Skip to content

Add support for 'groups' (group memberships) to staticPasswords entries #4454

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
larsw wants to merge 2 commits into from
Closed

Add support for 'groups' (group memberships) to staticPasswords entries #4454

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
365ba85
Add support for adding 'groups' (group memberships) to user entries i…
larsw Dec 19, 2025
afa6834
Merge branch 'dexidp:master' into staticpasswords-groups-support
larsw Jan 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions cmd/dex/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,11 +95,12 @@ type password storage.Password

func (p *password) UnmarshalJSON(b []byte) error {
var data struct {
Email string `json:"email"`
Username string `json:"username"`
UserID string `json:"userID"`
Hash string `json:"hash"`
HashFromEnv string `json:"hashFromEnv"`
Email string `json:"email"`
Username string `json:"username"`
UserID string `json:"userID"`
Hash string `json:"hash"`
HashFromEnv string `json:"hashFromEnv"`
Groups []string `json:"groups"`
}
if err := json.Unmarshal(b, &data); err != nil {
return err
Expand All @@ -108,6 +109,7 @@ func (p *password) UnmarshalJSON(b []byte) error {
Email: data.Email,
Username: data.Username,
UserID: data.UserID,
Groups: data.Groups,
})
if len(data.Hash) == 0 && len(data.HashFromEnv) > 0 {
data.Hash = os.Getenv(data.HashFromEnv)
Expand Down
17 changes: 16 additions & 1 deletion cmd/dex/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,8 +116,13 @@ staticPasswords:
# bcrypt hash of the string "password"
hash: "$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy"
username: "admin"
groups:
- "administrators"
userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
- email: "foo@example.com"
groups:
- "developers"
- "testers"
# base64'd value of the same bcrypt hash above. We want to be able to parse both of these
hash: "JDJhJDEwJDMzRU1UMGNWWVZsUHk2V0FNQ0xzY2VMWWpXaHVIcGJ6NXl1Wnh1L0dBRmowM0o5THl0anV5"
username: "foo"
Expand All @@ -134,7 +139,7 @@ logger:
format: "json"

additionalFeatures: [
"ConnectorsCRUD"
"ConnectorsCRUD"
]
`)

Expand Down Expand Up @@ -207,12 +212,14 @@ additionalFeatures: [
StaticPasswords: []password{
{
Email: "admin@example.com",
Groups: []string{"administrators"},
Hash: []byte("$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy"),
Username: "admin",
UserID: "08a8684b-db88-4b73-90a9-3cd1661f5466",
},
{
Email: "foo@example.com",
Groups: []string{"developers", "testers"},
Hash: []byte("$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy"),
Username: "foo",
UserID: "41331323-6f44-45e6-b3b9-2c4b60c02be5",
Expand Down Expand Up @@ -331,11 +338,17 @@ connectors:
enablePasswordDB: true
staticPasswords:
- email: "admin@example.com"
groups:
- "administrators"
# bcrypt hash of the string "password"
hash: "$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy"
username: "admin"
userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
- email: "foo@example.com"
groups:
- "developers"
- "testers"
# hash is read from environment variable DEX_FOO_USER_PASSWORD
hashFromEnv: "DEX_FOO_USER_PASSWORD"
username: "foo"
userID: "41331323-6f44-45e6-b3b9-2c4b60c02be5"
Expand Down Expand Up @@ -421,12 +434,14 @@ logger:
StaticPasswords: []password{
{
Email: "admin@example.com",
Groups: []string{"administrators"},
Hash: []byte("$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy"),
Username: "admin",
UserID: "08a8684b-db88-4b73-90a9-3cd1661f5466",
},
{
Email: "foo@example.com",
Groups: []string{"developers", "testers"},
Hash: []byte("$2a$10$33EMT0cVYVlPy6WAMCLsceLYjWhuHpbz5yuZxu/GAFj03J9Lytjuy"),
Username: "foo",
UserID: "41331323-6f44-45e6-b3b9-2c4b60c02be5",
Expand Down
4 changes: 4 additions & 0 deletions config.dev.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,10 @@ enablePasswordDB: true

staticPasswords:
- email: "admin@example.com"
groups:
- "administrators"
- "developers"
- "testers"
hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
username: "admin"
userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
3 changes: 3 additions & 0 deletions storage/storage.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -354,6 +354,9 @@ type Password struct {

// Randomly generated user ID. This is NOT the primary ID of the Password object.
UserID string `json:"userID"`

// Groups associated with the password entry.
Groups []string `json:"groups"`
}

// Connector is an object that contains the metadata about connectors used to login to Dex.
Expand Down