SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-22 22:13:36 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Dex IdP Integration #347

New Issue
Closed
opened 2025-11-20 05:09:58 -05:00 by saavagebueno · 5 comments
saavagebueno commented 2025-11-20 05:09:58 -05:00
Owner
Copy Link

Originally created by @boynoiz on GitHub (May 25, 2023).

Is there any guide for setup Netbird self-host with Dex IdP?
or plan for supporting Dex IdP?

Originally created by @boynoiz on GitHub (May 25, 2023). Is there any guide for setup Netbird self-host with Dex IdP? or plan for supporting Dex IdP?
saavagebueno added the waiting-feedbackhelp wanted labels 2025-11-20 05:09:58 -05:00
saavagebueno commented 2025-11-20 05:09:59 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jun 16, 2023):

Hello @boynoiz we are looking into adding DEX as one of our supported integrations. Below you find a sample configuration for it.

issuer: https://auth.example.com/

storage:
  type: sqlite3
  config:
    file: examples/dex.db

# HTTP service configuration
web:
  http: 0.0.0.0:9000
  allowedOrigins: ['*']

frontend:
  issuer: dex
  logoURL: https://github.com/netbirdio/netbird/blob/main/docs/media/logo-full.png
  dir: /opt/dex/web

# OAuth2 configuration
oauth2:
  responseTypes: ["code", "token", "id_token"] # also allowed are "token" and "id_token"
  skipApprovalScreen: false
  alwaysShowLoginScreen: true

staticClients:
  - id: netbird-dex
    public: true
    redirectURIs:
      - 'https://netbird.example.com/#callback'
      - '/device/callback'
    name: 'Netbird VPN'

connectors:
- type: mockCallback
  id: mock
  name: Example

enablePasswordDB: true
# A static list of passwords to login the end user. By identifying here, dex
# won't look in its underlying storage for passwords.
#
# If this option isn't chosen users may be added through the gRPC API.
staticPasswords:
- email: "admin@example.com"
  # bcrypt hash of the string "password": $(echo password | htpasswd -BinC 10 admin | cut -d: -f2)
  hash: "$2a$10$23jbrk1bkjl1nk3ln2k3rnkjnrkj4nrkj3n4kj3n4jkrn3kj4"
  username: "admin"
  userID: "92929292-db88-3333-22222-111111"

Maybe @Thunderbottom would have a bit more of insights into the dashboard and management settings.

@mlsmaycon commented on GitHub (Jun 16, 2023): Hello @boynoiz we are looking into adding DEX as one of our supported integrations. Below you find a sample configuration for it. ```yaml issuer: https://auth.example.com/ storage: type: sqlite3 config: file: examples/dex.db # HTTP service configuration web: http: 0.0.0.0:9000 allowedOrigins: ['*'] frontend: issuer: dex logoURL: https://github.com/netbirdio/netbird/blob/main/docs/media/logo-full.png dir: /opt/dex/web # OAuth2 configuration oauth2: responseTypes: ["code", "token", "id_token"] # also allowed are "token" and "id_token" skipApprovalScreen: false alwaysShowLoginScreen: true staticClients: - id: netbird-dex public: true redirectURIs: - 'https://netbird.example.com/#callback' - '/device/callback' name: 'Netbird VPN' connectors: - type: mockCallback id: mock name: Example enablePasswordDB: true # A static list of passwords to login the end user. By identifying here, dex # won't look in its underlying storage for passwords. # # If this option isn't chosen users may be added through the gRPC API. staticPasswords: - email: "admin@example.com" # bcrypt hash of the string "password": $(echo password | htpasswd -BinC 10 admin | cut -d: -f2) hash: "$2a$10$23jbrk1bkjl1nk3ln2k3rnkjnrkj4nrkj3n4kj3n4jkrn3kj4" username: "admin" userID: "92929292-db88-3333-22222-111111" ``` Maybe @Thunderbottom would have a bit more of insights into the dashboard and management settings.
saavagebueno commented 2025-11-20 05:09:59 -05:00
Author
Owner
Copy Link

@Thunderbottom commented on GitHub (Jun 20, 2023):

Sorry, was away. I could help you out in a while with the complete configuration.

Quick Edit:

Here's the dex configuration you need. This config is for when you're using Google as a provider for dexIdP:

# The base path of Dex and the external name of the OpenID Connect service.
# This is the canonical URL that all clients MUST use to refer to Dex. If a
# path is provided, Dex's HTTP service will listen at a non-root URL.
issuer: https://auth.company.com

# The storage configuration determines where Dex stores its state.
# Supported options include:
#   - SQL flavors
#   - key-value stores (eg. etcd)
#   - Kubernetes Custom Resources
#
# See the documentation (https://dexidp.io/docs/storage/) for further information.
storage:
  type: postgres
  config:
    host: localhost
    port: 5432
    database: dexidp
    user: idpdex
    password: stronkpassword
    ssl:
      mode: disable

# HTTP service configuration
web:
  http: 0.0.0.0:9000
  allowedOrigins: ['*']

# Expiration configuration for tokens, signing keys, etc.
expiry:
  deviceRequests: "5m"
  signingKeys: "2160h"
  idTokens: "24h"
  refreshTokens:
    disableRotation: false
    reuseInterval: "3s"
    validIfNotUsedFor: "2160h" # 90 days
    absoluteLifetime: "3960h" # 165 days

# OAuth2 configuration
oauth2:
  responseTypes: ["code", "token", "id_token"] # also allowed are "token" and "id_token"

#   # By default, Dex will ask for approval to share data with application
#   # (approval for sharing data from connected IdP to Dex is separate process on IdP)
  skipApprovalScreen: false

#   # If only one authentication method is enabled, the default behavior is to
#   # go directly to it. For connected IdPs, this redirects the browser away
#   # from application to upstream provider such as the Google login page
  alwaysShowLoginScreen: false

# Static clients registered in Dex by default.
#
# Alternatively, clients may be added through the gRPC API.
staticClients:
  - id: netbird-dex
    public: true
    redirectURIs:
      - 'https://netbird.url/#callback'
      - '/device/callback'
    name: 'Netbird'

# Connectors are used to authenticate users agains upstream identity providers.
#
# See the documentation (https://dexidp.io/docs/connectors/) for further information.
connectors:
- type: google
  id: google
  name: Google
  config:
    issuer: https://accounts.google.com
    clientID: your-apps-clientid.apps.googleusercontent.com
    clientSecret: GOCSPX-stronkSecret
    redirectURI: https://auth.company.com/callback
    # userIDKey: email
    # getUserInfo: true
    hostedDomains:
    - company.com

# Enable the password database.
#
# It's a "virtual" connector (identity provider) that stores
# login credentials in Dex's store.
# enablePasswordDB: true

# If this option isn't chosen users may be added through the gRPC API.
# A static list of passwords for the password connector.
#
# Alternatively, passwords my be added/updated through the gRPC API.
# staticPasswords: []

You'll also need to set up a reverse proxy, which you do with nginx/caddy/load balancer, etc.

For configuring UI on dexIdP, check this link out.

On Netbird management and dashboard side, all you need is these variables set in your environment:

Dashboard
AUTH_AUDIENCE=netbird-dex
AUTH_CLIENT_ID=netbird-dex
AUTH_AUTHORITY=https://auth.company.com
USE_AUTH0=false
AUTH_SUPPORTED_SCOPES=openid email groups profile offline_access
NETBIRD_TOKEN_SOURCE=accessToken
AUTH_REDIRECT_URI=
AUTH_SILENT_REDIRECT_URI=
Management
"HttpConfig": {
        "Address": "0.0.0.0:443",
        "AuthIssuer": "https://auth.company.com",
        "AuthAudience": "netbird-dex",
        "AuthKeysLocation": "https://auth.company.com/keys",
        "AuthUserIDClaim": "email",
        "OIDCConfigEndpoint":"https://auth.company.com/.well-known/openid-configuration"
    }
@Thunderbottom commented on GitHub (Jun 20, 2023): Sorry, was away. I could help you out in a while with the complete configuration. #### Quick Edit: Here's the dex configuration you need. This config is for when you're using Google as a provider for dexIdP: ```yaml # The base path of Dex and the external name of the OpenID Connect service. # This is the canonical URL that all clients MUST use to refer to Dex. If a # path is provided, Dex's HTTP service will listen at a non-root URL. issuer: https://auth.company.com # The storage configuration determines where Dex stores its state. # Supported options include: # - SQL flavors # - key-value stores (eg. etcd) # - Kubernetes Custom Resources # # See the documentation (https://dexidp.io/docs/storage/) for further information. storage: type: postgres config: host: localhost port: 5432 database: dexidp user: idpdex password: stronkpassword ssl: mode: disable # HTTP service configuration web: http: 0.0.0.0:9000 allowedOrigins: ['*'] # Expiration configuration for tokens, signing keys, etc. expiry: deviceRequests: "5m" signingKeys: "2160h" idTokens: "24h" refreshTokens: disableRotation: false reuseInterval: "3s" validIfNotUsedFor: "2160h" # 90 days absoluteLifetime: "3960h" # 165 days # OAuth2 configuration oauth2: responseTypes: ["code", "token", "id_token"] # also allowed are "token" and "id_token" # # By default, Dex will ask for approval to share data with application # # (approval for sharing data from connected IdP to Dex is separate process on IdP) skipApprovalScreen: false # # If only one authentication method is enabled, the default behavior is to # # go directly to it. For connected IdPs, this redirects the browser away # # from application to upstream provider such as the Google login page alwaysShowLoginScreen: false # Static clients registered in Dex by default. # # Alternatively, clients may be added through the gRPC API. staticClients: - id: netbird-dex public: true redirectURIs: - 'https://netbird.url/#callback' - '/device/callback' name: 'Netbird' # Connectors are used to authenticate users agains upstream identity providers. # # See the documentation (https://dexidp.io/docs/connectors/) for further information. connectors: - type: google id: google name: Google config: issuer: https://accounts.google.com clientID: your-apps-clientid.apps.googleusercontent.com clientSecret: GOCSPX-stronkSecret redirectURI: https://auth.company.com/callback # userIDKey: email # getUserInfo: true hostedDomains: - company.com # Enable the password database. # # It's a "virtual" connector (identity provider) that stores # login credentials in Dex's store. # enablePasswordDB: true # If this option isn't chosen users may be added through the gRPC API. # A static list of passwords for the password connector. # # Alternatively, passwords my be added/updated through the gRPC API. # staticPasswords: [] ``` You'll also need to set up a reverse proxy, which you do with nginx/caddy/load balancer, etc. For configuring UI on dexIdP, check [this link](https://dexidp.io/docs/templates/#using-your-own-templates) out. On Netbird management and dashboard side, all you need is these variables set in your environment: ##### Dashboard ```env AUTH_AUDIENCE=netbird-dex AUTH_CLIENT_ID=netbird-dex AUTH_AUTHORITY=https://auth.company.com USE_AUTH0=false AUTH_SUPPORTED_SCOPES=openid email groups profile offline_access NETBIRD_TOKEN_SOURCE=accessToken AUTH_REDIRECT_URI= AUTH_SILENT_REDIRECT_URI= ``` ##### Management ```json "HttpConfig": { "Address": "0.0.0.0:443", "AuthIssuer": "https://auth.company.com", "AuthAudience": "netbird-dex", "AuthKeysLocation": "https://auth.company.com/keys", "AuthUserIDClaim": "email", "OIDCConfigEndpoint":"https://auth.company.com/.well-known/openid-configuration" } ```
saavagebueno commented 2025-11-20 05:09:59 -05:00
Author
Owner
Copy Link

@boynoiz commented on GitHub (Jun 20, 2023):

Okay, I'll give it a try and will come back later.

Thank you very much :)

@boynoiz commented on GitHub (Jun 20, 2023): Okay, I'll give it a try and will come back later. Thank you very much :)
saavagebueno commented 2025-11-20 05:09:59 -05:00
Author
Owner
Copy Link

@markcst commented on GitHub (Jul 15, 2025):

Okay, I'll give it a try and will come back later.

Thank you very much :)

How did this end up?

I'm planning to use Dex instead of something resource-intensive like Zitadel, to reduce RAM/ROM usage

@markcst commented on GitHub (Jul 15, 2025): > Okay, I'll give it a try and will come back later. > > Thank you very much :) How did this end up? I'm planning to use Dex instead of something resource-intensive like Zitadel, to reduce RAM/ROM usage
saavagebueno commented 2025-11-20 05:09:59 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jul 15, 2025):

I'm planning to use Dex instead of something resource-intensive like Zitadel, to reduce RAM/ROM usage

@markcst Be aware that Dex is primarily a federating IdP, meaning it does not function as a standalone IdP outside development environments (users defined in a static file, with no way to assign Groups). You will still need something to provide the user accounts & groups as a kind of "backend".

I think one of best use cases for it are:

  • using it as a "stable interface" before you decide on a specific IdP implementatio. It should make it easier to switch between different identity providers without reconfiguring your whole infrastructure every time you do so. I plan to use it for this purpose sooner or later myself.
  • federating (aggregating) identities from multiple providers, something similar to what we use Auth0 for on our Cloud offering when setting up customers with their own SSO/Identity providers.
@nazarewk commented on GitHub (Jul 15, 2025): > I'm planning to use Dex instead of something resource-intensive like Zitadel, to reduce RAM/ROM usage @markcst Be aware that Dex is primarily a **federating** IdP, meaning it does not function as a standalone IdP outside development environments (users defined in a static file, with no way to assign Groups). You will still need **something** to provide the user accounts & groups as a kind of "backend". I think one of best use cases for it are: - using it as a "stable interface" before you decide on a specific IdP implementatio. It should make it easier to switch between different identity providers without reconfiguring your whole infrastructure every time you do so. I plan to use it for this purpose sooner or later myself. - federating (aggregating) identities from multiple providers, something similar to what we use Auth0 for on our Cloud offering when setting up customers with their own SSO/Identity providers.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label help wanted waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#347
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?