Openshift connector and user policies

[sebastiendejou]

Hi,
I'm using dex with an openshift connector for argocd UI Authentication.
Authentication is OK and my client can access applications with default policy.
Next step is to affect policies for my users according to applications etc...
To do so, i can use Openshift group in my argocd configuration :

dex:
config: |
connectors:
- config:
clientID: {{ .Values.clientID }}
clientSecret: {{ .Values.clientSecret }}
groups: []
insecureCA: true
issuer: {{ .Values.issuer }}
redirectURI: {{ .Values.redirectURI }}
id: openshift
name: openshift
type: openshift
groups:
- ocp-group1

rbac:
policy: |
g, ocp-group1, role:ocp-group1
p, role:ocp-group1, applications, get, front/*prod, allow

I can even affect policies to a local argocd user :

rbac:
policy: |
p, user:totolocal, applications, get, front/*prod, allow

But my problem is : I can't affect policies to an Openshift user.
This does not work :

rbac:
policy: |
p, user:ocp-user1, applications, get, front/*prod, allow

Even if argocd have got the infos (user, issuer, ocp groups of the user) on the authenticated user.
The user still can't see front/*prod applications.

Have you ever tried to do it ?
Is it supported ?

Regards

[jannfis]

Hi.

By default, RBAC rules only inspect the groups claim in the SSO's JWT token. If you want other claims in the token to be available to the RBAC engine, you need to explicitly allow them in the scopes parameter in argocd-rbac-cm, e.g.

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
  annotations:
    app.kubernetes.io/part-of: argocd
data:
  policy.csv: |
    g, youruser, role:admin
  scopes: '[name,groups]'

I would not advise to do so tho, because if you have a group with extended privileges (e.g. mapped to role:admin) and someone could create a user with the same name as the group, they would receive the same privileges. You could also take another field of the OIDC's profile claim, such as email, for this purpose which probably is a little safer to use.