Fetching id in dex config for staticClients from ENV (as Secrets)

[sahil-sharma]

We are aware that the id in dex config for staticClients would be the actual client-ID from OIDC provider in plain-text format (in XXXXX..apps.googleusercontent.com format). The code block would look like this (link to official doc):

    dex.config: |
       staticClients:
       - id: XXXXX..apps.googleusercontent.com
        name: Argo Workflow
        redirectURIs:
        - https://argo-workflows.mydomain.com/oauth2/callback
        secretEnv: ARGO_WORKFLOWS_SSO_CLIENT_SECRET

We tried to fetch this id from an ENV (mounted as a secret using External Secret) in the below format but it failed:

     dex.config: |
       staticClients:
       - id: $argo-workflows-sso:client-id
        name: Argo Workflow
        redirectURIs:
        - https://argo-workflows.mydomain.com/oauth2/callback
        secretEnv: ARGO_WORKFLOWS_SSO_CLIENT_SECRET

ExternalSecret is defined as:

<redacted-code-block>

    data:
        client-id: '{{ index . "CLIENT-ID" }}'

<redacted-code-block>

 data:
    - secretKey: CLIENT-ID
      remoteRef:
        key: "arn:aws:secretsmanager:eu-west-1:XXXXXXXX:secret:production/argo-workflows/dex-token-abcABC"
        property: client-id

Is there any way to get this value instead of hardcoding it in the code and pushing it to the GH?

Any hints/suggestions would be highly appreciated!

[agilgur5]

This sounds like a pure Dex question rather than an Argo question.

You need to create another environment variable that holds your client ID.

The configuration already has:

     dex:
       env:
         - name: ARGO_WORKFLOWS_SSO_CLIENT_SECRET
           valueFrom:
             secretKeyRef:
               name: argo-workflows-sso
               key: client-secret

you can add another environment variable to represent your client ID:

         - name: ARGO_WORKFLOWS_SSO_CLIENT_ID
           valueFrom:
             secretKeyRef:
               name: argo-workflows-sso
               key: client-id

and then you can use it within your config:

     dex.config: |
       staticClients:
       - id: $ARGO_WORKFLOWS_SSO_CLIENT_ID
        name: Argo Workflow
        redirectURIs:
        - https://argo-workflows.mydomain.com/oauth2/callback
        secretEnv: ARGO_WORKFLOWS_SSO_CLIENT_SECRET

with $ reading from the environment variables as you seem to be aware of already

[sahil-sharma]

Thank you @agilgur5 for your answer. We have tried this way but got an error: Not Found. Invalid client_id.
I am not sure how to resolve this. Do you suggest to ask in Dex folks on this? I posted this here in a hope that someone else might be knowing this or already have such implementation.

[agilgur5]

We have tried this way but got an error: Not Found. Invalid client_id.

An error from where? When does the error appear?

I would try introspecting your network requests and/or turning on debug logging in Dex to check if the env var matches what you expect.
If it's instead the raw string $ARGO_WORKFLOWS_SSO_CLIENT_ID, then you would know Dex is not substituting it at least.

That is supposed to work, so I would also double-check that your ExternalSecret and the resulting Secret have a client-id that matches what you expect.
That's probably the first thing I would check since it should be easy to confirm.

Do you suggest to ask in Dex folks on this?

But, generally speaking, yes, since it's not an Argo question and is purely about Dex config. And Dex folks would ofc know Dex config nuances better than others.

There is also a not well documented feature of Dex to be able to do templating, which is potentially something you can try as well.

[agilgur5]

There is also a not well documented feature of Dex to be able to do templating, which is potentially something you can try as well.

It looks like Dex folks indeed suggest this: dexidp/dex#2022

then you would know Dex is not substituting it at least.

And in the example I linked and that discussion, it's suggested that simple env var substitution is not available for staticClients. But both are quite old and dated, so I'm not sure if newer versions support it; Dex is definitely lacking some docs on env var substitution