Dex

Overview

Dex is an open-source OpenID Connect provider that federates to existing identity sources: applications talk OIDC to Dex, and Dex authenticates users against LDAP, GitHub, an upstream OIDC provider or another backend through "connectors," then issues signed ID tokens. CoreOS started it in 2016, and it was accepted into the CNCF at the Sandbox level on 25 June 2020, where it remains. It is Apache 2.0 licensed with no commercial owner; the GitHub repository had about 11,200 stars and shipped v2.46.1 on 21 October 2026. It is best known as the standard way to put SSO in front of the Kubernetes API server.

What it is good at

It does one job and keeps the footprint small. A single Go binary, configured in YAML, can store state in Kubernetes custom resources, etcd, SQLite, PostgreSQL or MySQL, so it runs inside a cluster without a separate database. The Kubernetes guide covers API server OIDC authentication with kubectl and kubelogin, and Dex passes upstream group membership into the groups claim, which maps cleanly to Kubernetes RBAC. The LDAP and GitHub connectors are marked stable and support refresh tokens and groups; GitLab, Microsoft and generic OIDC connectors are beta. A gRPC API manages clients and local passwords programmatically. For platform teams it removes the need to teach every internal tool about every identity source.

Where it falls short

It is a broker, not an identity platform. There is no admin console, no self-service registration or password reset, no SCIM provisioning, and no MFA documented in Dex itself, so second factors must be enforced upstream. Connector maturity varies: Google, generic OAuth 2.0, Bitbucket and Gitea are alpha, which Dex defines as possibly "untested by core maintainers." The biggest caveat is SAML. Dex's SAML connector page warns that it is "unmaintained, likely vulnerable to authentication bypass vulnerabilities" and under consideration for deprecation, and it cannot issue refresh tokens. That matters because many enterprise IdPs are wired up over SAML 2.0; prefer their OIDC endpoint. Support is community-only, with no vendor SLA.

Pricing

Free and open source under Apache 2.0, self-hosted. The real cost is the engineering time to run, upgrade and monitor it, which for a typical Kubernetes deployment is small. No paid edition exists.

Best for, and who should look elsewhere

Choose Dex when users already live in an IdP or directory and you need a lightweight OIDC front door for Kubernetes, Argo CD-style internal tools or CLI sign-in: a working deployment is usually a day of Helm values and connector configuration. Look elsewhere if you need a user store, MFA, an admin UI or SAML identity-provider features; Keycloak, Zitadel and authentik are full IdPs (Keycloak vs Zitadel). For workload rather than human identity in clusters, see the Kubernetes identity security guide.

Bottom line

The default lightweight OIDC broker for Kubernetes and internal tooling, as long as you federate over OIDC or LDAP rather than its unmaintained SAML connector. It complements an identity provider; it does not replace one.