feat: Add generic JWT authentication (Alpha) #22901

alexander-applyinnovations · 2025-05-08T00:28:25Z

Closes #14250
Based on: #20928
Feature implemented by @wrmedford

This allows for generic JWTs to be used for authentication that are minted outside of Argo. Argo currently mints its own JWTs for auth outside of Dex, and this extends its capabilities to utilize JWTs that originate from Identity Aware Proxies.

Checklist:

Signed-off-by: Wes Medford <[email protected]>

…e audiences Signed-off-by: Wes Medford <[email protected]>

Signed-off-by: Wes Medford <[email protected]>

Co-authored-by: Josh Soref <[email protected]> Signed-off-by: Wes <[email protected]>

Signed-off-by: Wes Medford <[email protected]>

Signed-off-by: Wes <[email protected]>

Signed-off-by: Wes Medford <[email protected]>

Signed-off-by: Wes <[email protected]>

Signed-off-by: Wes Medford <[email protected]>

bunnyshell · 2025-05-08T00:28:30Z

❌ Preview Environment undeployed from Bunnyshell

Available commands (reply to this comment):

🚀 /bns:deploy to deploy the environment

codecov · 2025-05-08T01:09:02Z

Codecov Report

Attention: Patch coverage is 55.83596% with 140 lines in your changes missing coverage. Please review.

Project coverage is 60.00%. Comparing base (f0d783b) to head (1445dcc).
Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
util/session/sessionmanager.go	45.53%	51 Missing and 10 partials ⚠️
util/oidc/provider.go	73.38%	21 Missing and 12 partials ⚠️
util/jwt/jwt.go	45.83%	25 Missing and 1 partial ⚠️
cmd/argocd/commands/project_role.go	0.00%	10 Missing ⚠️
util/settings/settings.go	20.00%	7 Missing and 1 partial ⚠️
server/logout/logout.go	0.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #22901      +/-   ##
==========================================
+ Coverage   59.96%   60.00%   +0.04%     
==========================================
  Files         343      343              
  Lines       57848    58053     +205     
==========================================
+ Hits        34686    34837     +151     
- Misses      20375    20428      +53     
- Partials     2787     2788       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: applyinnovations <[email protected]>

wrmedford · 2025-05-08T17:06:41Z

Thank you for getting this across the line!

alexander-applyinnovations · 2025-05-13T01:02:50Z

@crenshaw-dev I believe this would be a great addition to argo-cd. am very interested to see this PR merged, who would be the right person to review this, I am currently available to address any feedback.

agaudreault

Adding my review, a lot of comment due to the size of the change, but looks good overall. I still havent reviewed provider.go and provider_test.go files. All other files are reviewed.

agaudreault · 2025-07-04T19:32:31Z

docs/operator-manual/user-management/index.md


+## External JWT Authentication Current Status: Alpha (Since v3.0.0)
+
+Argo CD can be configured to verify JSON Web Tokens (JWTs) issued by an external authentication provider. This allows you to integrate Argo CD with existing authentication systems that issue JWTs.


Is this mutually exclusive with having an oidc/dex configuration? If so, the doc should mention that both cannot be configured.

agaudreault · 2025-07-04T19:34:33Z

docs/operator-manual/user-management/index.md

+    jwkSetURL: "https://auth.example.com/.well-known/jwks.json"
+    # Optional: How long to cache the JWKS
+    cacheTTL: "1h"
+    # Optional: Expected audience for the JWT


To stay in sync with the OIDC configuration, could it be allowedAudiences instead?

agaudreault · 2025-07-04T19:39:15Z

docs/operator-manual/user-management/index.md

+4. Extract the username and email from the specified claims
+5. Use these values to identify the user within Argo CD


Multiple features in argo will use the groups claims and user info endpoint. This is possible to be configured using oidc and dex.

Since userInfo is another endpoint, how would that work in this case?

agaudreault · 2025-07-04T19:40:34Z

go.mod

 	google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a
 	google.golang.org/grpc v1.72.1
 	google.golang.org/protobuf v1.36.6
+	gopkg.in/square/go-jose.v2 v2.6.0


This package is deprecated.

agaudreault · 2025-07-04T19:43:53Z

util/jwt/jwt.go

+	// If it's *MapClaims (less common but possible), dereference and return.
+	if mapClaimsPtr, ok := claims.(*jwtgo.MapClaims); ok {
+		return *mapClaimsPtr, nil
+	}


What is causing this new behaviour?

agaudreault · 2025-07-04T20:35:18Z

util/session/sessionmanager.go

+		// Attempt to get settings manager from the verifier if possible
+		// This assumes the TokenVerifier implementation might expose settings
+		var settingsMgr *settings.SettingsManager
+		if sm, ok := authn.(*SessionManager); ok {
+			settingsMgr = sm.settingsMgr
+		}


Create another method on the interface, or provide another interface param to the middleware to GetToken(r *http.Request) string

agaudreault · 2025-07-04T20:43:15Z

util/session/sessionmanager.go

+	prov, provErr := mgr.provider()
+	if provErr != nil {
+		// If OIDC/Dex is not configured, but we reached here, the token is invalid
+		return nil, "", fmt.Errorf("token issuer (%s) is not '%s' and OIDC provider is not available: %w", issuer, SessionManagerClaimsIssuer, provErr)


Suggested change

return nil, "", fmt.Errorf("token issuer (%s) is not '%s' and OIDC provider is not available: %w", issuer, SessionManagerClaimsIssuer, provErr)

return nil, "", fmt.Errorf("failed to get provider for OIDC Validation: %w", provErr)

agaudreault · 2025-07-04T20:45:03Z

util/session/sessionmanager.go

+		if errors.As(oidcErr, &tokenExpiredError) {
+			// Return minimal claims indicating SSO source for expired tokens
+			// Use issuer variable from above, handle potential error if it wasn't retrieved
+			issForExpired := ""


default to sso if not found?

Suggested change

issForExpired := ""

issForExpired := "sso"

agaudreault · 2025-07-04T20:46:40Z

util/session/sessionmanager.go

 		return nil
 	}
+
+	// Check if JWT config specifies a groups claim


Remove comments

agaudreault · 2025-07-04T20:47:17Z

util/oidc/provider_test.go

+}
+
+// Helper for pointer to bool
+func boolPtr(b bool) *bool {


use ptr package

agaudreault · 2025-07-04T21:19:42Z

util/oidc/provider.go


 	Verify(tokenString string, argoSettings *settings.ArgoCDSettings) (*gooidc.IDToken, error)
+
+	VerifyJWT(tokenString string, argoSettings *settings.ArgoCDSettings) (*jwtgo.Token, error)


Instead of having a new VerifyJWT method on the existing provider interface, shouldn't you have a new implementation of the provider interface for JWT token? or have a new provider totally in something like /util/jwt/provider.go

wrmedford and others added 30 commits November 24, 2024 20:07

feat: Add JWT support to ArgoCD's OIDC authentication

f9a6228

Signed-off-by: Wes Medford <[email protected]>

(fix) Standardize on jwt/v4

d62d916

Signed-off-by: Wes Medford <[email protected]>

(feat) contextually call VerifyJWT if a JWKS url is set.

678805a

Signed-off-by: Wes Medford <[email protected]>

(fix) deps bump.

8106163

Signed-off-by: Wes Medford <[email protected]>

(chore) lint fix.

0180e81

Signed-off-by: Wes Medford <[email protected]>

(fix) generate JWT token during unit tests

a168c83

Signed-off-by: Wes Medford <[email protected]>

(chore) bump deps

a180a8e

Signed-off-by: Wes Medford <[email protected]>

(fix) return public key instead of parsed token.

511162d

Signed-off-by: Wes Medford <[email protected]>

(feat) add JWKS caching

0759945

Signed-off-by: Wes Medford <[email protected]>

(chore) fix lint

e0772d7

Signed-off-by: Wes Medford <[email protected]>

Merge branch 'master' into master

a463c2b

Merge branch 'master' into master

5da2fb3

Merge branch 'master' into master

933b0d3

feat: Add JWT audience validation with support for single and multipl…

2b3ac11

…e audiences Signed-off-by: Wes Medford <[email protected]>

(fix) Update settings to allow audience configuration.

933539f

Signed-off-by: Wes Medford <[email protected]>

Merge branch 'master' into master

f22a0d2

Merge branch 'argoproj:master' into master

c27f45b

(docs) add docs for external JWT auth

2251194

Signed-off-by: Wes Medford <[email protected]>

Merge branch 'master' into master

5cd320f

Log cacheTTL

47329f5

Co-authored-by: Josh Soref <[email protected]> Signed-off-by: Wes <[email protected]>

Whitespace

e0dfd48

Co-authored-by: Josh Soref <[email protected]> Signed-off-by: Wes <[email protected]>

(lint) remove whitespace due to fmt complaining

ac97c7c

Signed-off-by: Wes Medford <[email protected]>

Merge branch 'master' into master

1e36bf6

Signed-off-by: Wes <[email protected]>

(fix) make audience and alg errors clearer for end users

c006bd3

Signed-off-by: Wes Medford <[email protected]>

(lint) use correct format for non-formatted errors

989a45d

Signed-off-by: Wes Medford <[email protected]>

Merge branch 'master' into master

ce29329

Signed-off-by: Wes <[email protected]>

(feat) update to v5 and update tests

87cbec5

Signed-off-by: Wes Medford <[email protected]>

(tests) fix new tests to match expected output

8d959cc

Signed-off-by: Wes Medford <[email protected]>

(fix) correct function signatures

53aa703

Signed-off-by: Wes Medford <[email protected]>

(chore) lint

ee37300

Signed-off-by: Wes Medford <[email protected]>

wrmedford and others added 9 commits April 3, 2025 02:08

(chore) lint + cleanup unused function

1cd3ce7

Signed-off-by: Wes Medford <[email protected]>

(ci) fix outdated test

73db1a8

Signed-off-by: Wes Medford <[email protected]>

(fix) correctly wrap request context for error handing

5b30d6e

Signed-off-by: Wes Medford <[email protected]>

(chore) lint

498f32f

Signed-off-by: Wes Medford <[email protected]>

(chore) bump go-jose to v4

1b97be1

Signed-off-by: Wes Medford <[email protected]>

(chore) lint

2d99383

Signed-off-by: Wes Medford <[email protected]>

Merge branch 'master' into master

41e2864

Merge remote-tracking branch 'upstream/master'

af04e81

Merge branch wrmedford/argo-cd/master

e71dda6

alexander-applyinnovations marked this pull request as ready for review May 8, 2025 01:33

alexander-applyinnovations requested review from a team as code owners May 8, 2025 01:33

alexander-applyinnovations mentioned this pull request May 8, 2025

feat: Add generic JWT auth #20928

Closed

14 tasks

alexander-applyinnovations changed the title ~~feat: Add generic JWT auth~~ feat: Add generic JWT authentication (Alpha) May 8, 2025

updated documentation to comply with the feature status guidelines

378e283

Signed-off-by: applyinnovations <[email protected]>

alexander-applyinnovations force-pushed the master branch from 552b595 to 378e283 Compare May 8, 2025 05:26

Merge branch 'master' into master

e7aacdb

alexander-applyinnovations added 2 commits May 16, 2025 10:39

Merge branch 'master' into master

1445dcc

Merge branch 'master' into master

91cc6f3

agaudreault added this to the v3.2 milestone Jul 4, 2025

agaudreault requested changes Jul 4, 2025

View reviewed changes

agaudreault reviewed Jul 4, 2025

View reviewed changes


		## External JWT Authentication Current Status: Alpha (Since v3.0.0)

		Argo CD can be configured to verify JSON Web Tokens (JWTs) issued by an external authentication provider. This allows you to integrate Argo CD with existing authentication systems that issue JWTs.

		4. Extract the username and email from the specified claims
		5. Use these values to identify the user within Argo CD

	return nil, "", fmt.Errorf("token issuer (%s) is not '%s' and OIDC provider is not available: %w", issuer, SessionManagerClaimsIssuer, provErr)
	return nil, "", fmt.Errorf("failed to get provider for OIDC Validation: %w", provErr)


		Verify(tokenString string, argoSettings settings.ArgoCDSettings) (gooidc.IDToken, error)

		VerifyJWT(tokenString string, argoSettings settings.ArgoCDSettings) (jwtgo.Token, error)

feat: Add generic JWT authentication (Alpha) #22901

Are you sure you want to change the base?

feat: Add generic JWT authentication (Alpha) #22901

Uh oh!

Conversation

alexander-applyinnovations commented May 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bunnyshell bot commented May 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Preview Environment undeployed from Bunnyshell

Uh oh!

codecov bot commented May 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

wrmedford commented May 8, 2025

Uh oh!

alexander-applyinnovations commented May 13, 2025

Uh oh!

agaudreault left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

alexander-applyinnovations commented May 8, 2025 •

edited

Loading

bunnyshell bot commented May 8, 2025 •

edited

Loading

codecov bot commented May 8, 2025 •

edited

Loading