Skip to main content
Version: 3.0

Other (Dex)

Loft supports a variety of other auth providers. You can follow this generic guide to configure SSO for any of the auth providers, including:

  • OpenShift
  • LinkedIn
  • AuthProxy
  • Bitbucket Cloud
  • Atlassian Crowd
  • Gitea

  1. Choose DEX_HOSTNAME And Configure DNS

    Loft uses the CNCF project dex for single sign-on.

    The easiest case is this one:

    • $LOFT_HOSTNAME = loft.mycompany.tld (where Loft is running)
    • $DEX_HOSTNAME = dex.mycompany.tld (where dex should be running)

  2. Create Dex Config For $OTHER_PROVIDER

    Create the file dex-config.yaml with the following dex configuration:

    ingress:
      enabled: true
      hosts:
      - host: dex.yourcompany.tld                             # Use $DEX_HOSTNAME
        paths:
          - path: /
    config:
      issuer: https://dex.yourcompany.tld                     # "https://" + $DEX_HOSTNAME
      connectors:
      - {YOUR_CONNECTOR_CONFIG}                               # SEE LINKS BELOW! (do not remove the '-' and indent correctly)
      staticClients:
      - name: Loft
        id: loft                                              # Define a $DEX_CLIENT_ID
        secret: XXXXXXXXXXXXXX                                # Define a $DEX_CLIENT_SECRET (can be any secret key)
        redirectURIs:
        - 'https://loft.mycompany.tld/auth/oidc/callback'     # Loft URL + /auth/oidc/callback
      oauth2:
        skipApprovalScreen: true
      web:
        http: 0.0.0.0:5556
      storage:
        type: kubernetes
        config:
          inCluster: true

    Check the official artifacthub.io page for all available options.

    To fill the connectors section shown above, go to the appropriate docs page for the auth provider you want to use in combination with dex:

  3. Deploy Dex via Helm

    After creating the file dex-config.yaml, you can now install dex via helm:

    helm install dex dex --repo https://charts.dexidp.io \
      --create-namespace --namespace dex \
      -f dex-config.yaml \
      --wait

  4. Configure Loft To Use Dex For Authentication

    To tell Loft to use dex for SSO, navigate to Admin > Config in Loft and adjust your config as shown below:

    auth:
      oidc:
        issuerUrl: https://dex.mycompany.tld  # Use $DEX_HOSTNAME (see above)
        clientId: ""                          # Use $DEX_CLIENT_ID (see above)
        clientSecret: ""                      # Use $DEX_CLIENT_SECRET (see above)
        type: "github"                        # Optional: SSO Login Button Icon ("", github, gitlab, microsoft, google)
        usernameClaim: "email"                # Optional: Which part of the dex token to use as Loft username (default: email)
        usernamePrefix: ""                    # Optional: Add prefix to usernameClaim for Loft username
        groupsClaim: "groups"                 # Optional: Add Kubernetes groups for this user
        groupsPrefix: "loft-"                 # Optional: Prefix for Kubernetes groups
        caFile: ""                            # Optional: Path to a CA cert of dex within the Loft container (default: '')

  5. Authenticate via Dex + $OTHER_PROVIDER

    After saving the new Loft configuration, Loft will restart itself and you should be able to log in via $OTHER_PROVIDER and dex.

  6. Disable Username + Password Authentication (optional)

    To disable password-based authentication, navigate to Admin > Config add these two lines to your config:

    auth:
      oidc: ...             # This is your SSO configuration (make sure this is working!)
      password:
        disabled: true      # Disable password-based authentication