From 405dede578ef14d8aa1ce98d22d01c27a48846a2 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 15:26:18 +1000 Subject: [PATCH] Make the ArgoCD OAuth2 client public and register the mobile callback The ArgoCD mobile app and CLI are native clients that cannot hold a secret, and Authentik derives the iss claim from the application slug, so they cannot have a client of their own either. Serve all three clients from the one provider. - switch client_type to public - add argocd://auth/callback as a strict redirect URI --- config/providers_oauth2/argocd.yaml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/config/providers_oauth2/argocd.yaml b/config/providers_oauth2/argocd.yaml index 0033295..fb4d33a 100644 --- a/config/providers_oauth2/argocd.yaml +++ b/config/providers_oauth2/argocd.yaml @@ -1,9 +1,18 @@ # OAuth2/OIDC provider + application for the in-cluster ArgoCD -# (argocd.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed. +# (argocd.k8s.syd1.au.unkin.net), serving the web UI, the `argocd` CLI and the +# ArgoCD mobile app. +# +# public, not confidential: the native clients cannot hold a secret, and they +# cannot have their own client either -- Authentik derives the `iss` claim from +# the application slug, while ArgoCD validates every token against the single +# issuer in oidc.config, so a second application would issue tokens ArgoCD +# rejects. One client for all three; the strict redirect URIs below are the +# control. Authentik ignores the secret for public clients, but the Vault read +# stays so argocd-cm's `$argocd-oidc:client_secret` keeps resolving. name: ArgoCD authorization_flow: default-provider-authorization-implicit-consent invalidation_flow: default-provider-invalidation-flow -client_type: confidential +client_type: public client_id: argocd client_secret_vault: mount: kv @@ -19,3 +28,6 @@ redirect_uris: # `argocd login --sso` CLI callback (local listener). - matching_mode: strict url: http://localhost:8085/auth/callback + # Mobile app callback (custom URL scheme, PKCE). + - matching_mode: strict + url: argocd://auth/callback