Set Up Authentication Using the Default Dex Identity Provider

GoodData.CN can deploy Dex, a built-in OpenID Connect (OIDC) identity provider. Dex lets you create and manage user credentials without setting up an external OIDC provider.

Testing Environments Only

Dex is intended for testing, evaluation, and proof-of-concept deployments. It exposes the full user list, including users outside your organization. For production, use an external OIDC provider such as Okta, Auth0, or Google and follow Set Up Authentication.

Enable Dex

The chart deploys Dex by default (deployDexIdP: true), but the Production Deployment guide overrides this with deployDexIdP: false, so installs that follow the guide do not run Dex. To use Dex, set deployDexIdP: true in your gdcn-values.yaml and add the dex configuration block:

deployDexIdP: true

dex:
  config:
    database:
      sslMode: require
    web:
      allowedOrigins:
        # One entry per organization hostname
        - "<ORGANIZATION_HOSTNAME>"
  ingress:
    authHost: "<AUTH_HOSTNAME>"
    ingressClassName: "<YOUR_INGRESS_CLASS_NAME>"
    annotations: {}

<AUTH_HOSTNAME> must resolve to your ingress and have a valid TLS certificate. Apply the change with helm upgrade before you continue.

Using Dex with Istio Gateway and wildcard certificates

If you enable Istio Gateway mode and use a wildcard TLS certificate on the shared Gateway, do not host Dex on a hostname covered by that wildcard certificate. Envoy does not allow overlapping wildcard and specific certificates on the same Gateway. Deploy Dex on a separate hostname with its own certificate that does not overlap with the wildcard domain. See Switch to Istio Service Mesh and Gateway.

Prerequisites

Before proceeding, ensure:

  • Dex is enabled in your gdcn-values.yaml and the deployment has been upgraded.
  • You have created your organization.
  • You know the admin username and password you configured when creating the Organization.

Create a Bootstrap Token

You need a bootstrap token to call administrative APIs (for example, to create Dex users and map them to your Organization).

Steps:

  1. Construct a token string in the format:

    <adminUser>:bootstrap:<adminPassword>

    for example:

    admin:bootstrap:MySecretPassword

  2. Encode the string using Base64:

    echo -n 'admin:bootstrap:MySecretPassword' | base64

    Keep the -n option, without it the token will be invalid.

Your encoded token will look similar to:

YWRtaW46Ym9vdHN0cmFwOk15U2VjcmV0UGFzc3dvcmQ=

Store the token securely, it grants full administrative access.

The examples below assume you exported the token and your organization hostname:

export BOOTSTRAP_API_TOKEN='YWRtaW46Ym9vdHN0cmFwOk15U2VjcmV0UGFzc3dvcmQ='
export HOST_URL='https://<ORGANIZATION_HOSTNAME>'

Manage Users in Dex

Once Dex is deployed, populate it with one or more users.

Create User 

curl -H "Authorization: Bearer $BOOTSTRAP_API_TOKEN" \
     -H "Content-type: application/json" \
     -d '{"email": "boss@alpha.example.com", "password": "123456", "displayName": "John Doe"}' \
     --request POST $HOST_URL/api/v1/auth/users

The response includes an authenticationId. Save this value; you need it to map the user to the Organization.

Update User 

curl -H "Authorization: Bearer $BOOTSTRAP_API_TOKEN" \
     -H "Content-type: application/json" \
     -d '{"email": "boss@alpha.example.com", "password": "Bett3rPa$$w0rd", "displayName": "John Doe"}' \
     --request PUT $HOST_URL/api/v1/auth/users/boss@alpha.example.com

List, View, and Delete Users

In addition to creating and updating a user, you can also perform these actions:

  • List all users — submit a GET request to /api/v1/auth/users. This request returns all users in Dex, including those outside your organization.

  • View a user — submit a GET request to /api/v1/auth/users/{email}.

  • Delete a user — submit a DELETE request to /api/v1/auth/users/{email}. This deletes the user’s credentials but does not fully remove the user. To remove the user completely, also delete their mapping from the Organization.

Map Users to Organization

After creating users in Dex, map them to your organization using their authenticationId. See Map Users to an Organization.

Security Hardening
Istio Gateway