dex

> If you are writing a new application, use OpenID Connect–skate to where the puck is going! I am glad to see this advice. At CoreOS we have now built API servers, command line tools, and web apps using OpenID Connect and are happy with its development in Open Source and third-party services as well. > OAuth2 was left generic so that it could be applied to many authorization requirements, When we started developing Dex[1] we lovingly referred to OpenID as "OAUTH 2.0 with types". Overall, from integrating OpenID Connect into our products, enabling Kubernetes[2] to use OpenID Connect Providers, and building both an OpenID Connect provider and clients we are pretty happy with the choice we made. My only complaint is the name of OpenID Connect is simply confusing. [1] https://github.com/coreos/dex [2] http://kubernetes.io/docs/admin/authentic

Of which virtually all of the components are open source, such as the most excellent auth service[1] for tectonic. [1] https://github.com/coreos/dex

We support OIDC connectors, so you can plug in LDAP using https://github.com/coreos/dex as one of the providers, or simply roll a new OIDC provider customized to your needs.

Disclaimer - I work at CoreOS and on the Kubernetes auth sub systems Today, most of the auth-N plugins[0] (the upstream equivalent to the OpenShift doc you linked to) are relatively minimal. Most of these are aimed at providing pluggability for other apps that focus on ease of use. Google uses the webhook implementation for its GKE auth-N and we (CoreOS) continue to try to make our OpenID Connect server federate to more backends (LDAP, GitHub, etc.).[1] With these kind of tooling, it's completely possible to map auth-Z policies to, say a group of LDAP users. But yes, there's a lack of canonical documentation on how to go about this. We're always trying to negotiate how much of this should live in core Kubernetes and how much should be provided by third party services (and what the upstream docs should endorse). But today I'd still (perhap

Also similar: https://github.com/coreos/dex

Looks like a viable and more robust alternative to what CoreOS is doing with dex which I feel sometimes is trying a bit too hard to be everything: https://github.com/coreos/dex Discussion and alternatives very much welcome. Ideally it would already come with its own set of dockerfiles to generate images to be integrated with development as well as of course deployment to staging/production environments.