Google SSO for Argo workflow does not work

[milosara78]

Hello Team,

Am new to argo workflow. We have a running argo cd setup with the dex deployment using helm .

We have deployed argo-workflow with chart version 0.42.7.

All we want to achieve is the SSO login using Google . We have the google groups available which comprises of my team members . Now all i need is when someone from my team try to access the argo workflow it should use google auth . As per docs it says we have to use DEX to support google SSO , hence we have added the configmap for static clients like below

apiVersion: v1
data:
  accounts.gitlab: apiKey
  accounts.gitlab.enabled: "true"
  admin.enabled: "true"
  application.instanceLabelKey: argocd.argoproj.io/instance
  dex.config: |-
    staticClients:
    - id: xxxxxxx-j30l5un7l46nthlpenbplikqnsikto5a.apps.googleusercontent.com
      name: Argo Workflow
      redirectURIs:
        - https://xxxxxx/oauth2/callback
      secretEnv: ARGO_WORKFLOWS_SSO_CLIENT_SECRET
    connectors:
    - type: oidc
      id: google
      name: Google
      config:
        issuer: https://accounts.google.com
        clientID: xxxxxx-fc21p4jtj5e02fn9bgkueoum6at2epvj.apps.googleusercontent.com
        clientSecret: xxxxx
  exec.enabled: "true"
  server.rbac.log.enforce.enable: "false"
  timeout.hard.reconciliation: 0s
  timeout.reconciliation: 180s
  url: https://argocd.xxxx.xxx
kind: ConfigMap

Also my workflow controller is set with

apiVersion: v1
data:
  config: |
    sso:
      issuer: https://xxxxxapi/dex
      clientId:
        name: argo-sso-secret
        key: client-id
      clientSecret:
        name: argo-sso-secret
        key: client-secret
      redirectUrl: "https://xxxxxxx/oauth2/callback"
      rbac:
        enabled: true
    nodeEvents:
      enabled: true
kind: ConfigMap

I have the secret created with client-secret and client id for the argo-sso-secret too as mentioned in doc.

But the problem is when i just use this and try to access i get

when i inspect in browser i can see

Request URL:
https://xxxxxs/api/v1/info
Request Method:
GET
Status Code:
401 Unauthorized
Remote Address:
xxxxx:443
Referrer Policy:
strict-origin-when-cross-origin

=====

Request URL:
https://argo.k8stest.kci.rocks/api/v1/info
Request Method:
GET
Status Code:
401 Unauthorized
Remote Address:
8.34.221.48:443
Referrer Policy:
strict-origin-when-cross-origin

Created default sa and it works :

apiVersion: v1
kind: ServiceAccount
metadata:
  name: user-default-login
  annotations:
    workflows.argoproj.io/rbac-rule: "true"
    workflows.argoproj.io/rbac-rule-precedence: "0"

So i have to use the default SA which then works like after seeing this error if i click login it logs in with default account and shows
default user account .

The documentation used for SSO:
https://argo-workflows.readthedocs.io/en/release-3.5/argo-server-sso/