A federated OpenID Connect (OIDC) and OAuth 2.0 provider with pluggable connectors to external identity sources.
Dex is an open-source federated OpenID Connect (OIDC) and OAuth 2.0 provider that centralizes authentication for applications. It solves the problem of integrating multiple identity sources by acting as a shim between clients and upstream providers like LDAP, SAML, GitHub, or Google, issuing standardized ID Tokens for secure identity assertion.
DevOps engineers, platform teams, and developers building or managing applications that require unified authentication across diverse identity systems, especially in Kubernetes environments or microservices architectures.
Developers choose Dex for its extensive pluggable connector ecosystem, robust OpenID Connect compliance, and seamless Kubernetes integration, allowing them to implement a single authentication layer that abstracts away the complexity of multiple identity protocols.
OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Dex supports over 10 connectors including LDAP, GitHub, SAML, and Google, with varying stability levels, enabling integration with diverse identity sources as shown in the connectors table.
Dex runs natively on Kubernetes using Custom Resource Definitions and drives API server authentication through the OIDC plugin, allowing tools like `kubectl` to use Dex for user login, as detailed in the Kubernetes section.
Issues OpenID Connect compliant ID Tokens (JWTs) with standard claims, which can be consumed by systems like Kubernetes and AWS STS for service-to-service credentials, ensuring interoperability.
Acts as a shim between clients and multiple upstream providers, allowing apps to write authentication logic once using OIDC while Dex handles protocol differences, simplifying multi-provider setups.
The SAML 2.0 connector is marked as unmaintained and likely vulnerable to auth bypasses, posing a security risk for environments relying on SAML, as noted in the connectors table.
Support for refresh tokens and group claims varies by connector; for example, SAML and OAuth 2.0 connectors do not support refresh tokens, limiting offline access for clients.
Dex requires self-hosting and configuration, including managing Kubernetes resources or other infrastructure, which adds operational overhead compared to managed services.