To connect Dex to on-premises Active Directory you do not use a cloud API token — you provide a dedicated domain service account and network access to a domain controller (usually via a Dex connector running inside the network).
Steps
1In Active Directory Users and Computers, create a dedicated service account (e.g. svc-dex) with a strong, non-expiring password — do not add it to Domain Admins.
2Delegate least-privilege rights on the target OUs: read access to user/group objects, plus write to specific attributes only if Dex must make changes (e.g. unlock accounts, group membership).
3Note the AD domain DNS name (e.g. corp.contoso.com) and the hostname/IP of a reachable domain controller.
4Ensure LDAP/LDAPS connectivity (TCP 389 / 636) from wherever the Dex connector runs to the domain controller.
5Provide Dex the service account username (UPN or DOMAIN\sAMAccountName), its password, the domain, and the domain-controller host.
Paste into Dex
The connection form in the Dex app store asks for these values:
