WebUI PKCE auth flow not working as expected in v2.9

[Kerwood]

Describe the bug

---

tldr; The PKCE auth flow only works if you checkout the master branch and not on any of the v2.9.* tags.

---

In the v2.9.0 release, @Marvin9 added support for using authorization code flow with PKCE in the webUI ❤️ , which is lovely.

• feat: PKCE authentication flow for web logins #9890 #15889

Unfortunately it does not seem to work in v2.9.* as expected.
If I clone the argo-cd repo and start a local instance from the master branch it works as expected. But if I check out any if the v2.9.* tags and run it locally again, the PKCE auth flow is not utilized.
I think the "if" statement here does not validate the enablePKCEAuthentication config correctly for some reason.

Below is the config I am using for my local instance.

Keep in mind that the PKCE flow does not actually work with Azure, because Azure is non-compliant with RFC8414 and the /.well-known/openid-configuration endpoint is missing the code_challenge_methods_supported property. But that is another issue.

data:
  admin.enabled: "false"
  oidc.config: |
    name: Azure
    enablePKCEAuthentication: true
    issuer: https://login.microsoftonline.com/<tenant-id>/v2.0
    clientID: <client-id>
    requestedIDTokenClaims:
      groups:
        essential: true
    requestedScopes:
      - openid
      - profile
      - email

With above config, running argocd locally with the make start command, on the master branch, the PKCE auth flow is triggered and you should see below error if using Azure as an IDP.

If I do a git checkout v2.9.3 and start up argocd again, it will use the auth code flow without PKCE and in my case Azure will provide the following error, because it was expecting the PKCE flow.

[Marvin9]

If I understood correct, the error should be explanatory that PKCE is not supported by IDP?

[K4pper]

@Marvin9 The error of the IDP only happens when you checkout the master branch, but if you checkout the v2.9.3 you get the error shown at the end of the post, therefore it seems that argo isn't attempting using PKCE flow.

[Kerwood]

If I understood correct, the error should be explanatory that PKCE is not supported by IDP?

No.. The error Authorization Server does not support S256 code challenge method is because Azure does not comply with RFC8414, which is not what this issue is about.

The issue here is that PKCE auth flow only works on the master branch, not if you checkout any if the v2.9.* tags.

@Marvin9 The error of the IDP only happens when you checkout the master branch, but if you checkout the v2.9.3 you get the error shown at the end of the post, therefore it seems that argo isn't attempting using PKCE flow.

Correct.

[crenshaw-dev]

The issue here is that PKCE auth flow only works on the master branch, not if you checkout any if the v2.9.* tags.

Correct. This feature won't be released until Monday, with 2.10.0-rc1.

[Kerwood]

@crenshaw-dev
If you look at https://github.com/argoproj/argo-cd/releases/tag/v2.9.0 you will see the PKCE feature in the list.

[crenshaw-dev]

@Kerwood the number of commits was so high that it broke GitHub's release not generation tool, so I used my own script. My script sucks, and I haven't had time to fix either it or the list it generated. 😛

[Kerwood]

That explains it.
Is there any way for us to check if a given PR is in a specific release? I cant really seem to figure out where to look for it. @crenshaw-dev

[crenshaw-dev]

Not a good way. I usually look at the merge date and compare it to the release date of rc-1 releases.

[michael-basil]

We have the PKCE flow working with Azure with other applications (like kubectl and various other mobile/Javascript applications) ... Is there a workaround for ...

Keep in mind that the PKCE flow does not actually work with Azure, because Azure is non-compliant with RFC8414 and the /.well-known/openid-configuration endpoint is missing the code_challenge_methods_supported property. But that is another issue.

I have hit the Authorization Server does not support S256 code challenge method blocker.

For reference:

• https://learn.microsoft.com/en-us/answers/questions/218113/openid-connect-authorization-code-flow-with-proof

[Kerwood]

@michael-basil
Currently with the feature provided, Azure is not supported because of this.
I will create another issue for the purpose.