dexidp/dex

Features

• Identity Federation Providers - Provides a system that enables authentication via external identity providers using standardized protocols to present a unified issuer.
• Identity Providers - Acts as a centralized identity provider that unifies various upstream authentication protocols into a single OIDC interface.
• OpenID Connect Providers - Translates various upstream authentication protocols like LDAP and SAML into a single OpenID Connect endpoint.
• API Server Authentication Plugins - Enables the Kubernetes API server to authenticate requests via an external OIDC provider plugin.
• Identity - Federates multiple external identity sources and normalizes user claims into consistent identity tokens.
• OpenID Connect Token Validations - Authorizes Kubernetes API requests by validating bearer tokens against an OpenID Connect issuer.
• Claim Mapping - Transforms provider-specific user attributes and group memberships into normalized claims for downstream applications.
• User Identity Verification - Extracts user claims by validating the signature and expiration of bearer tokens from trusted clients.
• Protocol Translation - Converts LDAP and SAML signals from identity providers into OpenID Connect tokens for client applications.
• Identity Protocol Translation - Converts disparate identity signals from LDAP, SAML, and OAuth2 into standardized JSON Web Tokens.
• Kubernetes Identity Integration - Integrates OpenID Connect with the Kubernetes API server to enable cluster login via external identity providers.
• LDAP Search Bind - Implements the search-then-bind authentication flow to verify user identities against an LDAP directory.
• Client Registrations - Registers and manages client applications, redirect URIs, and secret credentials for secure authorization flows.
• OAuth 2.0 Authorization Servers - Implements a full OAuth 2.0 authorization server to manage client registrations and grant access to protected resources.
• OAuth2 Client Management - Provides tools for registering client applications and defining their allowed redirect URIs and secret credentials.
• OAuth2 Implementations - Executes standard OAuth 2.0 authorization patterns and implicit flows to grant resource access.
• OIDC Identity Token Issuance - Functions as an OIDC provider that issues signed identity tokens after verifying users via upstream flows.
• OIDC Discovery Document Hosting - Publishes standardized OpenID Connect discovery documents and public keys to automate client integration and token verification.
• SAML Authentication - Implements SAML 2.0 HTTP POST binding to verify identities and map assertion attributes to profiles.
• Single Sign-On - Centralizes authentication for multiple applications by delegating user verification to a shared identity provider.
• Identity Connector Architectures - Implements a pluggable architecture to translate various upstream authentication protocols into a unified OpenID Connect interface.
• OIDC Claim Mapping - Transforms provider-specific user attributes and group memberships into normalized OIDC claims for downstream applications.
• Group Membership Retrieval - Retrieves Google Workspace group memberships using a service account and the Admin SDK Directory API.
• Identity Metadata Persistence - Persists configuration and session data across relational databases or Kubernetes API resources.
• Pluggable Database Backends - Supports multiple database storage options, including SQL and etcd, for persisting system configuration and session state.
• SQLite or PostgreSQL Storage - Stores identity data in SQLite, Postgres, or MySQL with automatic database migrations.
• Native Kubernetes Object Storage - Maintains identity state using Custom Resource Definitions within a Kubernetes cluster.
• Nested Group Memberships - Traverses nested group structures in LDAP and directory services to determine full user membership hierarchies.
• Header Field Mapping - Configures specific HTTP headers to supply user email and group lists from a proxy.
• Group Membership Enforcement - Validates user identity and access rights based on group membership filters provided by upstream identity sources.
• Identity Federation - Federates identities by querying OpenShift OAuth servers to retrieve user profiles and group memberships.
• Identity Provider Integrations - Integrates with OpenStack Keystone to verify user identities and synchronize group memberships.
• Claim Configuration - Controls which user attributes and scopes are included in the issued identity tokens.
• Directory Search - Enables locating user and group entries using configurable base DNs and search filters.
• Attribute Mappings - Provides configurations for linking internal user profile fields to standard LDAP directory attributes.
• LinkedIn Integrations - Implements specific OAuth2 authentication and authorization flows for LinkedIn identity verification.
• Proxy Token Issuance - Issues internal identity tokens mapped to upstream provider credentials for peer application trust.
• UserInfo Endpoints - Queries the OIDC UserInfo endpoint to retrieve additional user claims that take priority over ID token claims.
• Proxy Authentication - Extracts user identities and group memberships from custom HTTP headers provided by an upstream proxy.
• External Group Synchronization - Populates group claims in identity tokens by retrieving organization and team memberships from GitHub.
• OIDC Upstream Federation - Redirects users to an upstream OIDC provider and extracts identity claims through standard OAuth2 flows.
• etcd Metadata Stores - Stores system configuration and session state in an etcd v3 cluster using custom namespaces and SSL.
• OAuth 2.0 Provider Integrations - Connects to any standards-compliant OAuth 2.0 provider to authenticate users via a generic connector.
• Security and Compliance - OIDC and OAuth 2.0 identity provider.

Star 历史