# Dex handling OIDC instead of directly using Apache

**URL:** <https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648>\
**Category:** Get Help\
**Tags:** question\
**Created:** [July 23, 2024, 9:31pm UTC](https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648 "2024-07-23T21:31:00Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![mjbludwig](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mjbludwig/32/684_2.png) [@mjbludwig](https://discourse.openondemand.org/u/mjbludwig)\
**Post date:** [July 23, 2024, 9:31pm UTC](https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648/1 "2024-07-23T21:31:00Z")

</div>

Hi All,

Wondering if anyone has setup Dex to authenticate to an OIDC IDP like Globus or CiLogon instead of local LDAP. I have setup OIDC directly in the OOD configs many times but I am wondering if anyone has done it via Dex before.

I suppose the main reason of wanting Dex in front doing the OIDC bits would be so one can utilize and customize the Dex splash page instead of when one does it via the OOD direct OIDC where the second you hit ood being unauthed, it just bounces you out to the IDP you are using.

Thanks,  
Morgan

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 26, 2024, 3:59pm UTC](https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648/2 "2024-07-26T15:59:32Z")

</div>

I have not, but apparently it can be configured to do it.

> **[Authentication Through an OpenID Connect Provider](https://dexidp.io/docs/connectors/oidc/)**
>
> Overview Dex is able to use another OpenID Connect provider as an authentication source. When logging in, dex will redirect to the upstream provider and perform the necessary OAuth2 flows to determine the end users email, username, etc. More details...

Though I have to say that OSC uses Keycloak for this. Keycloak is able to actually map and retain those mappings from the extrenal provider. If you connected Dex to CiLogon you’d likely have to do all the mapping yourself.

For example I use CiLogon at OSC and authenticate as my OSU user (`ohrstrom.4`). Keycloak knows this and is connected to the OSC LDAP. So when I authenticate as `ohrstrom.4` from OSU - Keycloak maps me to my OSC user and lets me in.

---

<div class="post-metadata">

**Author:** ![mjbludwig](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mjbludwig/32/684_2.png) [@mjbludwig](https://discourse.openondemand.org/u/mjbludwig)\
**Post date:** [July 26, 2024, 8:52pm UTC](https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648/3 "2024-07-26T20:52:33Z")

</div>

Hi Jeff,

Thanks, I was following that but was having issues and was wondering if A, the ood-portal.yml dex section would properly make the dex conf during generation when setting those bits and B, if anyone had done it before.

I also have a production OOD that has keycloak in front of it (first one I ever setup actually) and it does the same as you guys have with ldap. For other deployments that just use oidc directly to OOD I just have custom user\_auth\_mod.sh that do ldapsearch’s and handle mapping.

Thanks for the response!

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 26, 2024, 8:55pm UTC](https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648/4 "2024-07-26T20:55:39Z")

</div>

> [@mjbludwig](#):
>
> For other deployments that just use oidc directly to OOD I just have custom user\_auth\_mod.sh that do ldapsearch’s and handle mapping.

Just be careful with this. This `sh` script gets executed _always on every single request_. This is why I recommend Keycloak, for performance really. You’re invoking a shell script that’s reaching out to ldap on every single page (and all the assets that are loaded for that page, so that’s js files and images and so on), so it can get pretty hairy pretty quickly. Especially say if `ldapsearch` begins to slow down, that’s going to bubble up to apache in response times.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 26, 2024, 8:56pm UTC](https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648/5 "2024-07-26T20:56:40Z")

</div>

But to answer you’re question, it seems like you should be able to provide settings other than LDAP do that `dex` configuration. If you can’t, that’s a bug on our side because you should be able to.

---

<div class="post-metadata">

**Author:** ![mjbludwig](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mjbludwig/32/684_2.png) [@mjbludwig](https://discourse.openondemand.org/u/mjbludwig)\
**Post date:** [July 26, 2024, 9:08pm UTC](https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648/6 "2024-07-26T21:08:43Z")

</div>

Ah, that is very good to know, re performance. I am surprised I have not had an issue up to this point then. I will keep working on the dex oidc bits and update this so I can give an example in case anyone in the future comes looking.

Thanks Jeff!

---

<div class="post-metadata">

**Author:** ![mjbludwig](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mjbludwig/32/684_2.png) [@mjbludwig](https://discourse.openondemand.org/u/mjbludwig)\
**Post date:** [July 26, 2024, 9:17pm UTC](https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648/7 "2024-07-26T21:17:03Z")

</div>

I would suggest making note of that in the docs if its not in there already. I imagine I am not the only one who has been using that shim to do some more complicated stuff.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [January 22, 2025, 9:17pm UTC](https://discourse.openondemand.org/t/dex-handling-oidc-instead-of-directly-using-apache/3648/8 "2025-01-22T21:17:51Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.