登录

dex

dexidpApache-2.0活跃维护

基于 Go 的 OpenID Connect 和 OAuth 2.0 身份提供者，通过可插拔连接器对接多种上游身份源，为 Kubernetes 等场景提供统一认证入口。

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

v2.46.1发布于 2026-10-21 14:33 UTC11,243star +4 / 7 天2,019fork同步于 2026-11-10 11:28 UTC
身份提供者OIDCOAuth 2.0可插拔连接器Kubernetes 认证
对比 GitHub 官网hacktoberfestidentity-provideridpkubernetesoidc

怎么上手

README 里没有找到可直接复制的安装命令
原文

README 里没有找到可直接复制的安装命令，请到 README 或官方文档查看安装方式。

硬件要求按 README 说明

README 未说明

下载：源码 zip·GitHub Releases（安装包）本站不镜像安装包

项目说明

由 README 自动翻译提炼
没人工点评？写下你的经验

用 OpenID Connect 给应用统一做身份认证，并通过可插拔连接器对接 LDAP、SAML、GitHub 等上游身份源

基于 Go 的 OpenID Connect 和 OAuth 2.0 身份提供者，通过可插拔连接器对接多种上游身份源，为 Kubernetes 等场景提供统一认证入口。

核心能力

  • 签发由 dex 签名的 JWT 格式 ID Token
  • 用 connector 把认证委托给 LDAP、SAML、GitHub 等上游
  • 客户端只需实现一次 OIDC 即可对接多种后端
  • 可作为 Kubernetes API Server 的 OIDC 认证器
  • 支持以 CRD 形式原生运行在 Kubernetes 上

容易踩的坑

SAML 连接器已无人维护，可能存在认证绕过风险；不同 connector 对 refresh token 和 groups claim 的支持不一致，例如 SAML 不签发 refresh token；connector 分 stable/beta/alpha，alpha 可能未经核心维护者测试且会有不兼容变更

内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README

最近发版

5 个版本v2.46.1
全部 release
  1. v2.46.1最新正式版2026-10-21 · 2026-10-21 14:33 UTC

    What's Changed

    Dependency Updates ⬆️

    Full Changelog: https://github.com/dexidp/dex/compare/v2.46.0...v2.46.1

  2. v2.46.02026-10-07 · 2026-10-07 23:17 UTC
    查看更新说明

    What's Changed

    Exciting New Features 🎉

    Enhancements 🚀

  3. v2.45.12026-03-03 · 2026-03-03 13:43 UTC
    查看更新说明

    Bug Fixes 🐛

    • Quote groups reserved word in query replacer to fix MySQL 8.0+ storage migration (#4580)
    • Update authproxy and oauth to match CallbackConnector interface (#4589)

    Full Changelog: https://github.com/dexidp/dex/compare/v2.45.0...v2.45.1

  4. v2.45.02026-02-23 · 2026-02-23 15:08 UTC
    查看更新说明

    Know Before Upgrade

    • The major version of gomplate has been bumped to v5.0.0, which includes breaking changes. Here is the full list.
    • There are two known CVEs in the gomplate binary - CVE-2025-68121 and CVE-2026-25934. gomplate is only used for preprocessing configuration files and is optional. Once the CVEs are fixed upstream, the version of gomplate in the dex image will be updated accordingly.
    • The ContinueOnConnectorFailure feature flag is now enabled by default. To disable it, use the following environment variable: DEX_CONTINUE_ON_CONNECTOR_FAILURE=false.
    • Pre-release versions of dex now use pseudo-versioning for identifying releases. Unreleased versions will follow the pattern v2.minor+1.0-yyyymmdd-commithash.

    What's Changed

    Exciting New Features 🎉

    Enhancements 🚀

    Bug Fixes 🐛

    Dependency Updates ⬆️

  5. v2.44.02025-09-01 · 2025-09-01 13:23 UTC
    查看更新说明

    What's Changed

    Enhancements 🚀

    Bug Fixes 🐛

    Dependency Updates ⬆️

用户点评

登录用户的真实使用记录，可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译
    在 GitHub 打开

    dex - A federated OpenID Connect provider

    GitHub Workflow Status OpenSSF Scorecard OpenSSF Best Practices Go Report Card LFX Health Score

    logo

    Dex is an identity service that uses OpenID Connect to drive authentication for other apps.

    Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend.

    ID Tokens

    ID Tokens are an OAuth2 extension introduced by OpenID Connect and dex's primary feature. ID Tokens are JSON Web Tokens (JWTs) signed by dex and returned as part of the OAuth2 response that attests to the end user's identity. An example JWT might look like:

    eyJhbGciOiJSUzI1NiIsImtpZCI6IjlkNDQ3NDFmNzczYjkzOGNmNjVkZDMyNjY4NWI4NjE4MGMzMjRkOTkifQ.eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjU1NTYvZGV4Iiwic3ViIjoiQ2djeU16UXlOelE1RWdabmFYUm9kV0kiLCJhdWQiOiJleGFtcGxlLWFwcCIsImV4cCI6MTQ5Mjg4MjA0MiwiaWF0IjoxNDkyNzk1NjQyLCJhdF9oYXNoIjoiYmk5NmdPWFpTaHZsV1l0YWw5RXFpdyIsImVtYWlsIjoiZXJpYy5jaGlhbmdAY29yZW9zLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJncm91cHMiOlsiYWRtaW5zIiwiZGV2ZWxvcGVycyJdLCJuYW1lIjoiRXJpYyBDaGlhbmcifQ.OhROPq_0eP-zsQRjg87KZ4wGkjiQGnTi5QuG877AdJDb3R2ZCOk2Vkf5SdP8cPyb3VMqL32G4hLDayniiv8f1_ZXAde0sKrayfQ10XAXFgZl_P1yilkLdknxn6nbhDRVllpWcB12ki9vmAxklAr0B1C4kr5nI3-BZLrFcUR5sQbxwJj4oW1OuG6jJCNGHXGNTBTNEaM28eD-9nhfBeuBTzzO7BKwPsojjj4C9ogU4JQhGvm_l4yfVi0boSx8c0FX3JsiB0yLa1ZdJVWVl9m90XmbWRSD85pNDQHcWZP9hR6CMgbvGkZsgjG32qeRwUL_eNkNowSBNWLrGNPoON1gMg

    ID Tokens contains standard claims assert which client app logged the user in, when the token expires, and the identity of the user.

    {
  "iss": "http://127.0.0.1:5556/dex",
  "sub": "CgcyMzQyNzQ5EgZnaXRodWI",
  "aud": "example-app",
  "exp": 1492882042,
  "iat": 1492795642,
  "at_hash": "bi96gOXZShvlWYtal9Eqiw",
  "email": "[email protected]",
  "email_verified": true,
  "groups": [
    "admins",
    "developers"
  ],
  "name": "Jane Doe"
}

    Because these tokens are signed by dex and contain standard-based claims other services can consume them as service-to-service credentials. Systems that can already consume OpenID Connect ID Tokens issued by dex include:

    For details on how to request or validate an ID Token, see "Writing apps that use dex".

    Kubernetes and Dex

    Dex runs natively on top of any Kubernetes cluster using Custom Resource Definitions and can drive API server authentication through the OpenID Connect plugin. Clients, such as kubelogin and kubectl, can act on behalf of users who can login to the cluster through any identity provider dex supports.

    • More docs for running dex as a Kubernetes authenticator can be found here.
    • You can find more about companies and projects which use dex, here.

    Connectors

    When a user logs in through dex, the user's identity is usually stored in another user-management system: a LDAP directory, a GitHub org, etc. Dex acts as a shim between a client app and the upstream identity provider. The client only needs to understand OpenID Connect to query dex, while dex implements an array of protocols for querying other user-management systems.

    A "connector" is a strategy used by dex for authenticating a user against another identity provider. Dex implements connectors that target specific platforms such as GitHub, LinkedIn, and Microsoft as well as established protocols like LDAP and SAML.

    Depending on the connectors limitations in protocols can prevent dex from issuing refresh tokens or returning group membership claims. For example, because SAML doesn't provide a non-interactive way to refresh assertions, if a user logs in through the SAML connector dex won't issue a refresh token to its client. Refresh token support is required for clients that require offline access, such as kubectl.

    Dex implements the following connectors:

    Namesupports refresh tokenssupports groups claimsupports preferred_username claimstatusnotes
    LDAPyesyesyesstable
    GitHubyesyesyesstable
    SAML 2.0noyesnostableWARNING: Unmaintained and likely vulnerable to auth bypasses (#1884)
    GitLabyesyesyesbeta
    OpenID ConnectyesyesyesbetaIncludes Salesforce, Azure, etc.
    OAuth 2.0noyesyesalpha
    Googleyesyesyesalpha
    LinkedInyesnonobeta
    Microsoftyesyesnobeta
    AuthProxynoyesnoalphaAuthentication proxies such as Apache2 mod_auth, etc.
    Bitbucket Cloudyesyesnoalpha
    OpenShiftyesyesnoalpha
    Atlassian Crowdyesyesyes *betapreferred_username claim must be configured through config
    Giteayesnoyesbeta
    OpenStack Keystoneyesyesnoalpha

    Stable, beta, and alpha are defined as:

    • Stable: well tested, in active use, and will not change in backward incompatible ways.
    • Beta: tested and unlikely to change in backward incompatible ways.
    • Alpha: may be untested by core maintainers and is subject to change in backward incompatible ways.

    All changes or deprecations of connector features will be announced in the release notes.

    Documentation

    See the official documentation for getting started, configuration, and usage guides.

    Reporting a vulnerability

    Please see our security policy for details about reporting vulnerabilities.

    Getting help

    • For feature requests and bugs, file an issue.
    • For general discussion about both using and developing Dex:

    Contributing

    Please see CONTRIBUTING.md for development setup, guidelines, and how to submit pull requests.

    License

    The project is licensed under the Apache License, Version 2.0.

    相关项目

    同分类里 star 最高的项目
    对比全部 →
    kubernetes
    kubernetes·Go

    生产级的容器编排与调度平台，用来自动化部署、扩缩容和管理跨主机的容器化应用。

    容器编排+4容器 / Kubernetes
    128969+8945kv1.37.22026-11-10 11:09 UTC
    uptime-kuma
    louislam·JavaScript

    自托管的网站与服务可用性监控面板，支持 HTTP、TCP、Ping 等多种探活方式，通过实时图表和告警通知掌握服务宕机情况。

    可用性监控+4容器 / Kubernetes
    93444+1098.7k2.5.92026-11-10 04:49 UTC
    mall
    macrozheng·Java

    基于 Spring Boot + MyBatis 的完整电商系统，含前台商城和后台管理，覆盖商品、订单、会员、促销等模块，用 Docker 容器化部署。

    电商系统+4容器 / Kubernetes
    85029+1730kv1.0.32026-09-15 02:34 UTC
    moby
    moby·Go

    构建容器化系统的开源协作项目，提供可拼装的组件，用来搭建和定制自己的容器平台，也是 Docker 的上游基础。

    容器引擎+3容器 / Kubernetes
    72361+819kdocker-v29.9.32026-11-09 22:29 UTC