dex

module
v0.0.0-...-43a01a0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 26, 2023 License: Apache-2.0

README

dex - A federated OpenID Connect provider

GitHub Workflow Status Go Report Card Gitpod ready-to-code

logo

Dex is an identity service that uses OpenID Connect to drive authentication for other apps.

Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend.

ID Tokens

ID Tokens are an OAuth2 extension introduced by OpenID Connect and dex's primary feature. ID Tokens are JSON Web Tokens (JWTs) signed by dex and returned as part of the OAuth2 response that attest to the end user's identity. An example JWT might look like:

eyJhbGciOiJSUzI1NiIsImtpZCI6IjlkNDQ3NDFmNzczYjkzOGNmNjVkZDMyNjY4NWI4NjE4MGMzMjRkOTkifQ.eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjU1NTYvZGV4Iiwic3ViIjoiQ2djeU16UXlOelE1RWdabmFYUm9kV0kiLCJhdWQiOiJleGFtcGxlLWFwcCIsImV4cCI6MTQ5Mjg4MjA0MiwiaWF0IjoxNDkyNzk1NjQyLCJhdF9oYXNoIjoiYmk5NmdPWFpTaHZsV1l0YWw5RXFpdyIsImVtYWlsIjoiZXJpYy5jaGlhbmdAY29yZW9zLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJncm91cHMiOlsiYWRtaW5zIiwiZGV2ZWxvcGVycyJdLCJuYW1lIjoiRXJpYyBDaGlhbmcifQ.OhROPq_0eP-zsQRjg87KZ4wGkjiQGnTi5QuG877AdJDb3R2ZCOk2Vkf5SdP8cPyb3VMqL32G4hLDayniiv8f1_ZXAde0sKrayfQ10XAXFgZl_P1yilkLdknxn6nbhDRVllpWcB12ki9vmAxklAr0B1C4kr5nI3-BZLrFcUR5sQbxwJj4oW1OuG6jJCNGHXGNTBTNEaM28eD-9nhfBeuBTzzO7BKwPsojjj4C9ogU4JQhGvm_l4yfVi0boSx8c0FX3JsiB0yLa1ZdJVWVl9m90XmbWRSD85pNDQHcWZP9hR6CMgbvGkZsgjG32qeRwUL_eNkNowSBNWLrGNPoON1gMg

ID Tokens contains standard claims assert which client app logged the user in, when the token expires, and the identity of the user.

{
  "iss": "http://127.0.0.1:5556/dex",
  "sub": "CgcyMzQyNzQ5EgZnaXRodWI",
  "aud": "example-app",
  "exp": 1492882042,
  "iat": 1492795642,
  "at_hash": "bi96gOXZShvlWYtal9Eqiw",
  "email": "jane.doe@coreos.com",
  "email_verified": true,
  "groups": [
    "admins",
    "developers"
  ],
  "name": "Jane Doe"
}

Because these tokens are signed by dex and contain standard-based claims other services can consume them as service-to-service credentials. Systems that can already consume OpenID Connect ID Tokens issued by dex include:

For details on how to request or validate an ID Token, see "Writing apps that use dex".

Kubernetes and Dex

Dex runs natively on top of any Kubernetes cluster using Custom Resource Definitions and can drive API server authentication through the OpenID Connect plugin. Clients, such as the kubernetes-dashboard and kubectl, can act on behalf of users who can login to the cluster through any identity provider dex supports.

  • More docs for running dex as a Kubernetes authenticator can be found here.
  • You can find more about companies and projects, which uses dex, here.

Connectors

When a user logs in through dex, the user's identity is usually stored in another user-management system: a LDAP directory, a GitHub org, etc. Dex acts as a shim between a client app and the upstream identity provider. The client only needs to understand OpenID Connect to query dex, while dex implements an array of protocols for querying other user-management systems.

A "connector" is a strategy used by dex for authenticating a user against another identity provider. Dex implements connectors that target specific platforms such as GitHub, LinkedIn, and Microsoft as well as established protocols like LDAP and SAML.

Depending on the connectors limitations in protocols can prevent dex from issuing refresh tokens or returning group membership claims. For example, because SAML doesn't provide a non-interactive way to refresh assertions, if a user logs in through the SAML connector dex won't issue a refresh token to its client. Refresh token support is required for clients that require offline access, such as kubectl.

Dex implements the following connectors:

Name supports refresh tokens supports groups claim supports preferred_username claim status notes
LDAP yes yes yes stable
GitHub yes yes yes stable
SAML 2.0 no yes no stable WARNING: Unmaintained and likely vulnerable to auth bypasses (#1884)
GitLab yes yes yes beta
OpenID Connect yes yes yes beta Includes Salesforce, Azure, etc.
OAuth 2.0 no yes yes alpha
Google yes yes yes alpha
LinkedIn yes no no beta
Microsoft yes yes no beta
AuthProxy no yes no alpha Authentication proxies such as Apache2 mod_auth, etc.
Bitbucket Cloud yes yes no alpha
OpenShift no yes no alpha
Atlassian Crowd yes yes yes * beta preferred_username claim must be configured through config
Gitea yes no yes beta
OpenStack Keystone yes yes no alpha

Stable, beta, and alpha are defined as:

  • Stable: well tested, in active use, and will not change in backward incompatible ways.
  • Beta: tested and unlikely to change in backward incompatible ways.
  • Alpha: may be untested by core maintainers and is subject to change in backward incompatible ways.

All changes or deprecations of connector features will be announced in the release notes.

Documentation

Reporting a vulnerability

Please see our security policy for details about reporting vulnerabilities.

Getting help

  • For feature requests and bugs, file an issue.
  • For general discussion about both using and developing Dex:

Development

When all coding and testing is done, please run the test suite:

make testall

For the best developer experience, install Nix and direnv.

Alternatively, install Go and Docker manually or using a package manager. Install the rest of the dependencies by running make deps.

License

The project is licensed under the Apache License, Version 2.0.

Directories

Path Synopsis
cmd
dex
docker-entrypoint
Package main provides a utility program to launch the Dex container process with an optional templating step (provided by gomplate).
Package main provides a utility program to launch the Dex container process with an optional templating step (provided by gomplate).
Package connector defines interfaces for federated identity strategies.
Package connector defines interfaces for federated identity strategies.
atlassiancrowd
Package atlassiancrowd provides authentication strategies using Atlassian Crowd.
Package atlassiancrowd provides authentication strategies using Atlassian Crowd.
authproxy
Package authproxy implements a connector which relies on external authentication (e.g.
Package authproxy implements a connector which relies on external authentication (e.g.
bitbucketcloud
Package bitbucketcloud provides authentication strategies using Bitbucket Cloud.
Package bitbucketcloud provides authentication strategies using Bitbucket Cloud.
gitea
Package gitea provides authentication strategies using Gitea.
Package gitea provides authentication strategies using Gitea.
github
Package github provides authentication strategies using GitHub.
Package github provides authentication strategies using GitHub.
gitlab
Package gitlab provides authentication strategies using Gitlab.
Package gitlab provides authentication strategies using Gitlab.
google
Package google implements logging in through Google's OpenID Connect provider.
Package google implements logging in through Google's OpenID Connect provider.
keystone
Package keystone provides authentication strategy using Keystone.
Package keystone provides authentication strategy using Keystone.
ldap
Package ldap implements strategies for authenticating using the LDAP protocol.
Package ldap implements strategies for authenticating using the LDAP protocol.
linkedin
Package linkedin provides authentication strategies using LinkedIn
Package linkedin provides authentication strategies using LinkedIn
microsoft
Package microsoft provides authentication strategies using Microsoft.
Package microsoft provides authentication strategies using Microsoft.
mock
Package mock implements connectors which help test various server components.
Package mock implements connectors which help test various server components.
oidc
Package oidc implements logging in through OpenID Connect providers.
Package oidc implements logging in through OpenID Connect providers.
saml
Package saml contains login methods for SAML.
Package saml contains login methods for SAML.
pkg
groups
Package groups contains helper functions related to groups
Package groups contains helper functions related to groups
log
Package log provides a logger interface for logger libraries so that dex does not depend on any of them directly.
Package log provides a logger interface for logger libraries so that dex does not depend on any of them directly.
Package server implements an OpenID Connect server with federated logins.
Package server implements an OpenID Connect server with federated logins.
Package storage defines the storage interface and types used by the server.
Package storage defines the storage interface and types used by the server.
conformance
Package conformance provides conformance tests for storage implementations.
Package conformance provides conformance tests for storage implementations.
ent
kubernetes
Package kubernetes provides a storage implementation using Kubernetes third party APIs.
Package kubernetes provides a storage implementation using Kubernetes third party APIs.
kubernetes/k8sapi
Package k8sapi holds vendored Kubernetes types.
Package k8sapi holds vendored Kubernetes types.
memory
Package memory provides an in memory implementation of the storage interface.
Package memory provides an in memory implementation of the storage interface.
sql
Package sql provides SQL implementations of the storage interface.
Package sql provides SQL implementations of the storage interface.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL