github.com/argoproj/argo-cd/v2@v2.10.9/docs/operator-manual/user-management/identity-center.md (about)

     1  # Identity Center (AWS SSO)
     2  
     3  !!! note "Are you using this? Please contribute!"
     4      If you're using this IdP please consider [contributing](../../developer-guide/site.md) to this document.
     5  
     6  A working Single Sign-On configuration using Identity Center (AWS SSO) has been achieved using the following method:
     7  
     8  * [SAML (with Dex)](#saml-with-dex)
     9  
    10  ## SAML (with Dex)
    11  
    12  1. Create a new SAML application in Identity Center and download the certificate.
    13      * ![Identity Center SAML App 1](../../assets/identity-center-1.png)
    14      * ![Identity Center SAML App 2](../../assets/identity-center-2.png)
    15  2. Click `Assign Users` after creating the application in Identity Center, and select the users or user groups you wish to grant access to this application.
    16      * ![Identity Center SAML App 3](../../assets/identity-center-3.png)
    17  3. Copy the Argo CD URL into the `data.url` field in the `argocd-cm` ConfigMap.
    18  
    19          data:
    20            url: https://argocd.example.com
    21  
    22  4. Configure Attribute mappings.
    23  
    24      !!! note "Group attribute mapping is not officially!"
    25          Group attribute mapping is not officially supported in the AWS docs, however the workaround is currently working.
    26  
    27      * ![Identity Center SAML App 4](../../assets/identity-center-4.png)
    28      * ![Identity Center SAML App 5](../../assets/identity-center-5.png)
    29  
    30  <!-- markdownlint-enable MD046 -->
    31  
    32  5. Download the CA certificate to use in the `argocd-cm` configuration.
    33      * If using the `caData` field, you'll need to base64-encode the entire certificate, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` stanzas (e.g., `base64 my_cert.pem`).
    34      * If using the `ca` field and storing the CA certificate separately as a secret, you will need to mount the secret onto the `dex` container in the `argocd-dex-server` Deployment.
    35      * ![Identity Center SAML App 6](../../assets/identity-center-6.png)
    36  6. Edit the `argocd-cm` and configure the `data.dex.config` section:
    37  
    38  <!-- markdownlint-disable MD046 -->
    39  ```yaml
    40  dex.config: |
    41    logger:
    42      level: debug
    43      format: json
    44    connectors:
    45    - type: saml
    46      id: aws
    47      name: "AWS IAM Identity Center"
    48      config:
    49        # You need value of Identity Center APP SAML (IAM Identity Center sign-in URL)
    50        ssoURL: https://portal.sso.yourregion.amazonaws.com/saml/assertion/id
    51        # You need `caData` _OR_ `ca`, but not both.
    52        caData: <CA cert (IAM Identity Center Certificate of Identity Center APP SAML) passed through base64 encoding>
    53        # Path to mount the secret to the dex container
    54        entityIssuer: https://external.path.to.argocd.io/api/dex/callback
    55        redirectURI: https://external.path.to.argocd.io/api/dex/callback
    56        usernameAttr: email
    57        emailAttr: email
    58        groupsAttr: groups
    59  ```
    60  <!-- markdownlint-enable MD046 -->
    61  
    62  ### Connect Identity Center Groups to Argo CD Roles
    63  Argo CD recognizes user memberships in Identity Center groups that match the **Group Attribute Statements** regex. 
    64  
    65   In the example above, the regex `argocd-*` is used, making Argo CD aware of a group named `argocd-admins`.
    66  
    67  Modify the `argocd-rbac-cm` ConfigMap to connect the `ArgoCD-administrators` Identity Center group to the builtin Argo CD `admin` role.
    68  <!-- markdownlint-disable MD046 -->
    69  ```yaml
    70  apiVersion: v1
    71  kind: ConfigMap
    72  metadata:
    73    name: argocd-rbac-cm
    74  data:
    75    policy.csv: |
    76      g, <Identity Center Group ID>, role:admin
    77    scopes: '[groups, email]'
    78  ```
    79  <!-- markdownlint-enable MD046 -->