What is the use case for multiple connectors?

[maia-iyer]

Hello, I am just getting started learning about dex. Looking at the config, it looks like it allows for a list of connectors. I am confused by this case: if a client application connects to dex, how does it know which connector to connect to?

[nabokihms]

There is a connector picking screen shown to users when authenticating in dex with many configured connectors. You can bypass the screen by providing a connector ID in the auth URL path.

Why do people want to use more than one connector? Many reasons.

• Imagine you have an LDAP connector configured, but the network does not work. It is better to have a backup plan, like a local connector, to be able to access your app for debugging.
• developers are using GitHub authentication, but they are in the process of moving all the code to their Gitlab installations. New users are only created in Gitlab, so for the migration process, you need to enable both connectors.
• The legacy infra of an old company uses an active directory to store its users. A new and fancy company was acquired by the old one. In a new company, people were using a cloud Okta installation. So, you need to connect both providers to give access to both companies.

And so on.

[maia-iyer]

thank you so much for your reply - this makes a lot of sense!

If there are multiple dex clients and multiple connectors, is it possible to restrict which clients can access which upstream IdPs?
Also you mention providing connecter ID in the auth URL path - does that mean the client application must be aware of the connectors configured with dex?

[nabokihms]

For now this is not possible, but it sounds like a good feature request.

According to URL, it means yes.

[SaurabhAZip]

@nabokihms Following this conversation and i have a similar use case where client(another open source library) uses the URL that serves
.well-known/openid-configuration which in case of dex is ROOT path.
I am unable to tell client which IdP to use directly as individual connectors (/auth/{connector}/.well-known/openid-configuration) do not serve .well-known/openid-configuration

I have opened the discussion here.
#3491