Effortless enterprise authentication at Grab: Dex in action

Summary

Grab built Concedo to centralise access management, authentication, and authorisation across internal applications and external platforms. Its customised Google OAuth2.0-based mechanism created integration challenges with systems such as Databricks and Datadog, producing fragmented sign-on experiences and administrative overhead. To standardise identity, the team adopted OpenID Connect (OIDC) and used Dex, a federated OpenID Connect provider that aggregates identity providers and issues standardised OIDC tokens. Dex supports single sign-on, multiple identity providers, token delegation between trusted peer services, and a kill switch that can redirect traffic during an identity provider outage. The implementation separated application authentication concerns and established a single identity source, while a future phase will address fragmented authorisation through a unified model.

Takeaways

1. 1

   OIDC, built on OAuth 2.0, provides standardised user authentication and SSO across mobile, API, and browser-based applications.

2. 2

   Dex token exchange lets an authorised Service A mint a token scoped to both Service A and Service B, while Service B trusts Service A as a peer.

3. 3

   Dex’s multiple-IdP support enables a kill switch that shifts traffic during a provider outage without requiring changes in integrated services.