通過 OpenID Connect 提供商進行身份驗證¶

dockerrun-p8080:8080-eKEYCLOAK_ADMIN=admin-eKEYCLOAK_ADMIN_PASSWORD=admin\
quay.io/keycloak/keycloak:21.1.1start-dev

$gitclonehttps://github.com/dexidp/dex.git
$cddex/
$makebuild

./bin/dexserveexamples/config-dev.yaml

 # dex 的基本路徑和 OpenID Connect 服務的外部名稱。
 # 這是所有客戶端必須用來引用 dex 的規範 URL。
 issuer:http://127.0.0.1:5556/dex

 # 存儲配置決定了 dex 存儲其狀態的位置。支持的
 # 選項包括 SQL 資料庫和 Kubernetes 第三方資源。
 #
 # 有關詳細信息,請參閱文檔 (https://dexidp.io/docs/storage/)。
 storage:
 type:sqlite3
 config:
 file:examples/dex.db

 # type: mysql
 # config:
 # host: localhost
 # port: 3306
 # database: dex
 # user: mysql
 # password: mysql
 # ssl:
 # mode: "false"

 # type: postgres
 # config:
 # host: localhost
 # port: 5432
 # database: dex密碼
 # user: postgres
 # password: postgres
 # ssl:
 # mode: disable

 # type: etcd
 # config:
 # endpoints:
 # - http://localhost:2379
 # namespace: dex/

 # type: kubernetes
 # config:
 # kubeConfigFile: $HOME/.kube/config

 # HTTP 端點的配置。
 web:
 http:0.0.0.0:5556
 # 如果要配置 HTTPS 選項請使用下列的註釋。
 # https: 127.0.0.1:5554
 # tlsCert: /etc/dex/tls.crt
 # tlsKey: /etc/dex/tls.key

 # dex外觀的配置
 # frontend:
 # issuer: dex
 # logoURL: theme/logo.png
 # dir: web/
 # theme: light

 # 遙測配置
 telemetry:
 http:0.0.0.0:5558
 # enableProfiling: true

 # 取消下列註釋以啟用 gRPC API。這個值必須不同於在 "HTTP 端點的配置"。
 # grpc:
 # addr: 127.0.0.1:5557
 # tlsCert: examples/grpc-client/server.crt
 # tlsKey: examples/grpc-client/server.key
 # tlsClientCA: examples/grpc-client/ca.crt

 # 取消此區塊註釋以啟用相關token有效持續時間的配置。
 # 可以僅使用 s、m 和 h 後綴指定單位。
 # expiry:
 # deviceRequests: "5m"
 # signingKeys: "6h"
 # idTokens: "24h"
 # refreshTokens:
 # reuseInterval: "3s"
 # validIfNotUsedFor: "2160h" # 90 days
 # absoluteLifetime: "3960h" # 165 days

 # 用於控制日誌的選項。
 # logger:
 # level: "debug"
 # format: "text" # can also be "json"

 # 預設值如下所示
 # oauth2:
 # 使用 ["code", "token", "id_token"] 為 web-only 客戶端啟用 implicit flow
 # responseTypes: [ "code" ] # also allowed are "token" and "id_token"

 # 默認情況下,Dex 會請求批准與應用程序共享數據
 #(批准從連接的 IdP 到 Dex 的共享數據是 IdP 上的單獨過程)
 # skipApprovalScreen: false

 # 如果只啟用一種身份驗證方法,則默認行為是直接去吧。
 # 對於已連接的 IdP,這會將瀏覽器重定向到上游 IdP 提供商,例如 Google 登錄頁面
 # alwaysShowLoginScreen: false

 # 取消下列註釋以使用特定連接器進行密碼授予
 # passwordConnector: local

 # 若不是從外部存儲讀取,也可使用這個靜態配置的客戶端列表。
 #
 # 如果不使用靜態配置,也可以通過 gRPC API 添加客戶端。
 staticClients:
 -id:example-app
 redirectURIs:
 -'http://127.0.0.1:5555/callback'
 name:'ExampleApp'
 secret:ZXhhbXBsZS1hcHAtc2VjcmV0
 # - id: example-device-client
 # redirectURIs:
 # - /device/callback
 # name: 'Static Client for Device Flow'
 # public: true

 connectors:
 -type:mockCallback
 id:mock
 name:Example
 # - type: google
 # id: google
 # name: Google
 # config:
 # issuer: https://accounts.google.com
 # # Connector config values starting with a "$" will read from the environment.
 # clientID: $GOOGLE_CLIENT_ID
 # clientSecret: $GOOGLE_CLIENT_SECRET
 # redirectURI: http://127.0.0.1:5556/dex/callback
 # hostedDomains:
 # - $GOOGLE_HOSTED_DOMAIN

 -type:oidc
 id:keycloak
 name:Keycloak
 config:
 issuer:http://127.0.0.1:8080/realms/master
 # # Connector config values starting with a "$" will read from the environment.
 clientID:dex-oidc-keycloak
 clientSecret:JiaBlyreunTlfFV0CLi0rH4eHRXrKExD
 redirectURI:http://127.0.0.1:5556/dex/callback
 # 由於 keycloak 的 JWT 令牌的 claims 裡並沒有 `name` 的 claim
 # 因此把 preferred_username 映射成 dex 所需要的 `name` claim
 userNameKey:preferred_username
  # 讓 dex 保留一個密碼列表,可以用來登錄 dex。
 enablePasswordDB:true

 # 用於登錄最終用戶的靜態密碼列表。通過在這裡識別,dex
 # 不會在其底層存儲中查找密碼。
 #
 # 如果不是使用此選項,則可以通過 gRPC API 添加用戶與密碼。
 staticPasswords:
 -email:"admin@example.com"
 # bcrypt hash of the string "password": $(echo password | htpasswd -BinC 10 admin | cut -d: -f2)
 hash:"2ドルa10ドル2ドルb2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
 username:"admin"
 userID:"08a8684b-db88-4b73-90a9-3cd1661f5466"

 c.Flags().StringVar(&a.clientID,"client-id","example-app","OAuth2 client ID of this application.")
 c.Flags().StringVar(&a.clientSecret,"client-secret","ZXhhbXBsZS1hcHAtc2VjcmV0","OAuth2 client secret of this application.")
 c.Flags().StringVar(&a.redirectURI,"redirect-uri","http://127.0.0.1:5555/callback","Callback URL for OAuth2 responses.")
 c.Flags().StringVar(&issuerURL,"issuer","http://127.0.0.1:5556/dex","URL of the OpenID Connect issuer.")
 c.Flags().StringVar(&listen,"listen","http://127.0.0.1:5555","HTTP(S) address to listen at.")
 c.Flags().StringVar(&tlsCert,"tls-cert","","X509 cert file to present when serving HTTPS.")
 c.Flags().StringVar(&tlsKey,"tls-key","","Private key for the HTTPS cert.")
 c.Flags().StringVar(&rootCAs,"issuer-root-ca","","Root certificate authorities for the issuer. Defaults to host certs.")
 c.Flags().BoolVar(&debug,"debug",false,"Print all request and responses from the OpenID Connect issuer.")

$cddex/
$makeexamples

./bin/example-app