No description
This repository has been archived on 2022-08-17. You can view files and clone it, but cannot push or open issues or pull requests.
Find a file
Eric Chiang 97d395e351
Merge pull request #1119 from ericchiang/update-go-requirements
*: Go 1.7 no longer supported and updated build image to 1.9
2017-11-08 13:49:08 -08:00
api *: revendor and regenerate protobuf files 2017-04-13 11:35:41 -07:00
cmd storage: add etcd storage 2017-10-31 14:43:13 +00:00
connector Merge pull request #1109 from ericchiang/oidc-test 2017-10-30 11:18:18 -07:00
Documentation Merge pull request #1108 from dqminh/etcd-storage 2017-11-06 08:36:43 -08:00
examples *: add standup script for LDAP 2017-08-22 10:37:29 -07:00
scripts *: Go 1.7 no longer supported and updated build image to 1.9 2017-11-08 13:33:01 -08:00
server connector: implement LinkedIn connector 2017-10-27 12:54:28 +03:00
storage Merge pull request #1108 from dqminh/etcd-storage 2017-11-06 08:36:43 -08:00
vendor vendor etcd dependencies for etcd storage 2017-10-31 14:43:13 +00:00
version *: determine version from git 2016-08-09 14:38:09 -07:00
web Add tectonic-ldap matching rule to ldap icon. Fixes an issue where the ldap icon was missing in the tectonic console. 2017-11-02 15:33:30 -07:00
.dockerignore Replace docker-build script with multi-stage build 2017-09-21 22:08:11 +02:00
.gitignore *: prepare build scripts for a release 2016-10-05 23:43:44 -07:00
.travis.yml Merge pull request #1108 from dqminh/etcd-storage 2017-11-06 08:36:43 -08:00
DCO *: add DCO and LICENSE 2016-10-13 11:33:32 -07:00
Dockerfile *: Go 1.7 no longer supported and updated build image to 1.9 2017-11-08 13:33:01 -08:00
glide.lock vendor etcd dependencies for etcd storage 2017-10-31 14:43:13 +00:00
glide.yaml vendor etcd dependencies for etcd storage 2017-10-31 14:43:13 +00:00
glide_test.go *: add 'make revendor' and tests to catch incorrect glide usage 2016-12-22 11:52:24 -08:00
LICENSE *: add DCO and LICENSE 2016-10-13 11:33:32 -07:00
MAINTAINERS *: update maintainers 2017-04-21 09:39:31 -07:00
Makefile Replace docker-build script with multi-stage build 2017-09-21 22:08:11 +02:00
README.md Documentation: add LinkedIn connector documentation 2017-10-27 12:54:28 +03:00

dex - A federated OpenID Connect provider

Travis GoDoc Go Report Card

logo

Dex is an identity service that uses OpenID Connect to drive authentication for other apps.

Dex is NOT a user-management system, but acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend.

ID Tokens

ID Tokens are an OAuth2 extension introduced by OpenID Connect and dex's primary feature. ID Tokens are JSON Web Tokens (JWTs) signed by dex and returned as part of the OAuth2 response that attest to the end user's identity. An example JWT might look like:

eyJhbGciOiJSUzI1NiIsImtpZCI6IjlkNDQ3NDFmNzczYjkzOGNmNjVkZDMyNjY4NWI4NjE4MGMzMjRkOTkifQ.eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjU1NTYvZGV4Iiwic3ViIjoiQ2djeU16UXlOelE1RWdabmFYUm9kV0kiLCJhdWQiOiJleGFtcGxlLWFwcCIsImV4cCI6MTQ5Mjg4MjA0MiwiaWF0IjoxNDkyNzk1NjQyLCJhdF9oYXNoIjoiYmk5NmdPWFpTaHZsV1l0YWw5RXFpdyIsImVtYWlsIjoiZXJpYy5jaGlhbmdAY29yZW9zLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJncm91cHMiOlsiYWRtaW5zIiwiZGV2ZWxvcGVycyJdLCJuYW1lIjoiRXJpYyBDaGlhbmcifQ.OhROPq_0eP-zsQRjg87KZ4wGkjiQGnTi5QuG877AdJDb3R2ZCOk2Vkf5SdP8cPyb3VMqL32G4hLDayniiv8f1_ZXAde0sKrayfQ10XAXFgZl_P1yilkLdknxn6nbhDRVllpWcB12ki9vmAxklAr0B1C4kr5nI3-BZLrFcUR5sQbxwJj4oW1OuG6jJCNGHXGNTBTNEaM28eD-9nhfBeuBTzzO7BKwPsojjj4C9ogU4JQhGvm_l4yfVi0boSx8c0FX3JsiB0yLa1ZdJVWVl9m90XmbWRSD85pNDQHcWZP9hR6CMgbvGkZsgjG32qeRwUL_eNkNowSBNWLrGNPoON1gMg

ID Tokens contains standard claims assert which client app logged the user in, when the token expires, and the identity of the user.

{
  "iss": "http://127.0.0.1:5556/dex",
  "sub": "CgcyMzQyNzQ5EgZnaXRodWI",
  "aud": "example-app",
  "exp": 1492882042,
  "iat": 1492795642,
  "at_hash": "bi96gOXZShvlWYtal9Eqiw",
  "email": "jane.doe@coreos.com",
  "email_verified": true,
  "groups": [
    "admins",
    "developers"
  ],
  "name": "Jane Doe"
}

Because these tokens are signed by dex and contain standard-based claims other services can consume them as service-to-service credentials. Systems that can already consume OpenID Connect ID Tokens issued by dex include:

For details on how to request or validate an ID Token, see "Writing apps that use dex".

Kubernetes + dex

Dex's main production use is as an auth-N addon in CoreOS's enterprise Kubernetes solution, Tectonic. Dex runs natively on top of any Kubernetes cluster using Third Party Resources and can drive API server authentication through the OpenID Connect plugin. Clients, such as the Tectonic Console and kubectl, can act on behalf users who can login to the cluster through any identity provider dex supports.

More docs for running dex as a Kubernetes authenticator can be found here.

Documentation

Reporting a security vulnerability

Due to their public nature, GitHub and mailing lists are NOT appropriate places for reporting vulnerabilities. Please refer to CoreOS's security disclosure process when reporting issues that may be security related.

Getting help

  • For feature requests and bugs, file an issue.
  • For general discussion about both using and developing dex, join the dex-dev mailing list.
  • For more details on dex development plans, check out the GitHub milestones.