Skip to content

Conversation

@bgrouxupgrade
Copy link

@bgrouxupgrade bgrouxupgrade commented Dec 9, 2025

Closes #14250
Based on: #20928, #22901
Feature implemented by @wrmedford
Contributions by @alexander-applyinnovations

This allows for generic JWTs to be used for authentication that are minted outside of Argo. Argo currently mints its own JWTs for auth outside of Dex, and this extends its capabilities to utilize JWTs that originate from Identity Aware Proxies.

PR structure;

  • Initial commit (squashed from previous PRs)
  • Follow on commits for additional features (signing method, groups/nested supports, fixes)
  • Commit to address most initial PR comments
  • Commits to address structural comments

Checklist:

  • Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
  • The title of the PR states what changed and the related issues number (used for the release note).
  • The title of the PR conforms to the Title of the PR
  • I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
  • I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
  • Does this PR require documentation updates?
  • I've updated documentation as required by this PR.
  • I have signed off all my commits as required by DCO
  • I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
  • My build is green (troubleshooting builds).
  • My new feature complies with the feature status guidelines.
  • I have added a brief description of why this PR is necessary and/or what this PR solves.
  • Optional. My organization is added to USERS.md.
  • Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

@bunnyshell
Copy link

bunnyshell bot commented Dec 9, 2025

❌ Preview Environment deleted from Bunnyshell

Available commands (reply to this comment):

  • 🚀 /bns:deploy to deploy the environment

@bgrouxupgrade bgrouxupgrade changed the title Feat jwt clean feat generic jwt token parsing Dec 9, 2025
@codecov
Copy link

codecov bot commented Dec 9, 2025

Codecov Report

❌ Patch coverage is 60.21127% with 113 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (master@48c969b). Learn more about missing BASE report.
⚠️ Report is 95 commits behind head on master.

Files with missing lines Patch % Lines
util/session/sessionmanager.go 51.38% 24 Missing and 11 partials ⚠️
util/jwt/token/external.go 72.26% 17 Missing and 16 partials ⚠️
util/jwt/jwt.go 51.35% 17 Missing and 1 partial ⚠️
server/server.go 14.28% 12 Missing ⚠️
cmd/argocd/commands/project_role.go 0.00% 9 Missing ⚠️
server/logout/logout.go 0.00% 1 Missing and 1 partial ⚠️
util/oidc/oidc.go 50.00% 2 Missing ⚠️
util/oidc/provider.go 71.42% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff            @@
##             master   #25567   +/-   ##
=========================================
  Coverage          ?   62.52%           
=========================================
  Files             ?      354           
  Lines             ?    50258           
  Branches          ?        0           
=========================================
  Hits              ?    31425           
  Misses            ?    15800           
  Partials          ?     3033           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@bgrouxupgrade bgrouxupgrade changed the title feat generic jwt token parsing feat: generic jwt token parsing Dec 9, 2025
@bgrouxupgrade bgrouxupgrade force-pushed the feat-jwt-clean branch 2 times, most recently from c45238b to 9c1e33c Compare December 11, 2025 17:53
@bgrouxupgrade bgrouxupgrade changed the title feat: generic jwt token parsing feat: Add generic/external jwt authentication Dec 11, 2025
@bgrouxupgrade bgrouxupgrade force-pushed the feat-jwt-clean branch 2 times, most recently from 07e7046 to c319de3 Compare December 11, 2025 20:58
@bgrouxupgrade bgrouxupgrade force-pushed the feat-jwt-clean branch 4 times, most recently from e088df6 to de185eb Compare December 15, 2025 14:16
@bgrouxupgrade bgrouxupgrade changed the title feat: Add generic/external jwt authentication feat: Add generic/external jwt authentication (Alpha) Dec 15, 2025
@bgrouxupgrade bgrouxupgrade marked this pull request as ready for review December 15, 2025 17:44
@bgrouxupgrade bgrouxupgrade requested a review from a team as a code owner December 15, 2025 17:44
@bgrouxupgrade bgrouxupgrade requested review from a team as code owners December 15, 2025 17:44
@@ -0,0 +1,258 @@
package token
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not super happy with the util/jwt/token package being added but there's a nasty import cycle because we need settings in here which imports a ton of things and the util/jwt package is used is a ton places some of which are imported by settings ... it was either this or push settings behind an interface local to the jwt package which felt even uglier ¯\_(ツ)_/¯

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Configure ArgoCD to accept a JWT token provided in the HTTP header

1 participant