In simple English
This tool lets you handle user sign-in for all your web apps in one central place. It connects your apps to outside services like GitHub, Google, or an internal LDAP directory. Your apps only need to learn one sign-in method to talk to this tool. It saves you from writing custom sign-in code for every new service you launch. It costs you time to set up and configure, but runs for free on your own server.
What it is
Dex is a federated identity provider that uses OpenID Connect (OIDC, a standard way for a user to sign in to one website and get access to another) to drive authentication for other apps. It acts as a middleman portal that delegates sign-in requests to upstream systems like Active Directory or SAML providers.
What it is good for
Solo builders who need to secure internal dashboards, Kubernetes clusters, or multiple web applications behind a single sign-in wall tied to a team GitHub organization or corporate directory.
- Supports many common upstream sign-in providers out of the box like GitHub, Google, and LDAP.
- Issues standard JSON Web Tokens (JWT, a digitally signed block of text that proves who a user is) that other services can easily verify.
- Integrates natively with Kubernetes and other systems that accept standard OpenID Connect tokens.
- Requires writing a configuration file and managing a separate server instance alongside your applications.
- Some connectors like SAML are marked as unmaintained or experimental, which can introduce security risks if not checked.
- Debugging sign-in token failures requires comfort with OAuth and OpenID Connect flows.
Writing custom OAuth client code for every separate provider and service you build.
Kubernetes
- zitadel/zitadel15k stars
An identity management system written in Go that provides user management, OIDC, and multi-tenancy.
- authelia/authelia29k stars
An authentication and authorization server that provides two-factor auth and single sign-on for applications.
- pgaudit/pgaudit1.7k stars
A PostgreSQL extension that records what was done to the database, in the database's own log.
- openbao/openbao8.6k stars
A secrets manager that stores keys and passwords, hands them out on request, and can revoke them.
- future-architect/vuls12k stars
Scans Linux machines over SSH for installed software with publicly reported security holes.
git clone https://github.com/dexidp/dex.git cd dex make build