coreos/dex
Dex
Dex is an OpenID Connect identity provider that functions as an identity federation gateway. It authenticates users and issues signed tokens for applications by using a variety of pluggable connectors to interface with external identity sources.
The project focuses on federating multiple external identity providers into a single authentication portal. It maps diverse external authentication sources to a uniform internal user representation and manages the orchestration of authorization handshakes between clients and identity sources.
Capability areas include centralized user authentication, OAuth 2.0 identity provisioning, and the issuance of OIDC-compliant tokens. It also provides a mechanism for authenticating Kubernetes API server requests using external identities.
Features
- Identity Federation Providers - Functions as a federation gateway that combines multiple upstream identity providers into a single authentication endpoint.
- External Identity Provider Integration - Uses pluggable connectors to integrate and verify tokens from various third-party identity services.
- Flow Orchestrators - Manages the state and redirects required to complete secure authorization handshakes between clients and identity sources.
- Identity Token Services - Issues cryptographically signed tokens that attest to user identities for use across different systems.
- OAuth Authentication - Authenticates users through standard OIDC and OAuth 2.0 protocols to grant secure access to applications.
- Authorization Server Implementations - Implements an OAuth 2.0 authorization server that manages grants and issues access tokens to third-party apps.
- OAuth Providers - Acts as an authorization server that manages OAuth 2.0 flows and issues secure tokens for third-party applications.
- OIDC Identity Token Issuance - Generates signed identity and access tokens following OIDC specifications to authenticate users to third party clients.
- OpenID Connect Providers - Implements a standard OpenID Connect identity provider layer to authenticate users across multiple applications.
- Identity Mapping - Maps diverse external authentication sources to a uniform internal user representation.
- User Authentication Systems - Replaces individual application login systems with a single shared identity provider to simplify access management.
- Identity Federation - Connects multiple external user directories into a single authentication portal for a unified login experience.
- API Server Authentication Plugins - Provides a mechanism to drive Kubernetes API server authentication using external identities via OIDC.
- Cluster Access Control - Enables the use of external identity providers to manage user access and permissions for the Kubernetes API server.
- OIDC Authentication Plugins - Provides OIDC-based authentication plugins for the Kubernetes API server to delegate identity verification.
- Stateless Session Management - Tracks authentication progress across redirects using short-lived tokens and signed cookies without server-side session storage.
- Identity and Access Management - Identity service providing OpenID Connect and OAuth 2.0 delegation.
