argoproj / argoproj/argo-cd

oidcConfig.rootCA does not apply to sessionManager oidc provider

Open
#9,505 0 comments 3 reactions 1 assignee Claimed by @crenshaw-dev View on GitHub
bug workaround
Dominant language
Go
Stars
24.2k
Forks
7.9k
Avg merge
1d 6h
Merged PRs (30d)
239

Description

**Describe the bug**

The oidcConfig.rootCA should apply to all usages of the OIDC provider. However, this config is not used by the sessionmanager.go created provider which is causing x509 errors.

**To Reproduce**

Login through dex with an OIDC provider using a self-signed certificate. The initial redirect to dex did not work until the rootCA config was added. Then everything seemed to go fine until the redirect back to argocd.

**Expected behavior**

The oidcConfig.rootCA should apply to all usages of the OIDC provider.

**Screenshots**

**Version**
v2.3.1+b65c169

**Logs**

```
time="2022-05-25T00:53:06Z" level=info msg="Initializing OIDC provider (issuer: https://dexe03777d4.eks.local)"
time="2022-05-25T00:53:21Z" level=info msg="finished unary call with code Unauthenticated" error="rpc error: code = Unauthenticated desc = invalid session: Failed to query provider \"https://dex.e03777d4.eks.local\": Get \"https://dex.e03777d4.eks.local/.well-known/openid-configuration\": x509: certificate signed by unknown authority" grpc.code=Unauthenticated grpc.method=List grpc.service=application.ApplicationService grpc.start_time="2022-05-25T00:53:06Z" grpc.time_ms=15013.107 span.kind=server system=grpc
```

Work around appears to be mapping an extra volume per [this](https://github.com/argoproj/argo-cd/issues/4344#issuecomment-890382825)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.