argo-workflows: malformed Dex configuration found - Workflows & ArgoCD authentication

@sidh Thank you very much for your input. Finally it worked. Just to let everyone else know in descriptive manner. In following code where it says id: argo-workflows-sso it should be your actual client-id from OIDC provider. So let me rewrite the documentation part where we have this client id : Argo workflow secret :

apiVersion: v1
kind: Secret
metadata:
  name: argo-workflows-sso
data:
  # client-id is 'my-client-id-1234-1234'
  client-id: bXktY2xpZW50LWlkLTEyMzQtMTIzNAo=
  # client-secret is 'my-client-secret-very-secret'
  client-secret: bXktY2xpZW50LXNlY3JldC12ZXJ5LXNlY3JldAo=

Following code should be

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
data:
  # Kustomize sees the value of dex.config as a single string instead of yaml. It will not merge
  # Dex settings, but instead it will replace the entire configuration with the settings below,
  # so add these to the existing config instead of setting them in a separate file
  dex.config: |
    # Setting staticClients allows ArgoWorkflows to use ArgoCD's Dex installation for authentication
    staticClients:
      - id: my-client-id-1234-1234
        name: Argo Workflow
        redirectURIs:
          - https://argo-workflows.mydomain.com/oauth2/callback
        secretEnv: ARGO_WORKFLOWS_SSO_CLIENT_SECRET

Thats where documentation sucks as they are using argo-workflows-sso as a client-id too

@jrowinski3d Thank you very much for your input. Just figured it out before you posted. But really appreciate your help

Also DEX documentation helped it to understand :

https://dexidp.io/docs/using-dex/

https://dexidp.io/docs/using-dex/#:~:text=of the client.-,ClientID,-%3A "example-app"%2C ClientSecret

Hey @tiwarisanjay , my main problem was I didn’t have a connector setup in argo-cd dex configMap:

I’m not working on that project anymore but maybe this CM setup will help you out.

Argo cd

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
data:
  # Kustomize sees the value of dex.config as a single string instead of yaml. It will not merge
  # Dex settings, but instead it will replace the entire configuration with the settings below,
  # so add these to the existing config instead of setting them in a separate file
  url: https://argocd.<redacted>
  dex.config: |
    logger:
      level: debug
      format: json
    connectors:
    - type: saml
      id: okta
      name: Okta
      config:
        ssoURL: https://<redacted>/sso/saml 
        # You need `caData` _OR_ `ca`, but not both.
        caData: |
        	<redacted>
        redirectURI: https://argocd.<redacted>/api/dex/callback
        usernameAttr: email
        emailAttr: email
        groupsAttr: group
    staticClients:
    - id: argo-workflows-sso
      name: Argo Workflow
      redirectURIs:
        - https://argo-workflows<redacted>/oauth2/callback
      secretEnv: ARGO_WORKFLOWS_SSO_CLIENT_SECRET
      

Argo-Workflows

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: workflow-controller-configmap
data:
  # SSO Configuration for the Argo server.
  # You must also start argo server with `--auth-mode sso`.
  # https://argoproj.github.io/argo-workflows/argo-server-auth-mode/
  sso: |
    # This is the root URL of the OIDC provider (required).
    issuer: https://argocd.<redacted>/api/dex
    # This is name of the secret and the key in it that contain OIDC client
    # ID issued to the application by the provider (required).
    clientId:
      name: argo-workflows-sso
      key: client-id
    # This is name of the secret and the key in it that contain OIDC client
    # secret issued to the application by the provider (required).
    clientSecret:
      name: argo-workflows-sso
      key: client-secret
    # This is the redirect URL supplied to the provider (required). It must
    # be in the form <argo-server-root-url>/oauth2/callback. It must be
    # browser-accessible.
    redirectUrl: https://argo-workflows.<redacted>/oauth2/callback

I’m trying to do something similar to this, I mistakenly didn’t have a connector configured either. Now that I have one configured things are up and running however when Argo Workflows tries to use the Argo CD dex to handle the login I just get an error saying:

Not Found

Invalid client_id ("my-client-id").

Where my-client-id seems correct (it is the value from the Secret documented on https://argoproj.github.io/argo-workflows/argo-server-sso-argocd/#example-helm-chart-configuration-for-authenticating-against-argocds-dex)

One thing I’m wondering is, should the client ID used for the argo workflows static client be the same as the client id used in the connector config? That is how we have it setup now (so using the same client-id in connector config and argo workflows static client). In our case we’re using microsoft connector