github.com/argoproj/argo-cd@v1.8.7/docs/operator-manual/user-management/okta.md (about)

     1  # Okta
     2  
     3  !!! note "Are you using this? Please contribute!"
     4      If you're using this IdP please consider [contributing](../../developer-guide/site.md) to this document.
     5  
     6  A working Single Sign-On configuration using Okta via at least two methods was achieved using:
     7  
     8  * [SAML (with Dex)](#saml-with-dex)
     9  * [OIDC (without Dex)](#oidc-without-dex)
    10  
    11  ## SAML (with Dex)
    12  
    13  1. Create a new SAML application in Okta UI.
    14      * ![Okta SAML App 1](../../assets/saml-1.png)
    15          I've disabled `App Visibility` because Dex doesn't support Provider-initiated login flows.
    16      * ![Okta SAML App 2](../../assets/saml-2.png)
    17  1. Click `View setup instructions` after creating the application in Okta.
    18      * ![Okta SAML App 3](../../assets/saml-3.png)
    19  1. Copy the SSO URL to the `argocd-cm` in the data.oicd
    20  1. Download the CA certificate to use in the `argocd-cm` configuration.  If you are using this in the caData field, you will need to pass the entire certificate (including `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` stanzas) through base64 encoding, for example, `base64 my_cert.pem`.
    21      * ![Okta SAML App 4](../../assets/saml-4.png)
    22  1. Edit the `argocd-cm` and configure the `data.dex.config` section:
    23  
    24  <!-- markdownlint-disable MD046 -->
    25  ```yaml
    26  dex.config: |
    27    logger:
    28      level: debug
    29      format: json
    30    connectors:
    31    - type: saml
    32      id: okta
    33      name: Okta
    34      config:
    35        ssoURL: https://yourorganization.oktapreview.com/app/yourorganizationsandbox_appnamesaml_2/rghdr9s6hg98s9dse/sso/saml
    36        # You need `caData` _OR_ `ca`, but not both.
    37        caData: |
    38          <CA cert passed through base64 encoding>
    39        # You need `caData` _OR_ `ca`, but not both.
    40        ca: /path/to/ca.pem
    41        redirectURI: https://ui.argocd.yourorganization.net/api/dex/callback
    42        usernameAttr: email
    43        emailAttr: email
    44        groupsAttr: group
    45  ```
    46  <!-- markdownlint-enable MD046 -->
    47  
    48  ----
    49  
    50  ## OIDC (without Dex)
    51  
    52  !!! warning "Do you want groups for RBAC later?"
    53      If you want `groups` scope returned from Okta you need to unfortunately contact support to enable [API Access Management with Okta](https://developer.okta.com/docs/concepts/api-access-management/) or [_just use SAML above!_](#saml-with-dex)
    54  
    55      Next you may need the API Access Management feature, which the support team can enable for your OktaPreview domain for testing, to enable "custom scopes" and a separate endpoint to use instead of the "public" `/oauth2/v1/authorize` API Access Management endpoint. This might be a paid feature if you want OIDC unfortunately. The free alternative I found was SAML.
    56  
    57  1. On the `Okta Admin` page, navigate to the Okta API Management at `Security > API`.
    58      ![Okta API Management](../../assets/api-management.png)
    59  1. Choose your `default` authorization server.
    60  1. Click `Scopes > Add Scope`
    61      1. Add a scope called `groups`.
    62      ![Groups Scope](../../assets/groups-scope.png)
    63  1. Click `Claims > Add Claim.`
    64      1. Add a claim called `groups`
    65      1. Choose the matching options you need, one example is:
    66          * e.g. to match groups starting with `argocd-` you'd return an `ID Token` using your scope name from step 3 (e.g. `groups`) where the groups name `matches` the `regex` `argocd-.*`
    67      ![Groups Claim](../../assets/groups-claim.png)
    68  1. Edit the `argocd-cm` and configure the `data.oidc.config` section:
    69  
    70  <!-- markdownlint-disable MD046 -->
    71  ```yaml
    72  oidc.config: |
    73    name: Okta
    74    issuer: https://yourorganization.oktapreview.com
    75    clientID: 0oaltaqg3oAIf2NOa0h3
    76    clientSecret: ZXF_CfUc-rtwNfzFecGquzdeJ_MxM4sGc8pDT2Tg6t
    77    requestedScopes: ["openid", "profile", "email", "groups"]
    78    requestedIDTokenClaims: {"groups": {"essential": true}}
    79  ```
    80  <!-- markdownlint-enable MD046 -->