Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enabling fetching of UserInfoGroups breaks web-terminal #22244

Open
3 tasks done
the-technat opened this issue Mar 7, 2025 · 1 comment
Open
3 tasks done

Enabling fetching of UserInfoGroups breaks web-terminal #22244

the-technat opened this issue Mar 7, 2025 · 1 comment
Labels
bug Something isn't working

Comments

@the-technat
Copy link
Contributor

the-technat commented Mar 7, 2025

Checklist:

  • I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
  • I've included steps to reproduce the bug.
  • I've pasted the output of argocd version.

Describe the bug

Somehow when enabling the feature introduced in #12062 users can no longer open the web-terminal for pods and instead get an error.

To Reproduce

  1. Argo CD with an OICD provider hooked up
  2. Enable the web-terminal feature (has to be explicitly enabled)
  3. Grant an OIDC group the role: admin in argocd-rbac-cm (could also be a permission based on AppProject, but for the sake of simplicity we just assume the user is admin)
  4. Enable the UserInfoGroup feature using these keys in argocd-cm:
enableUserInfoGroups: true
userInfoPath: /userinfo
userInfoCacheExpiration: "5m"
  1. Logout, Login & Verify that in redis your group informations are cached (there's a key called userinfo_response_<token.sub>)
  2. Open a web-terminal for a pod that does have a shell

Expected behavior

Web-Terminal works since the users is admin in Argo CD and can see/edit everything.

If the UserInfoGroups feature is disabled the web-terminal works without issues.

Screenshots

Image

Image

Version

Image

Logs

I can't see anything relevant in the logs.

@the-technat the-technat added the bug Something isn't working label Mar 7, 2025
@the-technat the-technat changed the title Enabling fetching of userInfoGroups breaks terminal RBCA Enabling fetching of UserInfoGroups breaks web-terminal Mar 7, 2025
@the-technat
Copy link
Contributor Author

Since this is a feature I contributed I'm also willing to fix this bug.

But I suppose the terminal RBAC works different than the rest so if somebody could point me in the right direction where to look/start that would be awesome.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant