Error 400 with github sso

[molnare]

Hello,
I am trying to install argocd with dex github connector. I want argocd to run under a subpath. When I click login via github I get a 400 bad request. I have no idea why...
I install argocd through helm:

helm upgrade --install --force --namespace argocd --create-namespace argocd argo/argo-cd --values values.yaml

Here is my values.yaml

configs:
  params:
    server.basehref: /argocd
    server.rootpath: 'argocd'
  cm:
    url: "https://myfalsedomain.com/argocd"
    dex.config: |
      connectors:
        - type: github
          id: github
          name: GitHub
          config:
            clientID: $argocd-github:github-client-id
            clientSecret: $argocd-github:github-client-secret
            orgs:
            - name: MyGitHubOrg
server:
  ingress:
    enabled: true
    annotations:
      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    ingressClassName: "nginx"
    hosts:
    - myfalsedomain.com
    paths:
    - /argocd
    tls:
     - secretName: myfalsedomain-ssl-cert
       hosts:
       - myfalsedomain.com
    https: true

What am I doing wrong?

[yu-croco]

Hi @molnare ,
you can get more help in upstream because argo-helm manages Helm Chart, not specific features of Argo project.

When I click login via github I get a 400 bad request

I think logs of dex and server will help you, status 400 means URL may be wrong or the application needs to be restarted to reed the config.... 🤔

[molnare]

Hello @yu-croco,

Thank you for your response!
I will post my question there too. Thank you for the tip!

I think logs of dex and server will help you, status 400 means URL may be wrong or the application needs to be restarted to reed the config.... 🤔

That's the thing, logs did not help much... :( I started both servers in debug mode, but no luck.

• dex server didn't log anything. Here's the complete log of dex server:

Defaulted container "dex-server" out of: dex-server, copyutil (init)
time="2024-01-15T23:46:13Z" level=info msg="ArgoCD Dex Server is starting" built="2023-12-01T23:05:50Z" commit=6eba5be864b7e031871ed7698f5233336dfe75c7 namespace=argocd version=v2.9.3+6eba5be
time="2024-01-15T23:46:13Z" level=info msg="Generating self-signed TLS certificate for this session"
time="2024-01-15T23:46:14Z" level=info msg="Starting configmap/secret informers"
time="2024-01-15T23:46:14Z" level=info msg="Configmap/secret informer synced"
time="2024-01-15T23:46:14Z" level=info msg="0x40000b6960 subscribed to settings updates"
time="2024-01-15T23:46:14Z" level=info msg="Dex Version: v2.37.0-dirty, Go Version: go1.20.4, Go OS/ARCH: linux arm64"
time="2024-01-15T23:46:14Z" level=info msg="config issuer: https://myfalsedomain.com/argocd/api/dex"
time="2024-01-15T23:46:14Z" level=info msg="config storage: memory"
time="2024-01-15T23:46:14Z" level=info msg="config static client: Argo CD"
time="2024-01-15T23:46:14Z" level=info msg="config static client: Argo CD CLI"
time="2024-01-15T23:46:14Z" level=info msg="config connector: github"
time="2024-01-15T23:46:14Z" level=info msg="config skipping approval screen"
time="2024-01-15T23:46:14Z" level=info msg="config refresh tokens rotation enabled: true"
time="2024-01-15T23:46:14Z" level=info msg="keys expired, rotating"
time="2024-01-15T23:46:15Z" level=info msg="keys rotated, next rotation: 2024-01-16 05:46:15.420789616 +0000 UTC"
time="2024-01-15T23:46:15Z" level=info msg="listening (telemetry) on 0.0.0.0:5558"
time="2024-01-15T23:46:15Z" level=info msg="listening (https) on 0.0.0.0:5556"
time="2024-01-15T23:46:15Z" level=info msg="listening (grpc) on 0.0.0.0:5557"
time="2024-01-16T05:46:15Z" level=info msg="keys expired, rotating"
time="2024-01-16T05:46:16Z" level=info msg="keys rotated, next rotation: 2024-01-16 11:46:16.32820298 +0000 UTC"

• argocd-server logged only the following when I pressed "log in via github":

time="2024-01-16T08:25:15Z" level=info msg="Performing authorization_code flow login: https://myfalsedomain.com/argocd/api/dex/auth?client_id=argo-cd&redirect_uri=https%3A%2F%2Fmyfalsedomain.com%2Fargocd%2Fauth%2Fcallback&respon
se_type=code&scope=openid+profile+email+groups&state=pRcgOMifEmkWUrgGmvIszqXC"

[yu-croco]

Oh...
Maybe because something is not expected and access doesn't reach to the dex after clicking the login, dex doesn't show any log...🤔
Is the redirect URL is correct including your SSO config in GitHub integration?👀

[yu-croco]

Hi @molnare ,
do the following info help you to investigate your situation? 🤔

• Failed to query provider Client sent an HTTP request to an HTTPS server with SAML Enterprise App Auth using Dex implementation argo-cd#14123
• Dex SSO failing with "http: server gave HTTP response to HTTPS client" argo-cd#9998

[molnare]

It should be correct, but I am not sure. I followed the official documentation on how to configure dex:
https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#dex
My Github Oauth App has:

• homepage URL: https://myfalsedomain.com/argocd
• Authorization callback URL: https://myfalsedomain.com/argocd/api/dex/callback
  The dex config inside the dex pod looks like this:

connectors:
- config:
    clientID: REDACTED
    clientSecret: REDACTED
    orgs:
    - name: SpringStoreOrg
    redirectURI: https://myfalsedomain.com/argocd/api/dex/callback
  id: github
  name: GitHub
  type: github
grpc:
  addr: 0.0.0.0:5557
issuer: https://myfalsedomain.com/argocd/api/dex
oauth2:
  skipApprovalScreen: true
staticClients:
- id: argo-cd
  name: Argo CD
  redirectURIs:
  - https://myfalsedomain.com/argocd/auth/callback
  secret: REDACTED
- id: argo-cd-cli
  name: Argo CD CLI
  public: true
  redirectURIs:
  - http://localhost
  - http://localhost:8085/auth/callback
storage:
  type: memory
telemetry:
  http: 0.0.0.0:5558
web:
  https: 0.0.0.0:5556
  tlsCert: /tmp/tls.crt
  tlsKey: /tmp/tls.key

[molnare]

argoproj/argo-cd#14123
argoproj/argo-cd#9998

I had this issue myself, but as I observed it had something to do with TLS termination. I am doing TLS termination with SSL Passthrough as described here: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough
This way I can let the argocd server handle the TLS termination itself and I don't have to setup multiple ingresses for http and grpc.

I also added nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" because of the infinite 307 loop mentioned here: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#ssl-passthrough-with-cert-manager-and-lets-encrypt. I don't use letsencrypt certificates (yet), I have my signed certificates from no-ip. but the situation was similar. Without adding backend-protocol "HTTPS" I also got an infinte redirect loop.