github.com/argoproj/argo-cd/v2@v2.10.9/docs/operator-manual/user-management/microsoft.md (about) 1 # Microsoft 2 3 * [Azure AD SAML Enterprise App Auth using Dex](#azure-ad-saml-enterprise-app-auth-using-dex) 4 * [Azure AD App Registration Auth using OIDC](#azure-ad-app-registration-auth-using-oidc) 5 * [Azure AD App Registration Auth using Dex](#azure-ad-app-registration-auth-using-dex) 6 7 ## Azure AD SAML Enterprise App Auth using Dex 8 ### Configure a new Azure AD Enterprise App 9 10 1. From the `Azure Active Directory` > `Enterprise applications` menu, choose `+ New application` 11 2. Select `Non-gallery application` 12 3. Enter a `Name` for the application (e.g. `Argo CD`), then choose `Add` 13 4. Once the application is created, open it from the `Enterprise applications` menu. 14 5. From the `Users and groups` menu of the app, add any users or groups requiring access to the service. 15  16 6. From the `Single sign-on` menu, edit the `Basic SAML Configuration` section as follows (replacing `my-argo-cd-url` with your Argo URL): 17 - **Identifier (Entity ID):** https://`<my-argo-cd-url>`/api/dex/callback 18 - **Reply URL (Assertion Consumer Service URL):** https://`<my-argo-cd-url>`/api/dex/callback 19 - **Sign on URL:** https://`<my-argo-cd-url>`/auth/login 20 - **Relay State:** `<empty>` 21 - **Logout Url:** `<empty>` 22  23 7. From the `Single sign-on` menu, edit the `User Attributes & Claims` section to create the following claims: 24 - `+ Add new claim` | **Name:** email | **Source:** Attribute | **Source attribute:** user.mail 25 - `+ Add group claim` | **Which groups:** All groups | **Source attribute:** Group ID | **Customize:** True | **Name:** Group | **Namespace:** `<empty>` | **Emit groups as role claims:** False 26 - *Note: The `Unique User Identifier` required claim can be left as the default `user.userprincipalname`* 27  28 8. From the `Single sign-on` menu, download the SAML Signing Certificate (Base64) 29 - Base64 encode the contents of the downloaded certificate file, for example: 30 - `$ cat ArgoCD.cer | base64` 31 - *Keep a copy of the encoded output to be used in the next section.* 32 9. From the `Single sign-on` menu, copy the `Login URL` parameter, to be used in the next section. 33 34 ### Configure Argo to use the new Azure AD Enterprise App 35 36 1. Edit `argocd-cm` and add the following `dex.config` to the data section, replacing the `caData`, `my-argo-cd-url` and `my-login-url` your values from the Azure AD App: 37 38 data: 39 url: https://my-argo-cd-url 40 dex.config: | 41 logger: 42 level: debug 43 format: json 44 connectors: 45 - type: saml 46 id: saml 47 name: saml 48 config: 49 entityIssuer: https://my-argo-cd-url/api/dex/callback 50 ssoURL: https://my-login-url (e.g. https://login.microsoftonline.com/xxxxx/a/saml2) 51 caData: | 52 MY-BASE64-ENCODED-CERTIFICATE-DATA 53 redirectURI: https://my-argo-cd-url/api/dex/callback 54 usernameAttr: email 55 emailAttr: email 56 groupsAttr: Group 57 58 2. Edit `argocd-rbac-cm` to configure permissions, similar to example below. 59 - Use Azure AD `Group IDs` for assigning roles. 60 - See [RBAC Configurations](../rbac.md) for more detailed scenarios. 61 62 # example policy 63 policy.default: role:readonly 64 policy.csv: | 65 p, role:org-admin, applications, *, */*, allow 66 p, role:org-admin, clusters, get, *, allow 67 p, role:org-admin, repositories, get, *, allow 68 p, role:org-admin, repositories, create, *, allow 69 p, role:org-admin, repositories, update, *, allow 70 p, role:org-admin, repositories, delete, *, allow 71 g, "84ce98d1-e359-4f3b-85af-985b458de3c6", role:org-admin # (azure group assigned to role) 72 73 ## Azure AD App Registration Auth using OIDC 74 ### Configure a new Azure AD App registration 75 #### Add a new Azure AD App registration 76 77 1. From the `Azure Active Directory` > `App registrations` menu, choose `+ New registration` 78 2. Enter a `Name` for the application (e.g. `Argo CD`). 79 3. Specify who can use the application (e.g. `Accounts in this organizational directory only`). 80 4. Enter Redirect URI (optional) as follows (replacing `my-argo-cd-url` with your Argo URL), then choose `Add`. 81 - **Platform:** `Web` 82 - **Redirect URI:** https://`<my-argo-cd-url>`/auth/callback 83 5. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the Application (client) ID. 84  85 86 #### Configure additional platform settings for ArgoCD CLI 87 88 1. In the Azure portal, in App registrations, select your application. 89 2. Under Manage, select Authentication. 90 3. Under Platform configurations, select Add a platform. 91 4. Under Configure platforms, select the "Mobile and desktop applications" tile. Use the below value. You shouldn't change it. 92 - **Redirect URI:** `http://localhost:8085/auth/callback` 93  94 95 #### Add credentials a new Azure AD App registration 96 97 1. From the `Certificates & secrets` menu, choose `+ New client secret` 98 2. Enter a `Name` for the secret (e.g. `ArgoCD-SSO`). 99 - Make sure to copy and save generated value. This is a value for the `client_secret`. 100  101 102 #### Setup permissions for Azure AD Application 103 104 1. From the `API permissions` menu, choose `+ Add a permission` 105 2. Find `User.Read` permission (under `Microsoft Graph`) and grant it to the created application: 106  107 3. From the `Token Configuration` menu, choose `+ Add groups claim` 108  109 110 ### Associate an Azure AD group to your Azure AD App registration 111 112 1. From the `Azure Active Directory` > `Enterprise applications` menu, search the App that you created (e.g. `Argo CD`). 113 - An Enterprise application with the same name of the Azure AD App registration is created when you add a new Azure AD App registration. 114 2. From the `Users and groups` menu of the app, add any users or groups requiring access to the service. 115  116 117 ### Configure Argo to use the new Azure AD App registration 118 119 1. Edit `argocd-cm` and configure the `data.oidc.config` and `data.url` section: 120 121 ConfigMap -> argocd-cm 122 123 data: 124 url: https://argocd.example.com/ # Replace with the external base URL of your Argo CD 125 oidc.config: | 126 name: Azure 127 issuer: https://login.microsoftonline.com/{directory_tenant_id}/v2.0 128 clientID: {azure_ad_application_client_id} 129 clientSecret: $oidc.azure.clientSecret 130 requestedIDTokenClaims: 131 groups: 132 essential: true 133 requestedScopes: 134 - openid 135 - profile 136 - email 137 138 2. Edit `argocd-secret` and configure the `data.oidc.azure.clientSecret` section: 139 140 Secret -> argocd-secret 141 142 data: 143 oidc.azure.clientSecret: {client_secret | base64_encoded} 144 145 3. Edit `argocd-rbac-cm` to configure permissions. Use group ID from Azure for assigning roles 146 [RBAC Configurations](../rbac.md) 147 148 ConfigMap -> argocd-rbac-cm 149 150 policy.default: role:readonly 151 policy.csv: | 152 p, role:org-admin, applications, *, */*, allow 153 p, role:org-admin, clusters, get, *, allow 154 p, role:org-admin, repositories, get, *, allow 155 p, role:org-admin, repositories, create, *, allow 156 p, role:org-admin, repositories, update, *, allow 157 p, role:org-admin, repositories, delete, *, allow 158 g, "84ce98d1-e359-4f3b-85af-985b458de3c6", role:org-admin 159 160 4. Mapping role from jwt token to argo 161 If you want to map the roles from the jwt token to match the default roles (readonly and admin) then you must change the scope variable in the rbac-configmap. 162 163 policy.default: role:readonly 164 policy.csv: | 165 p, role:org-admin, applications, *, */*, allow 166 p, role:org-admin, clusters, get, *, allow 167 p, role:org-admin, repositories, get, *, allow 168 p, role:org-admin, repositories, create, *, allow 169 p, role:org-admin, repositories, update, *, allow 170 p, role:org-admin, repositories, delete, *, allow 171 g, "84ce98d1-e359-4f3b-85af-985b458de3c6", role:org-admin 172 scopes: '[groups, email]' 173 174 Refer to [operator-manual/argocd-rbac-cm.yaml](https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-rbac-cm.yaml) for all of the available variables. 175 176 ## Azure AD App Registration Auth using Dex 177 178 Configure a new AD App Registration, as above. 179 Then, add the `dex.config` to `argocd-cm`: 180 ```yaml 181 ConfigMap -> argocd-cm 182 183 data: 184 dex.config: | 185 connectors: 186 - type: microsoft 187 id: microsoft 188 name: Your Company GmbH 189 config: 190 clientID: $MICROSOFT_APPLICATION_ID 191 clientSecret: $MICROSOFT_CLIENT_SECRET 192 redirectURI: http://localhost:8080/api/dex/callback 193 tenant: ffffffff-ffff-ffff-ffff-ffffffffffff 194 groups: 195 - DevOps 196 ``` 197 198 ## Validation 199 ### Log in to ArgoCD UI using SSO 200 201 1. Open a new browser tab and enter your ArgoCD URI: https://`<my-argo-cd-url>` 202  203 3. Click `LOGIN VIA AZURE` button to log in with your Azure Active Directory account. You’ll see the ArgoCD applications screen. 204  205 4. Navigate to User Info and verify Group ID. Groups will have your group’s Object ID that you added in the `Setup permissions for Azure AD Application` step. 206  207 208 ### Log in to ArgoCD using CLI 209 210 1. Open terminal, execute the below command. 211 212 argocd login <my-argo-cd-url> --grpc-web-root-path / --sso 213 214 2. You will see the below message after entering your credentials from the browser. 215  216 3. Your terminal output will be similar as below. 217 218 WARNING: server certificate had error: x509: certificate is valid for ingress.local, not my-argo-cd-url. Proceed insecurely (y/n)? y 219 Opening browser for authentication 220 INFO[0003] RequestedClaims: map[groups:essential:true ] 221 Performing authorization_code flow login: https://login.microsoftonline.com/XXXXXXXXXXXXX/oauth2/v2.0/authorize?access_type=offline&claims=%7B%22id_token%22%3A%7B%22groups%22%3A%7B%22essential%22%3Atrue%7D%7D%7D&client_id=XXXXXXXXXXXXX&code_challenge=XXXXXXXXXXXXX&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A8085%2Fauth%2Fcallback&response_type=code&scope=openid+profile+email+offline_access&state=XXXXXXXX 222 Authentication successful 223 'yourid@example.com' logged in successfully 224 Context 'my-argo-cd-url' updated 225 226 You may get an warning if you are not using a correctly signed certs. Refer to [Why Am I Getting x509: certificate signed by unknown authority When Using The CLI?](https://argo-cd.readthedocs.io/en/stable/faq/#why-am-i-getting-x509-certificate-signed-by-unknown-authority-when-using-the-cli).