[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-5023":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":17,"stars7d":18,"stars30d":19,"stars90d":16,"forks30d":16,"starsTrendScore":20,"compositeScore":21,"rankGlobal":10,"rankLanguage":10,"license":22,"archived":23,"fork":23,"defaultBranch":24,"hasWiki":25,"hasPages":23,"topics":26,"createdAt":10,"pushedAt":10,"updatedAt":32,"readmeContent":33,"aiSummary":34,"trendingCount":16,"starSnapshotCount":16,"syncStatus":35,"lastSyncTime":36,"discoverSource":37},5023,"dex","dexidp\u002Fdex","dexidp","OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors","https:\u002F\u002Fdexidp.io",null,"Go",10879,1941,164,338,0,3,21,81,14,94.46,"Apache License 2.0",false,"master",true,[27,28,29,30,31],"hacktoberfest","identity-provider","idp","kubernetes","oidc","2026-06-12 04:00:24","# dex - A federated OpenID Connect provider\n\n![GitHub Workflow Status](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Factions\u002Fworkflow\u002Fstatus\u002Fdexidp\u002Fdex\u002Fci.yaml?style=flat-square&branch=master)\n[![OpenSSF Scorecard](https:\u002F\u002Fapi.securityscorecards.dev\u002Fprojects\u002Fgithub.com\u002Fdexidp\u002Fdex\u002Fbadge?style=flat-square)](https:\u002F\u002Fapi.securityscorecards.dev\u002Fprojects\u002Fgithub.com\u002Fdexidp\u002Fdex)\n[![OpenSSF Best Practices](https:\u002F\u002Fwww.bestpractices.dev\u002Fprojects\u002F12566\u002Fbadge)](https:\u002F\u002Fwww.bestpractices.dev\u002Fprojects\u002F12566)\n[![Go Report Card](https:\u002F\u002Fgoreportcard.com\u002Fbadge\u002Fgithub.com\u002Fdexidp\u002Fdex?style=flat-square)](https:\u002F\u002Fgoreportcard.com\u002Freport\u002Fgithub.com\u002Fdexidp\u002Fdex)\n[![LFX Health Score](https:\u002F\u002Finsights.linuxfoundation.org\u002Fapi\u002Fbadge\u002Fhealth-score?project=dex)](https:\u002F\u002Finsights.linuxfoundation.org\u002Fproject\u002Fdex\u002Fcontributors)\n\n![logo](docs\u002Flogos\u002Fdex-horizontal-color.png)\n\nDex is an identity service that uses [OpenID Connect][openid-connect] to drive authentication for other apps.\n\nDex acts as a portal to other identity providers through [\"connectors.\"](#connectors) This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend.\n\n## ID Tokens\n\nID Tokens are an OAuth2 extension introduced by OpenID Connect and dex's primary feature. ID Tokens are [JSON Web Tokens][jwt-io] (JWTs) signed by dex and returned as part of the OAuth2 response that attests to the end user's identity. An example JWT might look like:\n\n```\neyJhbGciOiJSUzI1NiIsImtpZCI6IjlkNDQ3NDFmNzczYjkzOGNmNjVkZDMyNjY4NWI4NjE4MGMzMjRkOTkifQ.eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjU1NTYvZGV4Iiwic3ViIjoiQ2djeU16UXlOelE1RWdabmFYUm9kV0kiLCJhdWQiOiJleGFtcGxlLWFwcCIsImV4cCI6MTQ5Mjg4MjA0MiwiaWF0IjoxNDkyNzk1NjQyLCJhdF9oYXNoIjoiYmk5NmdPWFpTaHZsV1l0YWw5RXFpdyIsImVtYWlsIjoiZXJpYy5jaGlhbmdAY29yZW9zLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJncm91cHMiOlsiYWRtaW5zIiwiZGV2ZWxvcGVycyJdLCJuYW1lIjoiRXJpYyBDaGlhbmcifQ.OhROPq_0eP-zsQRjg87KZ4wGkjiQGnTi5QuG877AdJDb3R2ZCOk2Vkf5SdP8cPyb3VMqL32G4hLDayniiv8f1_ZXAde0sKrayfQ10XAXFgZl_P1yilkLdknxn6nbhDRVllpWcB12ki9vmAxklAr0B1C4kr5nI3-BZLrFcUR5sQbxwJj4oW1OuG6jJCNGHXGNTBTNEaM28eD-9nhfBeuBTzzO7BKwPsojjj4C9ogU4JQhGvm_l4yfVi0boSx8c0FX3JsiB0yLa1ZdJVWVl9m90XmbWRSD85pNDQHcWZP9hR6CMgbvGkZsgjG32qeRwUL_eNkNowSBNWLrGNPoON1gMg\n```\n\nID Tokens contains standard claims assert which client app logged the user in, when the token expires, and the identity of the user.\n\n```json\n{\n  \"iss\": \"http:\u002F\u002F127.0.0.1:5556\u002Fdex\",\n  \"sub\": \"CgcyMzQyNzQ5EgZnaXRodWI\",\n  \"aud\": \"example-app\",\n  \"exp\": 1492882042,\n  \"iat\": 1492795642,\n  \"at_hash\": \"bi96gOXZShvlWYtal9Eqiw\",\n  \"email\": \"jane.doe@coreos.com\",\n  \"email_verified\": true,\n  \"groups\": [\n    \"admins\",\n    \"developers\"\n  ],\n  \"name\": \"Jane Doe\"\n}\n```\n\nBecause these tokens are signed by dex and [contain standard-based claims][standard-claims] other services can consume them as service-to-service credentials. Systems that can already consume OpenID Connect ID Tokens issued by dex include:\n\n* [Kubernetes][kubernetes]\n* [AWS STS][aws-sts]\n\nFor details on how to request or validate an ID Token, see [_\"Writing apps that use dex\"_](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fusing-dex\u002F).\n\n## Kubernetes and Dex\n\nDex runs natively on top of any Kubernetes cluster using Custom Resource Definitions and can drive API server authentication through the OpenID Connect plugin. Clients, such as [`kubelogin`](https:\u002F\u002Fgithub.com\u002Fint128\u002Fkubelogin) and `kubectl`, can act on behalf of users who can login to the cluster through any identity provider dex supports.\n\n* More docs for running dex as a Kubernetes authenticator can be found [here](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fguides\u002Fkubernetes\u002F).\n* You can find more about companies and projects which use dex, [here](.\u002FADOPTERS.md).\n\n## Connectors\n\nWhen a user logs in through dex, the user's identity is usually stored in another user-management system: a LDAP directory, a GitHub org, etc. Dex acts as a shim between a client app and the upstream identity provider. The client only needs to understand OpenID Connect to query dex, while dex implements an array of protocols for querying other user-management systems.\n\n![](docs\u002Fimg\u002Fdex-flow.png)\n\nA \"connector\" is a strategy used by dex for authenticating a user against another identity provider. Dex implements connectors that target specific platforms such as GitHub, LinkedIn, and Microsoft as well as established protocols like LDAP and SAML.\n\nDepending on the connectors limitations in protocols can prevent dex from issuing [refresh tokens][scopes] or returning [group membership][scopes] claims. For example, because SAML doesn't provide a non-interactive way to refresh assertions, if a user logs in through the SAML connector dex won't issue a refresh token to its client. Refresh token support is required for clients that require offline access, such as `kubectl`.\n\nDex implements the following connectors:\n\n| Name | supports refresh tokens | supports groups claim | supports preferred_username claim | status | notes |\n| ---- | ----------------------- | --------------------- | --------------------------------- | ------ | ----- |\n| [LDAP](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fldap\u002F) | yes | yes | yes | stable | |\n| [GitHub](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fgithub\u002F) | yes | yes | yes | stable | |\n| [SAML 2.0](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fsaml\u002F) | no | yes | no | stable | WARNING: Unmaintained and likely vulnerable to auth bypasses ([#1884](https:\u002F\u002Fgithub.com\u002Fdexidp\u002Fdex\u002Fdiscussions\u002F1884)) |\n| [GitLab](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fgitlab\u002F) | yes | yes | yes | beta | |\n| [OpenID Connect](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Foidc\u002F) | yes | yes | yes | beta | Includes Salesforce, Azure, etc. |\n| [OAuth 2.0](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Foauth\u002F) | no | yes | yes | alpha | |\n| [Google](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fgoogle\u002F) | yes | yes | yes | alpha | |\n| [LinkedIn](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Flinkedin\u002F) | yes | no | no | beta | |\n| [Microsoft](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fmicrosoft\u002F) | yes | yes | no | beta | |\n| [AuthProxy](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fauthproxy\u002F) | no | yes | no | alpha | Authentication proxies such as Apache2 mod_auth, etc. |\n| [Bitbucket Cloud](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fbitbucketcloud\u002F) | yes | yes | no | alpha | |\n| [OpenShift](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fopenshift\u002F) | yes | yes | no | alpha | |\n| [Atlassian Crowd](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fatlassian-crowd\u002F) | yes | yes | yes * | beta | preferred_username claim must be configured through config |\n| [Gitea](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fgitea\u002F) | yes | no | yes | beta | |\n| [OpenStack Keystone](https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fconnectors\u002Fkeystone\u002F) | yes | yes | no | alpha | |\n\nStable, beta, and alpha are defined as:\n\n* Stable: well tested, in active use, and will not change in backward incompatible ways.\n* Beta: tested and unlikely to change in backward incompatible ways.\n* Alpha: may be untested by core maintainers and is subject to change in backward incompatible ways.\n\nAll changes or deprecations of connector features will be announced in the [release notes][release-notes].\n\n## Documentation\n\nSee the [official documentation](https:\u002F\u002Fdexidp.io\u002Fdocs\u002F) for getting started, configuration, and usage guides.\n\n## Reporting a vulnerability\n\nPlease see our [security policy](.github\u002FSECURITY.md) for details about reporting vulnerabilities.\n\n## Getting help\n\n- For feature requests and bugs, file an [issue](https:\u002F\u002Fgithub.com\u002Fdexidp\u002Fdex\u002Fissues).\n- For general discussion about both using and developing Dex:\n    - join the [#dexidp](https:\u002F\u002Fcloud-native.slack.com\u002Fmessages\u002Fdexidp) on the CNCF Slack\n    - open a new [discussion](https:\u002F\u002Fgithub.com\u002Fdexidp\u002Fdex\u002Fdiscussions)\n\n[openid-connect]: https:\u002F\u002Fopenid.net\u002Fconnect\u002F\n[standard-claims]: https:\u002F\u002Fopenid.net\u002Fspecs\u002Fopenid-connect-core-1_0.html#StandardClaims\n[scopes]: https:\u002F\u002Fdexidp.io\u002Fdocs\u002Fcustom-scopes-claims-clients\u002F#scopes\n[jwt-io]: https:\u002F\u002Fjwt.io\u002F\n[kubernetes]: https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Freference\u002Faccess-authn-authz\u002Fauthentication\u002F#openid-connect-tokens\n[aws-sts]: https:\u002F\u002Fdocs.aws.amazon.com\u002FSTS\u002Flatest\u002FAPIReference\u002FWelcome.html\n[release-notes]: https:\u002F\u002Fgithub.com\u002Fdexidp\u002Fdex\u002Freleases\n\n## Contributing\n\nPlease see [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, guidelines, and how to submit pull requests.\n\n## License\n\nThe project is licensed under the [Apache License, Version 2.0](LICENSE).\n","Dex 是一个实现了 OpenID Connect (OIDC) 和 OAuth 2.0 协议的身份认证服务，通过可插拔的连接器支持多种身份验证后端。其核心功能包括通过 OIDC 发放 ID Token，这些令牌是 JSON Web Tokens (JWT)，包含标准声明，如用户身份、过期时间等，并由 Dex 签名。技术上，Dex 使用 Go 语言开发，具备良好的安全性和性能。适用于需要统一身份认证解决方案的场景，特别是那些希望将认证逻辑与业务逻辑分离的企业或团队，以及在 Kubernetes 环境中进行身份管理的情况。",2,"2026-06-11 03:02:08","top_language"]