Argo CD配置Dex GitHub SSO后登录成功但无法进入UI界面

现象 #

已完成Dex GitHub连接器配置，登录验证环节成功，但登录后页面闪一下就自动回到登录页面。

相关日志 #

Dex服务器日志 #

msg="login successful: connector \"github\"

Argo CD服务器日志 #

time="2023-03-07T14:09:52Z" level=info msg="Initializing OIDC provider (issuer: https://argocd.dev.xxx.com/api/dex)"                                                         
time="2023-03-07T14:09:52Z" level=info msg="received unary call /session.SessionService/GetUserInfo" grpc.method=GetUserInfo grpc.request.content= grpc.service=session.SessionService grpc.start_time="2023-03-07T14:09:52Z" span.kind=server system=grpc                                                                                                           
time="2023-03-07T14:09:52Z" level=info msg="finished unary call with code OK" grpc.code=OK grpc.method=GetUserInfo grpc.service=session.SessionService grpc.start_time="2023-03-07T14:09:52Z" grpc.time_ms=8.645 span.kind=server system=grpc

当前RBAC配置 #

configs:
  cm:
    accounts.xxx-admin: apiKey, login
    accounts.xxx-developer: apiKey, login
    url: "https://argocd.dev.xxx.com"
    dex.config: |
      connectors:
        - type: github
          id: github
          name: GitHub
          config:
            clientID: $dex.github.clientID:dex.github.clientID
            clientSecret: $dex.github.clientsecret:dex.github.clientSecret
            orgs:
            - name: xxxorg
  rbac:
    create: true
    policy.default: role:none
    policy.csv: |
      p, role:none, *, *, */*, deny
      p, role:xxxadmin, applications, *, */*, allow
      p, role:xxxadmin, clusters, get, *, allow
      p, role:xxxadmin, repositories, get, *, allow
      p, role:xxxadmin, repositories, create, *, allow
      p, role:xxxadmin, repositories, update, *, allow
      p, role:xxxadmin, repositories, delete, *, allow
      g, xxx-admin, role:admin
      g, xxx-developer, role:readonly
      g, xxxorg:devops, role:admin
      g, xxxorg:engineering, role:admin
      g, xxxorg:app, role:readonly
      g, xxxorg:automation, role:readonly
      g, xxxorg:automation-qa, role:readonly
      g, xxxorg:de, role:readonly

问题原因分析 #

从日志可确认身份验证和用户信息获取均成功，页面跳转回登录页的核心原因是RBAC权限配置不匹配：

1. 系统默认角色为role:none，该角色被设置为拒绝所有操作
2. GitHub组织内用户被映射到role:admin或role:readonly，但当前policy.csv仅定义了role:xxxadmin的权限规则，未给role:admin和role:readonly配置任何允许访问的规则
3. 登录用户无匹配的有效权限规则，系统自动应用默认的role:none，导致访问被拒绝，最终跳转回登录页

解决方案 #

提供两种可选修复方案：

方案一：为role:admin和role:readonly添加权限规则 #

修改policy.csv，补充对应角色的权限配置：

p, role:none, *, *, */*, deny
p, role:xxxadmin, applications, *, */*, allow
p, role:xxxadmin, clusters, get, *, allow
p, role:xxxadmin, repositories, get, *, allow
p, role:xxxadmin, repositories, create, *, allow
p, role:xxxadmin, repositories, update, *, allow
p, role:xxxadmin, repositories, delete, *, allow
# 新增admin角色全量权限
p, role:admin, *, *, */*, allow
# 新增readonly角色只读权限
p, role:readonly, applications, get, */*, allow
p, role:readonly, clusters, get, *, allow
p, role:readonly, repositories, get, *, allow
g, xxx-admin, role:admin
g, xxx-developer, role:readonly
g, xxxorg:devops, role:admin
g, xxxorg:engineering, role:admin
g, xxxorg:app, role:readonly
g, xxxorg:automation, role:readonly
g, xxxorg:automation-qa, role:readonly
g, xxxorg:de, role:readonly

方案二：调整用户角色映射至已定义权限的角色 #

将GitHub组织用户的角色映射改为已配置权限的role:xxxadmin：

p, role:none, *, *, */*, deny
p, role:xxxadmin, applications, *, */*, allow
p, role:xxxadmin, clusters, get, *, allow
p, role:xxxadmin, repositories, get, *, allow
p, role:xxxadmin, repositories, create, *, allow
p, role:xxxadmin, repositories, update, *, allow
p, role:xxxadmin, repositories, delete, *, allow
g, xxx-admin, role:xxxadmin
g, xxx-developer, role:readonly
g, xxxorg:devops, role:xxxadmin
g, xxxorg:engineering, role:xxxadmin
g, xxxorg:app, role:readonly
g, xxxorg:automation, role:readonly
g, xxxorg:automation-qa, role:readonly
g, xxxorg:de, role:readonly

内容的提问来源于stack exchange，提问作者Techalicious