Investigate using DEX locally with ARGO

[npeterson54]

Problem we are trying to solve:
Add Keycloak to Argo's Dex (add Keycloak to the dex sso config)

Currently we use Keycload as a provider,

We would like to see if Dex is possible. (Argo is being used in product with Argo), we need to determine if this will work for our needs.

Acceptance Criteria

Verify that Dex works

• Verify bearer token from Keycloak still works with argo when using dex

[RachalCassity]

There are two issues with using Dex and Keycloak to make API calls.

1. The OIDC issuer changes from Keycloak to Dex:

   Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend.

   When Dex is used for authenticating users in Argo, users signs in through an external connector, like Keycloak or github. The external connecter is no longer the sso provider in Argo. The connector's issuer is removed and replaced with the Dex issuer which may look like http://localhost:8080/api/dex. The error below is reports when attempting to make an API call to Argo with keycloak token:

   "error": "invalid session: oidc: id token issued by a different provider, expected \"http://localhost:8080/api/dex\" got \"http://localhost:8180/auth/realms/Twilight\""

2. The Keycloak Access token is not obtained.

   Access tokens are what the OAuth client uses to make requests to an API. The access token is meant to be read and validated by the API. An ID token contains information about what happened when a user authenticated, and is intended to be read by the OAuth client.

   Dex authenticates the user but does not obtain the Keycloak Access token, therefore Argo API calls cannot be made via Dex.

There has not been a solution to use the Keycloak token for ArgoCD API calls via Dex.

Here are some reported issues with Issuers/Dex/Connectors:

dexidp/dex#1635
argoproj/argo-cd#671
kubeflow/kfctl#433

Possible solutions:

Keycloak is a OIDC provider, just like Dex. Github users are able to go to the Argo login page. Click "Sign in via Keycloak". Then the user has the option to sign into Github or Keycloak. The user will redirected back to ArgoCD. This works the same way as Dex but the user will be able to make API calls to Argo.