Make the ArgoCD OAuth2 client public and register the mobile callback #39

2026-09-19T15:26:45+10:00

unkin-agent commented

2026-09-19 15:26:45 +10:00

ArgoCD login from the mobile app fails at Authentik with redirect_uri_no_match: the app calls back to the custom scheme argocd://auth/callback, which is not registered. It is a native client, so it cannot hold a secret -- and it cannot have a client of its own either, because Authentik derives the iss claim from the application slug while ArgoCD validates every token against the one issuer in oidc.config, so a second application would issue tokens ArgoCD rejects.

switch client_type from confidential to public
register argocd://auth/callback as a strict redirect URI
keep the web and CLI callbacks, and the Vault client_secret read that argocd-cm still resolves

ArgoCD login from the mobile app fails at Authentik with redirect_uri_no_match: the app calls back to the custom scheme argocd://auth/callback, which is not registered. It is a native client, so it cannot hold a secret -- and it cannot have a client of its own either, because Authentik derives the iss claim from the application slug while ArgoCD validates every token against the one issuer in oidc.config, so a second application would issue tokens ArgoCD rejects. - switch client_type from confidential to public - register argocd://auth/callback as a strict redirect URI - keep the web and CLI callbacks, and the Vault client_secret read that argocd-cm still resolves

unkin-agent added 1 commit 2026-09-19 15:26:46 +10:00

Make the ArgoCD OAuth2 client public and register the mobile callback

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

405dede578

The ArgoCD mobile app and CLI are native clients that cannot hold a
secret, and Authentik derives the iss claim from the application slug,
so they cannot have a client of their own either. Serve all three
clients from the one provider.

- switch client_type to public
- add argocd://auth/callback as a strict redirect URI

benvin merged commit 9508c151c4 into main

2026-09-19 15:40:18 +10:00

benvin deleted branch benvin/argocd-public-client

2026-09-19 15:40:18 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#39