dex and local users/groups

[shacktown]

Hello Dex heroes,

I am developing an application with support for multiple Idp's using Dex (AD and OIDC).
I now need to support a use case using Windows local users/groups. The only way I see to do this is to use the Dex DB and add users through gRPC with my application. It looks like there was more support for this type scenario in Dex v1.

So, anyway, is this the best/correct approach? I would deploy a Postgres DB with Dex and add users via gRPC.
Thoughts and advice?

Thank you!

[allidoisace]

I don't know if this gets bumped, so I might make another discussion related to this, but I am curious about this as well.

Edit: Looks like it does get bumped.

My question which I figure is the same: I need to support users that can login with an email/password. I am assuming I can use the Dex DB with Postgres and dynamically generate these users through gRPC API?

[nabokihms]

@allidoisace, yes, this is a correct approach. In Flant, we use this scenario to generate temporary users if the main IdP is unavailable or if there are no other connectors enabled.

[allidoisace]

@nabokihms Thank you. Follow up question. We are using the sub claim in the JWT for relations. Is this value stored in the Postgres tables or is it generated automatically?

When we create a user, we want to apply relations immediately, but we can't if we don't have that sub for the Subject in our RBAC relations.

[nabokihms]

It is possible to predict the sub claim in this case.

Sub consists of two parts: connector id (in the case of passwords it always equals local), and user id (you can set it by calling CreatePassword gRPC method).

If you know user id and connector id, you can marshal the sub claim

dex/server/oauth2.go

Lines 314 to 323 in f49e7bc

	sub := &internal.IDTokenSubject{
	UserId: claims.UserID,
	ConnId: connID,
	}
	subjectString, err := internal.Marshal(sub)
	if err != nil {
	s.logger.Errorf("failed to marshal offline session ID: %v", err)
	return "", expiry, fmt.Errorf("failed to marshal offline session ID: %v", err)
	}