You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Márk Sági-Kazár 0b9b588c96
Merge pull request #2089 from flant/remove-go-dev-badge-from-readme
3 days ago
.github chore: add keystone connector icon and bump tests dependencies 1 month ago
api chore(deps): update dependencies 2 weeks ago
cmd/dex feat: add DEX_FRONTEND_DIR env var for setting the frontend dir 4 weeks ago
connector Merge pull request #2036 from flant/keystone-minor-fixes 4 weeks ago
docs chore: rename the docs directory 3 months ago
examples Merge pull request #1899 from lcc3108/master 2 months ago
pkg connectors: refactor filter code into a helper package 2 years ago
scripts chore: add editorconfig 6 months ago
server chore(deps): upgrade protobuf and grpc 4 weeks ago
storage Merge pull request #2089 from flant/remove-go-dev-badge-from-readme 3 days ago
version *: determine version from git 5 years ago
web Merge pull request #2036 from flant/keystone-minor-fixes 4 weeks ago
.dockerignore chore: cleanup ignore files 3 months ago
.editorconfig chore: add new development configuration 3 months ago
.gitignore chore: improve docker-compose setup 3 months ago
.gitpod.yml Fully automate dev setup with Gitpod (#1868) 5 months ago
.golangci.yml Enable unparam, prealloc, sqlclosecheck linters 3 months ago Add flant to 4 months ago
Dockerfile build(deps): bump alpine from 3.13.4 to 3.13.5 6 days ago
LICENSE *: add DCO and LICENSE 5 years ago
MAINTAINERS MAINTAINERS: Update email address for Stephen Augustus 2 months ago
Makefile chore(deps): upgrade protobuf and grpc 4 weeks ago chore: remove go dev badge from README 4 days ago chore: add new development configuration 3 months ago
config.docker.yaml Switch to slim version of a gomplate and add a comment to docker config 2 months ago
config.yaml.dist chore: change frontend dir default to unset 4 weeks ago
docker-compose.override.yaml.dist test(connector/ldap): rewrite tests to use a single server instance 2 months ago
docker-compose.test.yaml test(connector/ldap): rewrite tests to use a single server instance 2 months ago
docker-compose.yaml test(connector/ldap): rewrite tests to use a single server instance 2 months ago Apply suggestions from code review 3 months ago
go.mod build(deps): bump from 1.14.6 to 1.14.7 6 days ago
go.sum build(deps): bump from 1.14.6 to 1.14.7 6 days ago

dex - A federated OpenID Connect provider

GitHub Workflow Status Go Report Card Gitpod ready-to-code


Dex is an identity service that uses OpenID Connect to drive authentication for other apps.

Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend.

ID Tokens

ID Tokens are an OAuth2 extension introduced by OpenID Connect and dex's primary feature. ID Tokens are JSON Web Tokens (JWTs) signed by dex and returned as part of the OAuth2 response that attest to the end user's identity. An example JWT might look like:


ID Tokens contains standard claims assert which client app logged the user in, when the token expires, and the identity of the user.

  "iss": "",
  "sub": "CgcyMzQyNzQ5EgZnaXRodWI",
  "aud": "example-app",
  "exp": 1492882042,
  "iat": 1492795642,
  "at_hash": "bi96gOXZShvlWYtal9Eqiw",
  "email": "",
  "email_verified": true,
  "groups": [
  "name": "Jane Doe"

Because these tokens are signed by dex and contain standard-based claims other services can consume them as service-to-service credentials. Systems that can already consume OpenID Connect ID Tokens issued by dex include:

For details on how to request or validate an ID Token, see "Writing apps that use dex".

Kubernetes and Dex

Dex runs natively on top of any Kubernetes cluster using Custom Resource Definitions and can drive API server authentication through the OpenID Connect plugin. Clients, such as the kubernetes-dashboard and kubectl, can act on behalf of users who can login to the cluster through any identity provider dex supports.

  • More docs for running dex as a Kubernetes authenticator can be found here.
  • You can find more about companies and projects, which uses dex, here.


When a user logs in through dex, the user's identity is usually stored in another user-management system: a LDAP directory, a GitHub org, etc. Dex acts as a shim between a client app and the upstream identity provider. The client only needs to understand OpenID Connect to query dex, while dex implements an array of protocols for querying other user-management systems.

A "connector" is a strategy used by dex for authenticating a user against another identity provider. Dex implements connectors that target specific platforms such as GitHub, LinkedIn, and Microsoft as well as established protocols like LDAP and SAML.

Depending on the connectors limitations in protocols can prevent dex from issuing refresh tokens or returning group membership claims. For example, because SAML doesn't provide a non-interactive way to refresh assertions, if a user logs in through the SAML connector dex won't issue a refresh token to its client. Refresh token support is required for clients that require offline access, such as kubectl.

Dex implements the following connectors:

Name supports refresh tokens supports groups claim supports preferred_username claim status notes
LDAP yes yes yes stable
GitHub yes yes yes stable
SAML 2.0 no yes no stable WARNING: Unmaintained and likely vulnerable to auth bypasses (#1884)
GitLab yes yes yes beta
OpenID Connect yes yes yes beta Includes Salesforce, Azure, etc.
Google yes yes yes alpha
LinkedIn yes no no beta
Microsoft yes yes no beta
AuthProxy no no no alpha Authentication proxies such as Apache2 mod_auth, etc.
Bitbucket Cloud yes yes no alpha
OpenShift no yes no alpha
Atlassian Crowd yes yes yes * beta preferred_username claim must be configured through config
Gitea yes no yes alpha
OpenStack Keystone yes yes no alpha

Stable, beta, and alpha are defined as:

  • Stable: well tested, in active use, and will not change in backward incompatible ways.
  • Beta: tested and unlikely to change in backward incompatible ways.
  • Alpha: may be untested by core maintainers and is subject to change in backward incompatible ways.

All changes or deprecations of connector features will be announced in the release notes.


Reporting a security vulnerability

Due to their public nature, GitHub and mailing lists are NOT appropriate places for reporting vulnerabilities.

Please email the maintainers list to report issues that may be security-related.

Getting help

  • For feature requests and bugs, file an issue.
  • For general discussion about both using and developing Dex: