{"record":{"id":"208bff7ed38b7cb0","repo":"argoproj/argo-workflows","slug":"clientsecret-empty","errorCode":null,"errorMessage":"clientSecret empty","messagePattern":"clientSecret empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/sso/sso.go","lineNumber":132,"sourceCode":"}\n\nfunc newSso(\n\tctx context.Context,\n\tfactory providerFactory,\n\tc Config,\n\tsecretsIf corev1.SecretInterface,\n\tbaseHRef string,\n\tsecure bool,\n) (Interface, error) {\n\tbaseHRef = authcookie.NormalizePath(baseHRef)\n\tif c.Issuer == \"\" {\n\t\treturn nil, fmt.Errorf(\"issuer empty\")\n\t}\n\tif c.ClientID.Name == \"\" || c.ClientID.Key == \"\" {\n\t\treturn nil, fmt.Errorf(\"clientID empty\")\n\t}\n\tif c.ClientSecret.Name == \"\" || c.ClientSecret.Key == \"\" {\n\t\treturn nil, fmt.Errorf(\"clientSecret empty\")\n\t}\n\tclientSecretObj, err := secretsIf.Get(ctx, c.ClientSecret.Name, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Create http client\n\thttpClientConfig := HTTPClientConfig{\n\t\tInsecureSkipVerify: c.InsecureSkipVerify,\n\t\tRootCA:             c.RootCA,\n\t}\n\thttpClient, err := createHTTPClient(httpClientConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create HTTP client: %w\", err)\n\t}\n\n\toidcContext := oidc.ClientContext(ctx, httpClient)\n\t// Some offspec providers like Azure, Oracle IDCS have oidc discovery url different from issuer url which causes issuerValidation to fail","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/sso.go#L114-L150","documentation":"newSso validates the SSO Config before doing any kubernetes calls: both the Secret name and the data key for the OAuth client secret must be set (c.ClientSecret.Name and c.ClientSecret.Key). If either is empty, the OIDC client cannot be built, so construction fails immediately with 'clientSecret empty'. This is a static config check, not a kubernetes error.","triggerScenarios":"Calling New (server startup with SSO enabled) when the workflow-controller-configmap's sso.clientSecret.name or sso.clientSecret.key is omitted or set to an empty string.","commonSituations":"Partially filled SSO config in the configmap (issuer and clientID filled in but clientSecret block forgotten); a typo'd YAML key such as 'clientSecretKey' instead of the nested name/key structure; rendering Helm values that drop empty fields.","solutions":["Add sso.clientSecret.name and sso.clientSecret.key to the workflow-controller-configmap, pointing at the secret holding the OIDC client secret","Check the rendered configmap (kubectl get cm workflow-controller-configmap -o yaml) for an empty or misspelled clientSecret block","Restart the argo-server pod after fixing the config so New() re-runs"],"exampleFix":"# before\nsso: {\n  issuer: https://accounts.google.com\n  clientId: {name: argo-sso, key: client-id}\n}\n# after\nsso: {\n  issuer: https://accounts.google.com\n  clientId: {name: argo-sso, key: client-id}\n  clientSecret: {name: argo-sso, key: client-secret}\n}","handlingStrategy":"validation","validationCode":"cfg := ssoConfig\nif cfg.ClientSecret.Name == \"\" || cfg.ClientSecret.Key == \"\" {\n    return fmt.Errorf(\"sso.clientSecret.name and sso.clientSecret.key must both be set\")\n}","typeGuard":null,"tryCatchPattern":"if _, err := sso.New(ctx, cfg, secretsIf, baseHRef, secure); err != nil {\n    if strings.Contains(err.Error(), \"clientSecret empty\") {\n        return fmt.Errorf(\"SSO misconfigured: set sso.clientSecret.{name,key} in workflow-controller-configmap: %w\", err)\n    }\n    return err\n}","preventionTips":["Use the SSO configmap example as a template so all name/key pairs are present","Lint configmaps with a schema check for issuer/clientId/clientSecret blocks","Render Helm/Kustomize output and assert no empty sso fields before deploy"],"tags":["config","sso","kubernetes","validation"],"backgroundTag":"missing-sso-config","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}