upstream dex release: v2.28.0

The official docker release for this release can be pulled from

```
ghcr.io/dexidp/dex:v2.28.0
```

**Features:**

- Add c_hash to id_token, issued on /auth endpoint, when in hybrid flow (dexidp#1773, @HEllRZA)
- Allow configuration of returned auth proxy header (dexidp#1839, @seuf)
- Allow to disable os.ExpandEnv for storage + connector configs by env variable DEX_EXPAND_ENV = false (dexidp#1902, @heidemn-faro)
- Added the possibility to activate lowercase for UPN-Strings (dexidp#1888, @VF-mbrauer)
- Add "Cache-control: no-store" and "Pragma: no-cache" headers to token responses (dexidp#1948, @nabokihms)
- Add gomplate to the docker image (dexidp#1893, @nabokihms)
- Graceful shutdown (dexidp#1963, @nabokihms)
- Allow public clients created with API to have no client_secret (dexidp#1871, @spohner)

**Bugfixes:**

- Fix the etcd PKCE AuthCode deserialization (dexidp#1908, @bnu0)
- Fix garbage collection logging of device codes and device request (dexidp#1918, @nabokihms)
- Discovery endpoint contains updated claims and auth methods (dexidp#1951, @nabokihms)
- Return invalid_grant error if auth code is invalid or expired (dexidp#1952, @nabokihms)
- Return an error to auth requests with the "request" parameter (dexidp#1956, @nabokihms)

**Minor changes:**

- Change default themes to light/dark (dexidp#1858, @nabokihms)
- Various developer experience improvements
- Dependency upgrades
- Tons of small fixes and changes

cmd/dex/config.go

@@ -10,13 +10,13 @@ import (
 
 	"golang.org/x/crypto/bcrypt"
 
-	"github.com/dexidp/dex/pkg/log"
-	"github.com/dexidp/dex/server"
-	"github.com/dexidp/dex/storage"
-	"github.com/dexidp/dex/storage/etcd"
-	"github.com/dexidp/dex/storage/kubernetes"
-	"github.com/dexidp/dex/storage/memory"
-	"github.com/dexidp/dex/storage/sql"
+	"github.com/concourse/dex/pkg/log"
+	"github.com/concourse/dex/server"
+	"github.com/concourse/dex/storage"
+	"github.com/concourse/dex/storage/etcd"
+	"github.com/concourse/dex/storage/kubernetes"
+	"github.com/concourse/dex/storage/memory"
+	"github.com/concourse/dex/storage/sql"
 )
 
 // Config is the config format for the main application.

cmd/dex/config_test.go

@@ -7,11 +7,11 @@ import (
 	"github.com/ghodss/yaml"
 	"github.com/kylelemons/godebug/pretty"
 
-	"github.com/dexidp/dex/connector/mock"
-	"github.com/dexidp/dex/connector/oidc"
-	"github.com/dexidp/dex/server"
-	"github.com/dexidp/dex/storage"
-	"github.com/dexidp/dex/storage/sql"
+	"github.com/concourse/dex/connector/mock"
+	"github.com/concourse/dex/connector/oidc"
+	"github.com/concourse/dex/server"
+	"github.com/concourse/dex/storage"
+	"github.com/concourse/dex/storage/sql"
 )
 
 var _ = yaml.YAMLToJSON

cmd/dex/serve.go

@@ -29,9 +29,9 @@ import (
 	"google.golang.org/grpc/reflection"
 
 	"github.com/dexidp/dex/api/v2"
-	"github.com/dexidp/dex/pkg/log"
-	"github.com/dexidp/dex/server"
-	"github.com/dexidp/dex/storage"
+	"github.com/concourse/dex/pkg/log"
+	"github.com/concourse/dex/server"
+	"github.com/concourse/dex/storage"
 )
 
 type serveOptions struct {

cmd/dex/version.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/dexidp/dex/version"
+	"github.com/concourse/dex/version"
 )
 
 func commandVersion() *cobra.Command {

connector/atlassiancrowd/atlassiancrowd.go

@@ -13,9 +13,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/groups"
+	"github.com/concourse/dex/pkg/log"
 )
 
 // Config holds configuration options for Atlassian Crowd connector.

connector/authproxy/authproxy.go

@@ -8,8 +8,8 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/log"
 )
 
 // Config holds the configuration parameters for a connector which returns an

connector/bitbucketcloud/bitbucketcloud.go

@@ -14,9 +14,9 @@ import (
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/bitbucket"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/groups"
+	"github.com/concourse/dex/pkg/log"
 )
 
 const (

connector/bitbucketcloud/bitbucketcloud_test.go

@@ -10,7 +10,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 func TestUserGroups(t *testing.T) {

connector/cf/cf.go

@@ -16,8 +16,8 @@ import (
 
 	"golang.org/x/oauth2"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/log"
 )
 
 type cfConnector struct {

connector/cf/cf_test.go

@@ -12,7 +12,7 @@ import (
 
 	"github.com/sirupsen/logrus"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 func TestOpen(t *testing.T) {

connector/gitea/gitea.go

@@ -14,8 +14,8 @@ import (
 
 	"golang.org/x/oauth2"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/log"
 )
 
 // Config holds configuration options for gitea logins.

connector/gitea/gitea_test.go

@@ -9,7 +9,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 // tests that the email is used as their username when they have no username set

connector/github/github.go

@@ -19,9 +19,9 @@ import (
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/github"
 
-	"github.com/dexidp/dex/connector"
-	groups_pkg "github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	groups_pkg "github.com/concourse/dex/pkg/groups"
+	"github.com/concourse/dex/pkg/log"
 )
 
 const (

connector/github/github_test.go

@@ -12,7 +12,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 type testResponse struct {

connector/gitlab/gitlab.go

@@ -12,9 +12,9 @@ import (
 
 	"golang.org/x/oauth2"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/groups"
+	"github.com/concourse/dex/pkg/log"
 )
 
 const (

connector/gitlab/gitlab_test.go

@@ -10,7 +10,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 func TestUserGroups(t *testing.T) {

connector/google/google.go

@@ -15,9 +15,9 @@ import (
 	admin "google.golang.org/api/admin/directory/v1"
 	"google.golang.org/api/option"
 
-	"github.com/dexidp/dex/connector"
-	pkg_groups "github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	pkg_groups "github.com/concourse/dex/pkg/groups"
+	"github.com/concourse/dex/pkg/log"
 )
 
 const (

connector/keystone/keystone.go

@@ -9,8 +9,8 @@ import (
 	"io/ioutil"
 	"net/http"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/log"
 )
 
 type conn struct {

connector/keystone/keystone_test.go

@@ -12,7 +12,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 const (

connector/ldap/ldap.go

@@ -12,8 +12,8 @@ import (
 
 	"gopkg.in/ldap.v2"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/log"
 )
 
 // Config holds the configuration parameters for the LDAP connector. The LDAP

connector/ldap/ldap_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/kylelemons/godebug/pretty"
 	"github.com/sirupsen/logrus"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 // connectionMethod indicates how the test should connect to the LDAP server.

connector/linkedin/linkedin.go

@@ -11,8 +11,8 @@ import (
 
 	"golang.org/x/oauth2"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/log"
 )
 
 const (

connector/microsoft/microsoft.go

@@ -15,9 +15,9 @@ import (
 
 	"golang.org/x/oauth2"
 
-	"github.com/dexidp/dex/connector"
-	groups_pkg "github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	groups_pkg "github.com/concourse/dex/pkg/groups"
+	"github.com/concourse/dex/pkg/log"
 )
 
 // GroupNameFormat represents the format of the group identifier

connector/microsoft/microsoft_test.go

@@ -9,7 +9,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 type testResponse struct {

connector/mock/connectortest.go

@@ -8,8 +8,8 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/log"
 )
 
 // NewCallbackConnector returns a mock connector which requires no user interaction. It always returns

connector/oauth/oauth.go

@@ -16,8 +16,8 @@ import (
 
 	"golang.org/x/oauth2"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/log"
 )
 
 type oauthConnector struct {

connector/oauth/oauth_test.go

@@ -16,7 +16,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	jose "gopkg.in/square/go-jose.v2"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 func TestOpen(t *testing.T) {

connector/oidc/oidc.go

@@ -18,8 +18,8 @@ import (
 	"github.com/coreos/go-oidc/v3/oidc"
 	"golang.org/x/oauth2"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/log"
 )
 
 // Config holds configuration options for OpenID Connect logins.

connector/oidc/oidc_test.go

@@ -19,7 +19,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"gopkg.in/square/go-jose.v2"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 func TestKnownBrokenAuthHeaderProvider(t *testing.T) {

connector/openshift/openshift.go

@@ -14,10 +14,10 @@ import (
 
 	"golang.org/x/oauth2"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
-	"github.com/dexidp/dex/storage/kubernetes/k8sapi"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/groups"
+	"github.com/concourse/dex/pkg/log"
+	"github.com/concourse/dex/storage/kubernetes/k8sapi"
 )
 
 // Config holds configuration options for OpenShift login

connector/openshift/openshift_test.go

@@ -13,8 +13,8 @@ import (
 	"github.com/sirupsen/logrus"
 	"golang.org/x/oauth2"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/storage/kubernetes/k8sapi"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/storage/kubernetes/k8sapi"
 )
 
 func TestOpen(t *testing.T) {

connector/saml/saml.go

@@ -19,9 +19,9 @@ import (
 	dsig "github.com/russellhaering/goxmldsig"
 	"github.com/russellhaering/goxmldsig/etreeutils"
 
-	"github.com/dexidp/dex/connector"
-	"github.com/dexidp/dex/pkg/groups"
-	"github.com/dexidp/dex/pkg/log"
+	"github.com/concourse/dex/connector"
+	"github.com/concourse/dex/pkg/groups"
+	"github.com/concourse/dex/pkg/log"
 )
 
 // nolint

connector/saml/saml_test.go

@@ -14,7 +14,7 @@ import (
 	dsig "github.com/russellhaering/goxmldsig"
 	"github.com/sirupsen/logrus"
 
-	"github.com/dexidp/dex/connector"
+	"github.com/concourse/dex/connector"
 )
 
 // responseTest maps a SAML 2.0 response object to a set of expected values.

examples/go.mod

@@ -1,4 +1,4 @@
-module github.com/dexidp/dex/examples
+module github.com/concourse/dex/examples
 
 go 1.14
 

go.mod

@@ -1,4 +1,4 @@
-module github.com/dexidp/dex
+module github.com/concourse/dex
 
 go 1.16
 

pkg/groups/groups_test.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/dexidp/dex/pkg/groups"
+	"github.com/concourse/dex/pkg/groups"
 )
 
 func TestFilter(t *testing.T) {