Persistent SSO login with OpenUnison not working about argo-cd HOT 5 OPEN

@mattpoel Are you using direct OIDC setup or are you doing it with Dex? (Judging from the output I assume it's OIDC directly but want to make sure)

from argo-cd.

@christianh814 my trust configuration looks like the following:

apiVersion: openunison.tremolo.io/v1
kind: Trust
metadata:
  name: argocd
  namespace: openunison
spec:
  accessTokenSkewMillis: 120000
  accessTokenTimeToLive: 1200000
  authChainName: login-service
  clientId: argocd
  codeLastMileKeyName: lastmile-oidc
  codeTokenSkewMilis: 60000
  publicEndpoint: true
  redirectURI:
  - https://argo.demo.domain.com/auth/callback
  - http://localhost:8085/auth/callback
  signedUserInfo: true
  verifyRedirect: true

and the configmap for the OIDC configuration:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  url: https://argo.demo.domain.com
  oidc.config: |-
    name: OpenUnison
    issuer: https://k8sou.demo.domain.com/auth/idp/k8sIdp
    clientID: argocd
    requestedScopes: ["openid", "profile", "email", "groups"]

from argo-cd.

Usually, tls: failed to verify certificate: x509: certificate signed by unknown authority errors indicates that https://k8sou.demo.domain.com/auth/idp/k8sIdp/.well-known/openid-configuration does not have a valid trusted certificate. You can try to reproduce with curl from a container running where argo-cd is deployed. If you need to add --insecure, then you will either need a certificate trusted by a known CA, or add the root CA to the trust store.

https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#repositories-using-self-signed-tls-certificates-or-are-signed-by-custom-ca might be a way that works for argo. It is documented for repository, but since the server is making the call to the oidc provider, I think it might work too.

from argo-cd.

@agaudreault this was also my thinking, but I already spun up a throwaway netshoot pod in the argocd namespace to check on that, and the certificate/request to the URL was fine 😐

I now thought, a couple of restarts and re-applying the configuration can't do any harm and by:

• Removing the OIDC configuration from the argocd-cm ConfigMap.
• Deleting the argocd-server pod (to get a new one running).
• Re-adding the OIDC configuration to the argocd-cm ConfigMap.
• Deleting the argocd-server pod again to get a new one up and running.
• Reloading my ArgoCD browser tab.

💥 I was in (because I had already signed on in OpenUnison).

I guess the restarts of the argocd-server pod fixed this. According to documentation the configuration can be done without any restarts, but in case somebody might end up with the same problem, give it a try 😉

Thanks for your support! @agaudreault @christianh814

from argo-cd.

I too am running into this with my sso provider as I use self signed certs I assume there's either a way to tell Dex to not verify or I guess just mount the crt.

from argo-cd.