). Oathkeeper does Identity Aware Proxy part. Finally, Hydra acts as OAuth 2.0 and OpenID Connect server.
You can use either one of them separately or together. There is also no special glue to...glue them together, so you can use Hydra with different user management or Kratos with different OIDC server - my company at one point used Kratos for all user management, but Hydra was overkill, so we made our own OIDC server.
Comments
Correct, it's not that it's limited, it's just different components of ORY stack. Kratos only does identity management and authentication (including being OIDC client). Oathkeeper does Identity Aware Proxy part. Finally, Hydra acts as OAuth 2.0 and OpenID Connect server.
You can use either one of them separately or together. There is also no special glue to...glue them together, so you can use Hydra with different user management or Kratos with different OIDC server - my company at one point used Kratos for all user management, but Hydra was overkill, so we made our own OIDC server.