Skip to content

ADR-005: Dex for SSO

Status: Approved

Date: 2026-06-30

Decision

Use Dex as the OIDC proxy in each client cluster instead of Keycloak.

Rationale

  • Lightweight (~50MB memory, stateless, no database)
  • Clients bring their own identity provider (Google Workspace, Microsoft Entra, GitHub, Okta, LDAP)
  • 7KGroup does not manage user passwords or identity databases
  • Native support for all major enterprise IdPs

Connector Strategy

Client IdP Dex Connector
Google Workspace google
Microsoft Entra ID microsoft
GitHub Organization github
Generic LDAP ldap
SAML 2.0 saml
No IdP (fallback) oidc → 7KGroup central Keycloak

Fallback

Clients without an enterprise IdP connect to a central 7KGroup Keycloak instance via Dex's oidc connector. One Keycloak realm, many Dex instances.

7KGroup Operator Access

The central Keycloak instance also provides a mechanism for 7KGroup platform operators to authenticate to client platforms (Backstage, observability, etc.) without requiring the client to add 7KGroup users to their corporate identity provider.

This works as follows:

  1. Each client Dex instance includes an additional oidc connector pointing to the 7KGroup Keycloak realm.
  2. 7KGroup operators authenticate via Keycloak and are mapped to a restricted group or role for that client.
  3. Client Backstage and other tools enforce authorization based on the operator group.
  4. All operator authentications are logged and auditable.

Security Controls

  • Operator accounts use short-lived sessions and MFA where supported.
  • Access is scoped per client; an operator in client A's group cannot access client B's platform.
  • Operator access is read-only by default. Write access requires explicit elevation and approval.
  • Quarterly access reviews of operator group memberships.

Notes

The fallback connector uses OIDC, not LDAP. Keycloak stores user identities and can itself federate to an internal user store or external directory as needed. 7KGroup operates this Keycloak instance in the management plane.

Operator access to client platforms is an intentional use of the central Keycloak instance, distinct from the client fallback identity use case. A separate runbook governs operator onboarding, access review, and offboarding.