SSO setup with Github doesn't work with RBAC

[ishallbethat]

Hi
Is it a bug ? or something i missed ?
I followed the link https://argoproj.github.io/argo-cd/operator-manual/rbac/ to set up rbac but turns out people within team-sre still don't have proper access.
I placed sensitive information with xxx_

my argo-cm.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  url: https://cd.xxx_org.org
  dex.config: |
    connectors:
      - type: github
        id: github
        name: GitHub
        config:
          clientID: xxx_clientid
          clientSecret:xxx_clientsecret
          orgs:
          - name: xxx_org
  admin.enabled: "true"

my rbac

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    p, role:org-admin, applications, *, */*, allow
    p, role:org-admin, clusters, get, *, allow
    p, role:org-admin, repositories, get, *, allow
    p, role:org-admin, repositories, create, *, allow
    p, role:org-admin, repositories, update, *, allow
    p, role:org-admin, repositories, delete, *, allow
    p, role:org-admin, projects, *, *, allow
    g, xxx_org:team-sre, role:org-admin

My goal is to allow people within Github team "team-sre" to be admin.
And the argocd page gives me error like below picture.

[rbreeze]

Could you try setting loadAllGroups: true in the Github connector config section of your dex.config?

[ishallbethat]

I added and tried again "loadAllGroups: true". Still this doesn't work @rbreeze

[rbreeze]

Thanks for checking! I had a similar issue when setting up SSO on a personal cluster a few months ago and I seemed to remember that helping, so it's a bummer it didn't work for you... what version are you running?

[ishallbethat]

{
    "Version": "v1.8.3+0f9c684",
    "BuildDate": "2021-01-21T22:20:39Z",
    "GitCommit": "0f9c68427882bf4633d395cbfcd7c9271795fd9b",
    "GitTreeState": "clean",
    "GoVersion": "go1.14.12",
    "Compiler": "gc",
    "Platform": "linux/amd64",
    "KsonnetVersion": "v0.13.1",
    "KustomizeVersion": "v3.8.1 2020-07-16T00:58:46Z",
    "HelmVersion": "v3.4.1+gc4e7485",
    "KubectlVersion": "v1.17.8",
    "JsonnetVersion": "v0.17.0"
}

my versions @rbreeze . argocd version "v1.8.3+0f9c684"

[AnshumanTripathi]

I am seeing a similar issue when using Github Enterprise SSO.

Here is my ArgoCD version

{
    "Version": "v2.3.3+07ac038",
    "BuildDate": "2022-03-30T00:06:18Z",
    "GitCommit": "07ac038a8f97a93b401e824550f0505400a8c84e",
    "GitTreeState": "clean",
    "GoVersion": "go1.17.6",
    "Compiler": "gc",
    "Platform": "linux/amd64",
    "KsonnetVersion": "v0.13.1",
    "KustomizeVersion": "v4.4.1 2021-11-11T23:36:27Z",
    "HelmVersion": "v3.8.0+gd141386",
    "KubectlVersion": "v0.23.1",
    "JsonnetVersion": "v0.18.0"
}

my RBAC config

rbacConfig:
    policy.default: role:readonly
    policy.csv: |
      p, role:org-admin, applications, create, */*, allow
      p, role:org-admin, applications, update, */*, allow
      p, role:org-admin, applications, delete, */*, allow
      p, role:org-admin, applications, sync, */*, allow
      p, role:org-admin, applications, override, */*, allow
      p, role:org-admin, applications, action/*, */*, allow
      p, role:org-admin, certificates, create, *, allow
      p, role:org-admin, certificates, update, *, allow
      p, role:org-admin, certificates, delete, *, allow
      p, role:org-admin, clusters, create, *, allow
      p, role:org-admin, clusters, update, *, allow
      p, role:org-admin, clusters, delete, *, allow
      p, role:org-admin, repositories, create, *, allow
      p, role:org-admin, repositories, update, *, allow
      p, role:org-admin, repositories, delete, *, allow
      p, role:org-admin, projects, create, *, allow
      p, role:org-admin, projects, update, *, allow
      p, role:org-admin, projects, delete, *, allow
      p, role:org-admin, accounts, update, *, allow
      p, role:org-admin, gpgkeys, create, *, allow
      p, role:org-admin, gpgkeys, delete, *, allow
      g, xxx:ops, role:org-admin
      g, test, role:org-admin

Here I created a local account test with the same role org-admin, which has all the required permissions but a member of xxx:ops does not have similar permissions.

[SwordreamLj]

I also have this problem. the github users of the xxx_org:argocd-admin team have only the read permmison

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
      g, xxx_org:argocd-admin, role:admin

[crenshaw-dev]

@SwordreamLj can you look at your token in jwt.io and make sure the group info is actually making it into the token?

[SwordreamLj]

How to look the token？ I check argocd-dex-server log and find the group is empty as "groups=[]"

[crenshaw-dev]

You can use your browser dev tools to grab the argocd.token cookie. Or you can see basically the same info by looking at the "User Info" page in the Argo UI (icon on the left side of the page).

If the groups field is in fact empty, that's probably the problem. The next step would be to figure out why the oauth provider (GitHub) isn't populating that field (or why Dex isn't passing along the populated field). Are you using GitHub or GitHub Enterprise?

[SwordreamLj]

I use GitHub Enterprise. I found what was causing the problem. I missed configuring the connector.config.orgs list in configmap argocd-cm . ArgoCD can only get configured org team information

[mubarak-j]

For future travelers...when using Dex with Github connector, Org & teams are case-sensitive both in Dex config & ArgoCD RBAC and need to match how these are displayed in GitHub. The wrong case was causing Dex to return empty groups. see dexidp/dex#2499

[amanbisht]

Solution of this situation is to replace UPPERCASE with LOWER_CASE and SPACE with - in the RBAC policy. For example FOO BAR would become foo-bar.

[Ken501]

My solution was the GitHub team was mismatched with the group defined on my policy. I deleted old teams in github and recreated with the name defined on argocd-rbac-cm and now all permissions work flawlessly:

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
  labels:
    app.kubernetes.io/part-of: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    p, role:org-admin, applications, *, */*, allow
    p, role:org-admin, clusters, get, *, allow
    p, role:org-admin, clusters, delete, *, allow
    p, role:org-admin, repositories, get, *, allow
    p, role:org-admin, repositories, create, *, allow
    p, role:org-admin, repositories, update, *, allow
    p, role:org-admin, repositories, delete, *, allow
    p, role:org-admin, projects, get, *, allow
    p, role:org-admin, projects, create, *, allow
    p, role:org-admin, projects, update, *, allow
    p, role:org-admin, projects, delete, *, allow
    p, role:org-admin, logs, get, *, allow
    p, role:org-admin, exec, create, */*, allow

    g, github-lab:argocd-admins, role:org-admin

[mihaigalos]

For future travelers, take 2:
Do not create the OAuth app directly in your GitHub user but instead create an Organization, and a team inside.

Next create the OAuth app directly in the Organization.