Cognito OIDC working on ArgoCD v2.5.8 with Dex

[WesselAtWork]

This was such a pain...
But I got it working!

Argo Helm Chart

url: "https://example.com"

# Dex configuration
dex.config: |
  connectors:
    - type: oidc
      id: cognito
      name: Cognito
      config:
        issuer: https://cognito-idp.REGION.amazonaws.com/COGNITO_ID
        clientID: CLIENT_ID
        clientSecret: CLIENT_SECRET
        requestedScopes:
          - openid
          - profile
          - email
        insecureEnableGroups: true   # unsure how you would get the groups normally if not this? [See](https://dexidp.io/docs/connectors/oidc/#configuration)
        userNameKey: cognito:username   # I absolutely adore badly documented non-standard implementations :D
        claimMapping:
          groups: cognito:groups 

## OPTIONAL!!!: if you have something like ISTIO or some other servicemesh dealing with the SSL. Set Insecure to true.
# params:
#   # -- Run server without TLS
#   server.insecure: true

rbac:
  scopes: "[groups]"   # if you want to use a spesfic user identifier in the RBAC policy you can add `email`, `name` or `prefered_username` to this list: eg. "[groups, email, name]"

AWS Cognito Application config:

• Allowed callback URLs: "https://example.com/api/dex/callback"
• Allowed sign-out URLs: "https://example.com/auth/logout" (useless as there is no way for us to define a logout url in dex-config right now)
• Identity providers: "Cognito Userpool" (if you use another pool (cognito as proxy) you need to set insecureSkipEmailVerified: true doc)
• OAuth 2.0 grant types: "Authorization code grant"
• OpenID Connect scopes:
  • OpenID
  • Email
  • Profile

[WesselAtWork]

If you are wondering on the userNameKey: cognito:username, the error is as follows:

The line will be this in argo:

received error from dex: <buncha html...> <p>Failed to authenticate: missing &#34;name&#34; claim</p>  </buncha html...>

in dex it'll just be:

failed to authenticate: missing \"name\" claim

I think. I had debug on in my dex deployment.