oidc not able to login with cli with KeyCloak

[gnometsunami]

Is argocd cli not supported with oidc? Or do I have something misconfigured?

UI login works fine, but cli login gives this error:

$ argocd login argocd.my.domain --grpc-web --sso
Opening browser for authentication
Performing authorization_code flow login: <cut for brevity>
FATA[0001] oauth2: cannot fetch token: 401 Unauthorized
Response: {"error":"unauthorized_client","error_description":"Client secret not provided in request"}

server logs:

time="2021-08-14T22:35:21Z" level=info msg="received unary call /cluster.SettingsService/Get" grpc.method=Get grpc.request.claims=null grpc.request.content= grpc.service=cluster.SettingsService grpc.start_time="2021-08-14T22:35:21Z" span.kind=server system=grpc
time="2021-08-14T22:35:21Z" level=info msg="Ignore status for CustomResourceDefinitions"
time="2021-08-14T22:35:21Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=Get grpc.service=cluster.SettingsService grpc.start_time="2021-08-14T22:35:21Z" grpc.time_ms=1.78 span.kind=server system=grpc

[jessesuen]

Argo CD should support OIDC CLI login. Could you provide more details about your setup? who is your provider? are you using dex or native oidc support? Are you able to paste the config (redacted)?

[iam-veeramalla]

Hi @ezdan , I was able to fix the issue by making the client public as shown below.

If your security policies does not allow you to make the client public then yes, I think you would need to create a new client for CLI. Does this work for you ? I will be awaiting your reply.

[iam-veeramalla]

However, I see a documentation gap w.r.t the below 2 points.

1. Add the http://localhost:8085/auth/callback to the valid redirect URLS of the Keycloak Argo CD client.
2. Since the CLI access cannot be secured with the secret, we may need to make the client public or create a new public client for the CLI access.

I will update the documentation if @ezdan confirms that the above changes works :)

[gnometsunami]

Yes! Changing the client to public enabled me to sign in with cli. I'm not sure what the security implications are for the web ui, but at least the cli is functional.

[jessesuen]

I see that there is an "Implicit Flow" option in KeyCloak. As an alternative to public access type, can either of you try enabling Implicit flow to see if it works (in addition to whitelisting http://localhost:8085/auth/callback)?

I'm not sure what the security implications are for the web ui, but at least the cli is functional.

The implications are: if an attacker was successfully able to perform a MITM (man in the middle) attack and masquerade as your Argo CD, they would then be allowed to complete OAuth2 login flows as your users login, because your KeyCloak will not care that the hijacked Argo CD is not supplying a valid client secret.

[gnometsunami]

Implicit doesnt seem to help.

access: confidential
implicit flow: enabled

FATA[0002] oauth2: cannot fetch token: 401 Unauthorized
Response: {"error":"unauthorized_client","error_description":"Client secret not provided in request"}

I'll invoke the 80/20 rule and just leave it as public. I feel that the mitm risk is pretty low on my private network.

@iam-veeramalla if you copy your answer in a new comment, I'll mark it as answered.

[iam-veeramalla]

Hi @ezdan , I was able to fix the issue by making the client public as shown below.

If your security policies does not allow you to make the client public then yes, I think you would need to create a new client for CLI. Does this work for you ? I will be awaiting your reply.

[gnometsunami]

Thank you! And thanks @jessesuen !

[862902354]

Hi!
The keycloak 20 version has no access type: public option. How do you solve it?

[richardbeumer]

In keycloak 20 and above you can make your client public by setting Client authentication to off

[vipunsanjana]

yeah abhishek .. some times i cant to create it..can you give me solution