mystiq
/
dex
Archived
4
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity
This repository has been archived on 2022-08-17. You can view files and clone it, but cannot push or open issues or pull requests.
366 Commits 27 Branches 73 Tags 23 MiB
Go 97.8%
CSS 0.6%
HTML 0.6%
Makefile 0.5%
Dockerfile 0.2%
Other 0.2%
Go to file
Eric Chiang 72a431dd4b {web,server}: use html/template and reduce use of auth request ID 
Switch from using "text/template" to "html/template", which provides
basic XSS preventions. We haven't identified any particular place
where unsanitized user data is rendered to the frontend. This is
just a preventative step.

At the same time, make more templates take pure URL instead of
forming an URL themselves using an "authReqID" argument. This will
help us stop using the auth req ID in certain places, preventing
garbage collection from killing login flows that wait too long at
the login screen.

Also increase the login session window (time between initial
redirect and the user logging in) from 30 minutes to 24 hours,
and display a more helpful error message when the session expires.

How to test:

1. Spin up dex and example with examples/config-dev.yaml.
2. Login through both the password prompt and the direct redirect.
3. Edit examples/config-dev.yaml removing the "connectors" section.
4. Ensure you can still login with a password.

(email/password is "admin@example.com" and "password")
 		2017-02-02 11:11:00 -08:00
Documentation Documentation: add docs on patch release process. 2017-01-17 11:49:09 -08:00
api api: adding a gRPC call for listing passwords. 2016-11-17 16:56:54 -08:00
cmd Allow CORS on keys and token endpoints 2017-01-14 21:15:51 +01:00
connector connector: add a SAML connector 2017-01-09 18:30:58 -08:00
examples replace bcrypt hash with a working one 2016-12-20 15:21:05 +01:00
scripts sh has no arrays 2016-12-22 14:29:04 +01:00
server {web,server}: use html/template and reduce use of auth request ID 2017-02-02 11:11:00 -08:00
storage server: add at_hash claim support 2017-01-13 10:05:24 -08:00
vendor vendor: revendor 2017-01-09 18:30:58 -08:00
version *: determine version from git 2016-08-09 14:38:09 -07:00
web {web,server}: use html/template and reduce use of auth request ID 2017-02-02 11:11:00 -08:00
.gitignore *: prepare build scripts for a release 2016-10-05 23:43:44 -07:00
.travis.yml *: update travis to use Go 1.7.4. 2016-12-01 20:28:21 -08:00
DCO *: add DCO and LICENSE 2016-10-13 11:33:32 -07:00
Dockerfile *: add theme based frontend configuration 2016-11-30 17:20:21 -08:00
LICENSE *: add DCO and LICENSE 2016-10-13 11:33:32 -07:00
Makefile server: update refresh tokens instead of deleting and creating another 2017-01-11 12:07:48 -08:00
README.md *: wire up SAML POST binding 2017-01-09 18:30:58 -08:00
glide.lock vendor: revendor 2017-01-09 18:30:58 -08:00
glide.yaml connector: add a SAML connector 2017-01-09 18:30:58 -08:00
glide_test.go *: add 'make revendor' and tests to catch incorrect glide usage 2016-12-22 11:52:24 -08:00

README.md

dex - A federated OpenID Connect provider

Travis GoDoc Go Report Card

logo

Dex is an OpenID Connect server that connects to other identity providers. Clients use a standards-based OAuth2 flow to login users, while the actual authentication is performed by established user management systems such as Google, GitHub, FreeIPA, etc.

OpenID Connect is a flavor of OAuth that builds on top of OAuth2 using the JOSE standards. This allows dex to provide:

  • Short-lived, signed tokens with standard fields (such as email) issued on behalf of users.
  • "well-known" discovery of OAuth2 endpoints.
  • OAuth2 mechanisms such as refresh tokens and revocation for long term access.
  • Automatic signing key rotation.

Standards-based token responses allows applications to interact with any OpenID Connect server instead of writing backend specific "access_token" dances. Systems that can already consume ID Tokens issued by dex include:

Kubernetes + dex

Dex's main production use is as an auth-N addon in CoreOS's enterprise Kubernetes solution, Tectonic. Dex runs natively on top of any Kubernetes cluster using Third Party Resources and can drive API server authentication through the OpenID Connect plugin. Clients, such as the Tectonic Console and kubectl, can act on behalf users who can login to the cluster through any identity provider dex supports.

More docs for running dex as a Kubernetes authenticator can be found here.

Documentation

Getting help

  • For bugs and feature requests (including documentation!), file an issue.
  • For general discussion about both using and developing dex, join the dex-dev mailing list.
  • For more details on dex development plans, check out the GitHub milestones.