Dex is a federated OpenID Connect provider and OAuth 2.0 identity service written in Go that enables applications to authenticate users through a unified interface while delegating to various upstream identity providers. The project serves as an identity portal that abstracts away the complexity of multiple authentication protocols, allowing client applications to implement authentication logic once against dex rather than integrating with each backend identity system individually.
The core functionality of dex centers on issuing ID Tokens, which are JSON Web Tokens signed by dex that attest to a user's identity as part of the OAuth2 response. These tokens contain standard claims including which client application performed the login, token expiration time, and user identity information. Because these tokens are cryptographically signed and standards-based, they can be consumed directly by other services as service-to-service credentials, with explicit support for integration with Kubernetes API server authentication and AWS STS.
Dex's architecture relies on pluggable connectors that implement various authentication protocols and integrate with specific identity providers. The project includes connectors for LDAP directories, SAML providers, and established platforms including GitHub, Google, LinkedIn, Microsoft, GitLab, Bitbucket Cloud, Gitea, OpenShift, Atlassian Crowd, and OpenStack Keystone. Additionally, dex provides generic connectors for OpenID Connect and OAuth 2.0 providers, enabling integration with services like Salesforce and Azure. Each connector has different capabilities regarding refresh token support, group membership claims, and preferred username claims, with statuses ranging from stable to alpha depending on testing and maintenance levels.
Dex has particular relevance for Kubernetes environments, where it runs natively using Custom Resource Definitions and can drive API server authentication through the OpenID Connect plugin. This enables kubectl and tools like kubelogin to authenticate users against any identity provider that dex supports, providing a flexible authentication layer for Kubernetes clusters.
The project maintains active development with continuous integration workflows and holds OpenSSF Best Practices certification and a strong OpenSSF Scorecard rating. The repository is licensed under the Apache License, Version 2.0 and is part of the Cloud Native Computing Foundation ecosystem. Documentation is comprehensive and available at dexidp.io, covering getting started guides, configuration details, and usage patterns. The project maintains an ADOPTERS.md file documenting companies and projects using dex in production. Community support is available through the CNCF Slack channel #dexidp and GitHub discussions, with a formal security policy in place for vulnerability reporting.
