SSO does not work for users with a lot of groups due to exceeding max browser cookie size limit

[kolorful]

Pre-requisites

• I have double-checked my configuration
• I can confirm the issues exists when I tested with :latest
• I'd like to contribute the fix myself (see contributing guide)

What happened/what you expected to happen?

After setting up Argo Workflow with an external SSO we noticed certain users can login with correct groups showing up while others cannot. Argo server logs show "token not valid for running mode".

To debug, we compiled Argo Workflow ourselves and added tons of debug logs.

Eventually we were able to pinpoint everything is normal until the part that sets authorization Cookie in HandleCallback. In non-working case the final Cookie size is 5000+ bytes, which exceeds the 4096 bytes limit. This causes the authorization Cookie not to be written at all, which makes subsequent requests do not contain the "authorization" header and leads to "token not valid for running mode" since it's empty.

I think we probably need to consider reducing the size of this Cookie or use a different approach?

Thanks.

Version

V3.4.3

Paste a small workflow that reproduces the issue. We must be able to run the workflow; don't enter a workflows that uses private images.

N/A, just set up an fresh Argo Workflow with SSO then login with a user that has a ton of groups so cookie will exceed 4096 bytes

Logs from the workflow controller

N/A

Logs from in your workflow's wait container

N/A

[tooptoop4]

maybe similar to #9530

[kolorful]

Note: #10170 did not fully fix the issue.

[basanthjenuhb]

I tried splitting the large cookie, but seems very complex
One simple solution can be, filter groups received after Oauth

sso:
  scopes:
   - groups
   - email
filterSSOGroupsRegex: "argo-wf"
rbac:
  enabled: true

this way, backend would filter out groups received, and keep the only groups that contain "argo-wf".
Since the number of groups that remain would be very small, users can use this to limit the number of groups

@sarabala1979 @juliev0 @alexec wdyt ?

[agilgur5]

I tried splitting the large cookie, but seems very complex

Argo CD seems to have implemented cookie splitting in argoproj/argo-cd#5497

[basanthjenuhb]

I tried splitting the large cookie, but seems very complex

Argo CD seems to have implemented cookie splitting in argoproj/argo-cd#5497

I guess we could also implement cookie splitting on top of filtering.

[agilgur5]

I guess we could also implement cookie splitting on top of filtering.

Yea for any users finding themselves here, if groups filtering does not suffice for your needs, please open a new enhancement request for cookie splitting.