A federated OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors for LDAP, SAML, GitHub, and more.
Dex is an open-source federated OpenID Connect (OIDC) identity and OAuth 2.0 provider. It centralizes authentication by acting as a portal to other identity providers like LDAP, SAML, GitHub, and Google, issuing standards-based ID Tokens (JWTs) that clients can use for secure authentication. It solves the problem of integrating multiple, disparate identity systems into a single, unified OIDC interface.
Platform engineers, DevOps teams, and developers building or managing authentication for Kubernetes clusters, microservices, or applications that need to support multiple identity backends. It's particularly valuable for organizations with existing LDAP, SAML, or social identity providers.
Developers choose Dex because it provides a single, standards-based OIDC layer over any identity provider, eliminating the need to write custom authentication logic for each backend. Its deep Kubernetes integration and extensive connector ecosystem make it a robust, self-hosted alternative to commercial identity services.
OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Acts as a portal to multiple backends like LDAP, SAML, and GitHub, allowing clients to implement authentication once using OpenID Connect while Dex handles protocol diversity.
Runs natively on Kubernetes and drives API server authentication via the OIDC plugin, enabling tools like kubectl to use OIDC tokens for cluster access.
Issues OpenID Connect ID Tokens (JWTs) with standard claims, making them interoperable with systems like Kubernetes and AWS STS for secure identity attestation.
Supports an extensive range of connectors from stable (LDAP, GitHub) to beta/alpha (GitLab, OAuth 2.0), covering most enterprise and social identity needs.
Many connectors are in alpha or beta stages, and the SAML connector is explicitly warned as unmaintained and vulnerable to auth bypasses (#1884), posing security concerns.
Requires detailed YAML configuration and a deep understanding of OIDC and backend protocols, with no managed service option, increasing setup and maintenance burden.
Refresh tokens and claims like groups or preferred_username vary by connector; for example, SAML lacks refresh token support, limiting offline access for clients like kubectl.