RPJosh
/
authelia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
authelia/docs/content/en/integration/openid-connect/argocd/index.md

2.5 KiB
Raw Blame History

title description lead date draft images menu weight toc community
Argo CD Integrating Argo CD with the Authelia OpenID Connect Provider. 2022-07-13T04:27:30+10:00 false
integration
parent
openid-connect
620 true true

Tested Versions

Before You Begin

{{% oidc-common %}}

Assumptions

This example makes the following assumptions:

  • Application Root URL: https://argocd.example.com
  • Authelia Root URL: https://auth.example.com
  • Client ID: argocd
  • Client Secret: insecure_secret
  • CLI Client ID: argocd-cli

Configuration

Application

To configure Argo CD to utilize Authelia as an OpenID Connect 1.0 Provider use the following configuration:

name: Authelia
issuer: https://auth.example.com
clientID: argocd
clientSecret: insecure_secret
cliClientID: argocd-cli
requestedScopes:
  - openid
  - profile
  - email
  - groups

Authelia

The following YAML configuration is an example Authelia client configuration for use with Argo CD which will operate with the above example:

identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
    - id: argocd
      description: Argo CD
      secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
      public: false
      authorization_policy: two_factor
      redirect_uris:
        - https://argocd.example.com/auth/callback
      scopes:
        - openid
        - groups
        - email
        - profile
      userinfo_signing_algorithm: none
    - id: argocd-cli
      description: Argo CD (CLI)
      public: true
      authorization_policy: two_factor
      redirect_uris:
        - http://localhost:8085/auth/callback
      scopes:
        - openid
        - groups
        - email
        - profile
        - offline_access
      userinfo_signing_algorithm: none

See Also