README
¶
dex - A federated OpenID Connect provider
Dex is an OpenID Connect server that connects to other identity providers. Clients use a standards-based OAuth2 flow to login users, while the actual authentication is performed by established user management systems such as Google, GitHub, FreeIPA, etc.
OpenID Connect is a flavor of OAuth that builds on top of OAuth2 using the JOSE standards. This allows dex to provide:
- Short-lived, signed tokens with standard fields (such as email) issued on behalf of users.
- "well-known" discovery of OAuth2 endpoints.
- OAuth2 mechanisms such as refresh tokens and revocation for long term access.
- Automatic signing key rotation.
Standards-based token responses allows applications to interact with any OpenID Connect server instead of writing backend specific "access_token" dances. Systems that can already consume ID Tokens issued by dex include:
Kubernetes + dex
Dex's main production use is as an auth-N addon in CoreOS's enterprise Kubernetes solution, Tectonic. Dex runs natively on top of any Kubernetes cluster using Third Party Resources and can drive API server authentication through the OpenID Connect plugin. Clients, such as the Tectonic Console and kubectl, can act on behalf users who can login to the cluster through any identity provider dex supports.
More docs for running dex as a Kubernetes authenticator can be found here.
Documentation
- Getting started
- What's new in v2
- Storage options
- Intro to OpenID Connect
- gRPC API
- Using Kubernetes with dex
- Identity provider logins
- Client libraries
Getting help
- For bugs and feature requests (including documentation!), file an issue.
- For general discussion about both using and developing dex, join the dex-dev mailing list.
- For more details on dex development plans, check out the GitHub milestones.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package api is a generated protocol buffer package.
|
Package api is a generated protocol buffer package. |
|
cmd
|
|
|
Package connector defines interfaces for federated identity strategies.
|
Package connector defines interfaces for federated identity strategies. |
|
github
Package github provides authentication strategies using GitHub.
|
Package github provides authentication strategies using GitHub. |
|
ldap
Package ldap implements strategies for authenticating using the LDAP protocol.
|
Package ldap implements strategies for authenticating using the LDAP protocol. |
|
mock
Package mock implements connectors which help test various server components.
|
Package mock implements connectors which help test various server components. |
|
oidc
Package oidc implements logging in through OpenID Connect providers.
|
Package oidc implements logging in through OpenID Connect providers. |
|
Package server implements an OpenID Connect server with federated logins.
|
Package server implements an OpenID Connect server with federated logins. |
|
Package storage defines the storage interface and types used by the server.
|
Package storage defines the storage interface and types used by the server. |
|
conformance
Package conformance provides conformance tests for storage implementations.
|
Package conformance provides conformance tests for storage implementations. |
|
kubernetes
Package kubernetes provides a storage implementation using Kubernetes third party APIs.
|
Package kubernetes provides a storage implementation using Kubernetes third party APIs. |
|
kubernetes/k8sapi
Package k8sapi holds vendored Kubernetes types.
|
Package k8sapi holds vendored Kubernetes types. |
|
memory
Package memory provides an in memory implementation of the storage interface.
|
Package memory provides an in memory implementation of the storage interface. |
|
sql
Package sql provides SQL implementations of the storage interface.
|
Package sql provides SQL implementations of the storage interface. |
|
Package version contains version information for this app.
|
Package version contains version information for this app. |