OpenID Connect Identity (OIDC) and OAuth 2.0 Provider with Pluggable Connectors
ericchiang Merge pull request #1319 from dannysauer/oidc_doc
Add mention of `scopes` parameter in OIDC doc
Latest commit 9f91ae0 Oct 17, 2018
Failed to load latest commit information.
Documentation Add mention of `scopes` parameter in OIDC doc Oct 17, 2018
api *: regenerate proto Dec 1, 2017
cmd *: -> Sep 5, 2018
connector Remove unused DisplayName Oct 6, 2018
examples examples/k8s: reference Sep 6, 2018
scripts scripts,Makefile: nuke check-go-version Sep 10, 2018
server Merge pull request #1307 from edtan/upstream-add-bitbucket-connector Oct 12, 2018
storage Merge pull request #1266 from byxorna/gabe/fix-etcd-timeout-bug Sep 10, 2018
vendor Add Bitbucket connector Sep 30, 2018
version *: determine version from git Aug 9, 2016
web connector: implement Microsoft connector Nov 23, 2017
.dockerignore Replace docker-build script with multi-stage build Sep 21, 2017
.gitignore *: prepare build scripts for a release Oct 6, 2016
.travis.yml .travis.yml: fix golint import Oct 15, 2018
DCO *: add DCO and LICENSE Oct 13, 2016
Dockerfile Merge pull request #1253 from vasartori/master Sep 10, 2018
LICENSE *: add DCO and LICENSE Oct 13, 2016
MAINTAINERS *: update the maintainers list Sep 1, 2018
Makefile Merge pull request #1290 from srenatus/sr/release-process/update-quay… Sep 10, 2018
NOTICE update CoC and legalese Jan 4, 2018 Fix broken link to Bitbucket Cloud documentation Oct 15, 2018 update CoC and legalese Jan 4, 2018
glide.lock Add Bitbucket connector Sep 30, 2018
glide.yaml Update go-jose to v2.1.8 Sep 18, 2018
glide_test.go *: add 'make revendor' and tests to catch incorrect glide usage Dec 22, 2016

dex - A federated OpenID Connect provider

Travis GoDoc Go Report Card


Dex is an identity service that uses OpenID Connect to drive authentication for other apps.

Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend.

ID Tokens

ID Tokens are an OAuth2 extension introduced by OpenID Connect and dex's primary feature. ID Tokens are JSON Web Tokens (JWTs) signed by dex and returned as part of the OAuth2 response that attest to the end user's identity. An example JWT might look like:


ID Tokens contains standard claims assert which client app logged the user in, when the token expires, and the identity of the user.

  "iss": "",
  "sub": "CgcyMzQyNzQ5EgZnaXRodWI",
  "aud": "example-app",
  "exp": 1492882042,
  "iat": 1492795642,
  "at_hash": "bi96gOXZShvlWYtal9Eqiw",
  "email": "",
  "email_verified": true,
  "groups": [
  "name": "Jane Doe"

Because these tokens are signed by dex and contain standard-based claims other services can consume them as service-to-service credentials. Systems that can already consume OpenID Connect ID Tokens issued by dex include:

For details on how to request or validate an ID Token, see "Writing apps that use dex".

Kubernetes + dex

Dex's main production use is as an auth-N addon in CoreOS's enterprise Kubernetes solution, Tectonic. Dex runs natively on top of any Kubernetes cluster using Third Party Resources and can drive API server authentication through the OpenID Connect plugin. Clients, such as the Tectonic Console and kubectl, can act on behalf users who can login to the cluster through any identity provider dex supports.

More docs for running dex as a Kubernetes authenticator can be found here.


When a user logs in through dex, the user's identity is usually stored in another user-management system: a LDAP directory, a GitHub org, etc. Dex acts as a shim between a client app and the upstream identity provider. The client only needs to understand OpenID Connect to query dex, while dex implements an array of protocols for querying other user-management systems.

A "connector" is a strategy used by dex for authenticating a user against another identity provider. Dex implements connectors that target specific platforms such as GitHub, LinkedIn, and Microsoft as well as established protocols like LDAP and SAML.

Depending on the connectors limitations in protocols can prevent dex from issuing refresh tokens or returning group membership claims. For example, because SAML doesn't provide a non-interactive way to refresh assertions, if a user logs in through the SAML connector dex won't issue a refresh token to its client. Refresh token support is required for clients that require offline access, such as kubectl.

Dex implements the following connectors:

Name supports refresh tokens supports groups claim status notes
LDAP yes yes stable
GitHub yes yes stable
SAML 2.0 no yes stable
GitLab yes yes beta
OpenID Connect yes no (#1065) beta Includes Google, Salesforce, Azure, etc.
LinkedIn yes no beta
Microsoft yes yes beta
AuthProxy no no alpha Authentication proxies such as Apache2 mod_auth, etc.
Bitbucket Cloud yes yes alpha

Stable, beta, and alpha are defined as:

  • Stable: well tested, in active use, and will not change in backward incompatible ways.
  • Beta: tested and unlikely to change in backward incompatible ways.
  • Alpha: may be untested by core maintainers and is subject to change in backward incompatible ways.

All changes or deprecations of connector features will be announced in the release notes.


Reporting a security vulnerability

Due to their public nature, GitHub and mailing lists are NOT appropriate places for reporting vulnerabilities. Please refer to CoreOS's security disclosure process when reporting issues that may be security related.

Getting help

  • For feature requests and bugs, file an issue.
  • For general discussion about both using and developing dex, join the dex-dev mailing list.