Secure Argo CD Access with Google Workspace SSO: Step-by-Step Setup

There are different ways to integrate Argo CD login with your Google Workspace users. Generally the OpenID Connect (oidc) method would be the recommended way of doing this integration (and easier, as well…), but depending on your needs, you may choose a different option.

• OpenID Connect using Dex This is the recommended login method if you don’t need information about the groups the user’s belongs to. Google doesn’t expose the groups claim via oidc, so you won't be able to use Google Groups membership information for RBAC.
• OpenID Connect plus Google Groups using Dex This is the recommended method if you need to use Google Groups membership in your RBAC configuration.

we’ll use OpenID Connect plus Google Groups using Dex approach for authentication, using ‌groups from Google Workspace.

We’re going to use Dex’s google connector to get additional Google Groups information from your users, allowing you to use group membership on your RBAC, i.e., giving admin role to the whole sysadmins@yourcompany.com group.

This connector uses two different credentials:

• An oidc client ID and secret Same as when you’re configuring an OpenID connection, this authenticates your users
• A Google service account This is used to connect to the Google Directory API and pull information about your user’s group membership

Also, you’ll need the email address for an admin user on this domain. Dex will impersonate that user identity to fetch user information from the API.

Before you get started…

In order to get the SSO working you need to have the SSL and URL for your server already configured, otherwise, you’ll get errors during the authentication.

Configure your OAuth consent screen

If you’ve never configured this, you’ll be redirected straight to this if you try to create an OAuth Client ID

1. Go to your OAuth Consent configuration. If you still haven’t created one, select Internal or External and click Create
2. Go and edit your OAuth consent screen Verify you’re in the correct project!
3. Configure a name for your login app and a user support email address
4. The app logo and filling the information links is not mandatory, but it’s a nice touch for the login page
5. In “Authorized domains”of branding section add the domains who are allowed to log in to ArgoCD (e.g. if you add example.com, all Google Workspace users with an @example.com address will be able to log in)
6. Save to continue to the “Data access” section
7. Click on “Add or remove scopes” and add the .../auth/userinfo.profile and the openid scopes
8. Save, review the summary of your changes and finish

Configure a new OAuth Client ID

1. Go to your Google API Credentials console, and make sure you’re in the correct project.
2. Click on “+Create Credentials”/”OAuth Client ID”
3. Select “Web Application” in the Application Type drop down menu, and enter an identifying name for your app (e.g. Argo CD)
4. Fill “Authorized JavaScript origins” with your Argo CD URL, e.g. [https://argocd.example.com](https://argocd.example.com)
5. Fill “Authorized redirect URIs” with your Argo CD URL plus /api/dex/callback, e.g. [https://argocd.example.com/api/dex/callback](https://argocd.example.com/api/dex/callback)

6. Click “Create” and save your “Client ID” and your “Client Secret” for later

Create a service account:

1. In the Google Cloud console, go to Menu menu > IAM & Admin > Service Accounts.
2. Go to Service Accounts
3. Click Create service account.
4. Fill in the service account details, then click Create and continue
5. Select the created service account.
6. Click Keys > Add key > Create new key.
7. Select JSON, then click Create.
8. Your new public/private key pair is generated and downloaded to your machine as a new file.
9. Click Close.

Set up domain-wide delegation for a service account

To call APIs on behalf of users in a Google Workspace organization, your service account needs to be granted domain-wide delegation of authority in the Google Workspace Admin console by a super administrator account.

To set up domain-wide delegation of authority for a service account:

1. In the Google Cloud console, go to Menu menu > IAM & Admin > Service Accounts.
2. Go to Service Accounts
3. Select the created service account.
4. Click Show advanced settings.
5. Under “Domain-wide delegation,” find your service account’s “Client ID.” Click Copy content_copy to copy the client ID value to your clipboard.
6. If you have super administrator access to the relevant Google Workspace account, click View Google Workspace Admin Console, then sign in using a super administrator user account and continue following these steps.
7. If you don’t have super administrator access to the relevant Google Workspace account, contact a super administrator for that account and send them your service account’s Client ID and list of OAuth Scopes so they can complete the following steps in the Admin console.
8. In the Google Admin console, go to Menu menu > Security > Access and data control > API controls Go to API controls
9. Click Manage Domain Wide Delegation.
10. Click Add new.
11. In the “Client ID” field, paste the client ID that you previously copied.
12. In the “OAuth Scopes” field, https://www.googleapis.com/auth/admin.directory.group.readonly paste this scope and nothing else. If you assign any other scopes, you won't be able to fetch information from the API
13. Click Authorize.
14. Enable the Admin SDK API in the same project

Configure Dex

1. Create a secret with the contents of the previous json file encoded in base64, like this:

apiVersion: v1
kind: Secret
metadata:
  name: argocd-google-groups-json
  namespace: argocd
data:
  googleAuth.json: JSON_FILE_BASE64_ENCODED

2. create a secret for Client Secret we got from Configure a new OAuth Client ID step

apiVersion: v1
kind: Secret
metadata:
  name: argocd-cm-dex-secret
  namespace: argocd
  labels:
    app.kubernetes.io/part-of: argocd
type: Opaque
data:
  ...
  # Store client secret like below.
  # Ensure the secret is base64 encoded
  oidc.auth0.clientSecret: <client-secret-base64-encoded

3. Edit your argocd-dex-server deployment to mount that secret as a file

• Add a volume mount in /spec/template/spec/containers/0/volumeMounts/ like this. Be aware of editing the running container and not the init container!

volumeMounts:
- mountPath: /shared
  name: static-files
- mountPath: /tmp
  name: dexconfig
- mountPath: /tmp/oidc
  name: google-json
  readOnly: true

• Add a volume in /spec/template/spec/volumes/ like this:

volumes:
- emptyDir: {}
  name: static-files
- emptyDir: {}
  name: dexconfig
- name: google-json
  secret:
    defaultMode: 420
    secretName: argocd-google-groups-json

4. Edit argocd-cm and add the following url and dex.config to the data section, replacing clientID and clientSecret with the values you saved before, adminEmail with the address for the admin user you're going to impersonate, and editing redirectURI with your Argo CD domain

data:
  url: https://argocd.example.com
  dex.config: |
    connectors:
    - config:
        redirectURI: https://argocd.example.com/api/dex/callback
        clientID: XXXXXXXXXXXXX.apps.googleusercontent.com
        clientSecret: $argocd-cm-dex-secret:oidc.auth0.clientSecret
        serviceAccountFilePath: /tmp/oidc/googleAuth.json
        adminEmail: admin-email@example.com
      type: google
      id: google
      name: Google

5. Restart your argocd-dex-server deployment to be sure it's using the latest configuration

Now you have your ArgoCD configured with Google SSO!

Now you can use groups email addresses to give RBAC permissions

For configuring RBAC refer this: https://medium.com/@vamsinakka949/the-rbac-feature-enables-restrictions-of-access-to-argo-cd-resources-14c1ad653dda