alex/infrastructure
Watch
1
0
Fork
You've already forked infrastructure
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Map argocd SSO users by the subject tsidp issues #227

Merged
alex merged 1 commit from wiring-guru/argocd-oidc-subjects into main 2026-11-11 11:56:19 -07:00 AGit
Conversation 0 Commits 1 Files changed 2 +4 -2
wiring-guru commented 2026-11-11 11:55:06 -07:00
Contributor
Copy link

Argo CD uses the sub claim as the RBAC username, so the email policy lines never matched; keys admin on userid: instead. Also pins kiali server.web_fqdn.

Argo CD uses the sub claim as the RBAC username, so the email policy lines never matched; keys admin on userid:<id> instead. Also pins kiali server.web_fqdn.
Key argocd RBAC to the subject tsidp issues
All checks were successful
Apply Argo CD Applications / update-repo-folder (push) Successful in 1s
Details
Apply Argo CD Applications / update-repo (push) Successful in 0s
Details
Apply Argo CD Applications / apply-applications (push) Successful in 2s
Details
929b21ffba 
Argo CD names the SSO user after the token's sub claim, which tsidp renders as
userid:<tailscale user id>; the email lines never matched, so a successful login
still landed on policy.default (role:readonly). The log names the subject directly:
"username":"userid:51839577132867915".

kiali also asked for server.web_fqdn: without it the OIDC redirect_uri is derived
from request headers, which its own startup warning calls unsafe behind a proxy.
alex merged commit 929b21ffba into main 2026-11-11 11:56:19 -07:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
alex/infrastructure!227
No description provided.