Add support for SSO users to interact with the Argo API about argo-cd HOT 2 CLOSED

@svianac You can use the ArgoCD CLI with the --sso option to perform these kind of operation. When calling the argo REST API, Ii expects you to already be authenticated and provide the JWT. If you want to use REST instead of the CLI, I believe you will need to manage the Authentication separately to get a bearer token from your identity provider. You can look at the login command implementation for the actual workflow that you would need to replicate with curl.

Once authenticated, the user will be able to perform the same actions that are performed through the UI with normal RBAC.

Let me know if you need more details before closing the issue.

from argo-cd.

Hello @agaudreault, thanks for the hint. I actually followed your advice and manage to get the cookie using the API and a SSO user. I have DEX+LDAP for authentication. I will share my workflow to get the token:

1 Step

curl -v "https://$ARGOCD_URL/auth/login"
Here we will store a cookie called argocd.oauthstate and a string called session.

2 Step

curl -v "https://$ARGOCD_URL/api/dex/auth/ad?client_id=argo-cd&redirect_uri=https://$ARGOCD_URL/auth/callback&response_type=code&scope=openid+profile+email+groups&state=$STATE1"
Here we will get a new state string.

3 Step

curl -v "https://$ARGOCD_URL/api/dex/auth/ad/login?back=&state=$STATE2" \ --data-raw 'login=yourLDAPuser&password=yourLDAPpassuser'
Here we will get a code

4 Step

Finally we use the code, first state and the cookie from the beginning
curl -v "https://$ARGOCD_URL/auth/callback?code=$CODE&state=$STATE1" \ -H "Cookie: argocd.oauthstate=$COOKIE"

The token will be given in a cookie called argocd.token

Thanks and please feel free to close the ticket.

I just hope the URLs don't change between versions...

from argo-cd.