ArgoCD SSO with AWS IAM Identity Center (via Dex SAML)
A short, reproducible guide to wiring ArgoCD login to AWS Identity Center using ArgoCD's bundled Dex as a SAML service provider. Works whether IdC's identity source is its own directory or an external IdP (e.g. Google), with a couple of non-obvious gotchas that will cost you hours if you miss them (see Gotchas). Why this approach Access governed in IdC : grant/revoke ArgoCD like AWS account…
This guide provides a step-by-step process for configuring ArgoCD to use AWS IAM Identity Center for Single Sign-On (SSO) through Dex, a SAML service provider. The configuration is applicable regardless of whether the identity source is the IdC's own directory or an external IdP like Google. The primary advantage of this approach is that access is managed through the IdC, granting or revoking ArgoCD access in a single plane, without the need for a client secret.
The setup ensures no cluster egress, as the browser handles the redirect, and all communication between the user's browser, Dex, and the IdC is encrypted.
To begin, ensure ArgoCD is reachable via HTTPS at a stable hostname, and an admin account on the IdC is available. The first step involves creating a SAML 2.0 application within the IdC's applications section by adding a custom SAML application. This application requires specifying the ACS URL as https://argocd.example.com/api/dex/callback and setting the SAML audience to the same URL.
Next, define the attribute mappings in the IdC, specifically mapping the App attribute to the Subject format as ${user:subject} for persistent email and ${user:email} for unspecified. Assign users to this application to establish access control. Afterward, retrieve the IdC metadata, including the sign-in URL and certificate, which are necessary for configuration.
In ArgoCD, configure the SSO settings within the argocd-cm or Helm values, specifying the Dex configuration with the SSO URL, the base64-encoded IdC certificate, the entity issuer URL, and the redirect URI. These settings ensure that the SAML assertions are verified correctly without any outbound calls to the IdP. Assigning users via email attributes ensures that only authorized individuals can access ArgoCD.
A critical note is to set the Subject NameID Format to persistent, as using emailAddress can lead to authentication failures. Additionally, avoid mapping groups since the IdC's custom SAML app does not support emitting group memberships, and RBAC based on email addresses suffices for access control. The SSO application must be set to redirect to the ArgoCD URL, and the SAML audience must precisely match the entity issuer to avoid errors like Resource not found.
If ArgoCD is behind an SSL-terminating proxy, ensure the SSO URL in the configuration is HTTPS to prevent Dex from emitting an invalid ACS URL. Finally, after confirming the SSO setup with administrators, disable the built-in local admin and remove the bootstrap secret for enhanced security.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
