Unable to setup Github Auth using Dex

[GauJosh]

Hi everyone, I am looking for some help for GitHub Auth setup in ArgoCD. I have read multiple documents and posts so far but still not able to figure out what I have done wrong. Please see below error logs, configuration settings.

I have setup helm chart for argocd and updated dex.config in values.yaml as below:

    # Dex configuration
    dex.config: |
      connectors:
        # GitHub
        - type: github
          id: github
          name: GitHub
          config:
            clientID: $dex-secret:dex.github.clientID
            clientSecret: $dex-secret:dex.github.clientSecret
            orgs:
            - name: testorg

Created github app and used those clientid and client secret as a secret.
Secret dex-secret:

apiVersion: v1
data:
  clientID: <clientid in base64>
  clientSecret: <client secret in base64>
kind: Secret
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: argocd
    app.kubernetes.io/name: dex-secret
    app.kubernetes.io/part-of: argocd
  name: dex-secret
  namespace: argocd
type: Opaque

Values set in GitHub Auth App:
Homepage URL

http://testdomain.testing.com/argocd

Authorization callback URL

http://testdomain.testing.com/argocd/api/dex/callback

I am able to access ArgoCD at: http://testdomain.testing.com/argocd
I can see GitHub logo for login and I am able to go to GitHub login auth page but I get redirected to a 404 page.
Please see below logs:

time="2023-02-07T02:33:47Z" level=info msg="ArgoCD API Server is starting" built="2023-02-02T15:10:21Z" commit=d311fad538178ef97528edf7f09d1d5b57268f45 namespace=argocd port=8080 version=v2.5.10+d311fad
time="2023-02-07T02:33:47Z" level=info msg="Starting configmap/secret informers"
time="2023-02-07T02:33:48Z" level=info msg="Configmap/secret informer synced"
time="2023-02-07T02:33:48Z" level=info msg="Creating client app (argo-cd)"
time="2023-02-07T02:33:48Z" level=info msg="argocd v2.5.10+d311fad serving on port 8080 (url: http://testdomain.testing.com/argocd, tls: false, namespace: argocd, sso:true)"
time="2023-02-07T02:33:48Z" level=info msg="Enabled application namespace patterns: argocd"
time="2023-02-07T02:33:48Z" level=info msg="0xc0007cc240 subscribed to settings updates"
time="2023-02-07T02:33:48Z" level=warning msg="config referenced '$dex-secret:dex.github.clientID', but key does not exist in secret"
time="2023-02-07T02:33:48Z" level=warning msg="config referenced '$dex-secret:dex.github.clientSecret', but key does not exist in secret"
time="2023-02-07T02:33:48Z" level=info msg="Starting rbac config informer"
time="2023-02-07T02:33:48Z" level=info msg="RBAC ConfigMap 'argocd-rbac-cm' added"
time="2023-02-07T02:35:37Z" level=info msg="received unary call /version.VersionService/Version" grpc.method=Version grpc.request.content= grpc.service=version.VersionService grpc.start_time="2023-02-07T02:35:37Z" span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=Version grpc.service=version.VersionService grpc.start_time="2023-02-07T02:35:37Z" grpc.time_ms=18.64 span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="received unary call /cluster.SettingsService/Get" grpc.method=Get grpc.request.content= grpc.service=cluster.SettingsService grpc.start_time="2023-02-07T02:35:37Z" span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=Get grpc.service=cluster.SettingsService grpc.start_time="2023-02-07T02:35:37Z" grpc.time_ms=22.044 span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="received unary call /version.VersionService/Version" grpc.method=Version grpc.request.content= grpc.service=version.VersionService grpc.start_time="2023-02-07T02:35:37Z" span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="received unary call /cluster.SettingsService/Get" grpc.method=Get grpc.request.content= grpc.service=cluster.SettingsService grpc.start_time="2023-02-07T02:35:37Z" span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=Get grpc.service=cluster.SettingsService grpc.start_time="2023-02-07T02:35:37Z" grpc.time_ms=22.644 span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=Version grpc.service=version.VersionService grpc.start_time="2023-02-07T02:35:37Z" grpc.time_ms=25.749 span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="received unary call /session.SessionService/GetUserInfo" grpc.method=GetUserInfo grpc.request.content= grpc.service=session.SessionService grpc.start_time="2023-02-07T02:35:37Z" span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=GetUserInfo grpc.service=session.SessionService grpc.start_time="2023-02-07T02:35:37Z" grpc.time_ms=11.266 span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="finished unary call with code Unauthenticated" error="rpc error: code = Unauthenticated desc = no session information" grpc.code=Unauthenticated grpc.method=List grpc.service=cluster.ClusterService grpc.start_time="2023-02-07T02:35:37Z" grpc.time_ms=8.167 span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="received unary call /session.SessionService/GetUserInfo" grpc.method=GetUserInfo grpc.request.content= grpc.service=session.SessionService grpc.start_time="2023-02-07T02:35:37Z" span.kind=server system=grpc
time="2023-02-07T02:35:37Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=GetUserInfo grpc.service=session.SessionService grpc.start_time="2023-02-07T02:35:37Z" grpc.time_ms=8.696 span.kind=server system=grpc
time="2023-02-07T02:35:38Z" level=info msg="received unary call /cluster.SettingsService/Get" grpc.method=Get grpc.request.content= grpc.service=cluster.SettingsService grpc.start_time="2023-02-07T02:35:38Z" span.kind=server system=grpc
time="2023-02-07T02:35:38Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=Get grpc.service=cluster.SettingsService grpc.start_time="2023-02-07T02:35:38Z" grpc.time_ms=20.299 span.kind=server system=grpc
time="2023-02-07T02:35:38Z" level=info msg="received unary call /cluster.SettingsService/Get" grpc.method=Get grpc.request.content= grpc.service=cluster.SettingsService grpc.start_time="2023-02-07T02:35:38Z" span.kind=server system=grpc
time="2023-02-07T02:35:38Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=Get grpc.service=cluster.SettingsService grpc.start_time="2023-02-07T02:35:38Z" grpc.time_ms=19.854 span.kind=server system=grpc
time="2023-02-07T02:35:46Z" level=info msg="Initializing OIDC provider (issuer: http://testdomain.testing.com/argocd/api/dex)"
time="2023-02-07T02:35:46Z" level=info msg="OIDC supported scopes: [openid email groups profile offline_access]"
time="2023-02-07T02:35:46Z" level=info msg="Performing authorization_code flow login: http://testdomain.testing.com/argocd/api/dex/auth?client_id=argo-cd&redirect_uri=http%3A%2F%2Ftestdomain.testing.com%2Fargocd%2Fauth%2Fcallback&response_type=code&scope=openid+profile+email+groups&state=dvGQKgraJQlWfxBGnengFGrQ"

I am also not sure why I keep getting these:

time="2023-02-07T02:33:48Z" level=warning msg="config referenced '$dex-secret:dex.github.clientID', but key does not exist in secret"
time="2023-02-07T02:33:48Z" level=warning msg="config referenced '$dex-secret:dex.github.clientSecret', but key does not exist in secret"

Any help in this issue is greatly appreciated!

[jaideepr97]

hi @GauJosh
Maybe the issue is that you are referencing dex.github.clientID but in the actual secret the ID is just located under clientID in the data section
Could you try just setting it as $dex-secret:clientID and $dex-secret:clientSecret?

[GauJosh]

hi @GauJosh Maybe the issue is that you are referencing dex.github.clientID but in the actual secret the ID is just located under clientID in the data section Could you try just setting it as $dex-secret:clientID and $dex-secret:clientSecret?

Thank you so much! I was missing that detail.

[ryanmt]

I ran into this as well if the secret lacked the label: app.kubernetes.io/part-of=argocd, even if the secret references were correct. Just a note if anyone else finds this discussion.

[goshlanguage]

Wow that's annoying
Thanks for the call out!

[midestefanis]

Thank you!

[davidshen84]

Hi @GauJosh ,

I saw in your code, you authorisation URL has a argocd prefix, and your log "Performing authorization_code" line shows it generated the correct URL with the prefix.

I am having some trouble with the prefix thing. I have configured the 'rootpath' argument for the argocd server and updated my Ingress. I can access my Argo CD login page with the prefix. But the login button generated an authorisation URL without the prefix.

Could you give me some tips about how you configured the prefix?

Thanks 🙏