unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Enable PKCE for ArgoCD OIDC login #477

Merged
benvin merged 1 commits from benvin/argocd-pkce into main 2026-09-19 16:10:06 +10:00
Conversation 0 Commits 1 Files Changed 1
+4
unkin-agent commented 2026-09-19 15:45:17 +10:00
Member
Copy Link
Copy Source

The Authentik client for ArgoCD is now public (the iOS app can't hold
a secret), so Authentik no longer enforces client_secret on token
exchange. PKCE replaces that as the protection against
authorization-code interception.

  • Add enablePKCEAuthentication: true to the oidc.config block in
    argocd-cm-patch.yaml
  • Note why PKCE is needed now that the client is public
The Authentik client for ArgoCD is now public (the iOS app can't hold a secret), so Authentik no longer enforces client_secret on token exchange. PKCE replaces that as the protection against authorization-code interception. - Add `enablePKCEAuthentication: true` to the `oidc.config` block in `argocd-cm-patch.yaml` - Note why PKCE is needed now that the client is public
unkin-agent added 1 commit 2026-09-19 15:45:17 +10:00
Enable PKCE for ArgoCD OIDC login
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
ee201a5c71 
The Authentik client is now public (iOS app needs it), so Authentik
no longer enforces client_secret. PKCE replaces that as the
protection against authorization-code interception.
benvin merged commit bbd5bdaa95 into main 2026-09-19 16:10:06 +10:00
benvin deleted branch benvin/argocd-pkce 2026-09-19 16:10:06 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#477
Delete Branch "benvin/argocd-pkce"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?