{"record":{"id":"838d2dfa1c67f960","repo":"argoproj/argo-workflows","slug":"failed-to-compile-sso-filtergroupregex-s-w","errorCode":null,"errorMessage":"failed to compile sso.filterGroupRegex: %s %w","messagePattern":"failed to compile sso\\.filterGroupRegex: (.+?) %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/sso/sso.go","lineNumber":245,"sourceCode":"\t// The server both mints and verifies these tokens, so symmetric AEAD is\n\t// sufficient: encryption with A256GCM also authenticates, and go-jose v4\n\t// only permits encrypt-only JWTs with symmetric algorithms. Asymmetric\n\t// encryption needed a nested signature, which pushed the cookie over the\n\t// 4KB browser limit (https://github.com/argoproj/argo-workflows/issues/16744).\n\t// The AES key is derived from the RSA key already stored in the secret so\n\t// that existing installations don't need a secret migration.\n\tencryptionKey := sha256.Sum256(x509.MarshalPKCS1PrivateKey(privateKey))\n\tencrypter, err := jose.NewEncrypter(jose.A256GCM, jose.Recipient{Algorithm: jose.DIRECT, Key: encryptionKey[:]}, &jose.EncrypterOptions{Compression: jose.DEFLATE})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create JWT encrypter: %w\", err)\n\t}\n\n\tvar filterGroupsRegex []*regexp.Regexp\n\tif len(c.FilterGroupsRegex) > 0 {\n\t\tfor _, regex := range c.FilterGroupsRegex {\n\t\t\tcompiledRegex, err := regexp.Compile(regex)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to compile sso.filterGroupRegex: %s %w\", regex, err)\n\t\t\t}\n\t\t\tfilterGroupsRegex = append(filterGroupsRegex, compiledRegex)\n\t\t}\n\t}\n\n\tlf := logging.Fields{\"redirectUrl\": config.RedirectURL, \"logoutRedirectUrl\": c.LogoutRedirectURL, \"issuer\": c.Issuer, \"issuerAlias\": \"DISABLED\", \"clientId\": c.ClientID, \"scopes\": config.Scopes, \"insecureSkipVerify\": c.InsecureSkipVerify, \"filterGroupsRegex\": c.FilterGroupsRegex, \"rootCA\": c.RootCA}\n\tif c.IssuerAlias != \"\" {\n\t\tlf[\"issuerAlias\"] = c.IssuerAlias\n\t}\n\tlogger := logging.RequireLoggerFromContext(ctx).WithFields(lf)\n\tlogger.Info(ctx, \"SSO configuration\")\n\n\treturn &sso{\n\t\tconfig:            config,\n\t\tlogoutURL:         logoutURL,\n\t\tlogoutRedirectURL: c.LogoutRedirectURL,\n\t\tidTokenVerifier:   idTokenVerifier,\n\t\tbaseHRef:          baseHRef,","sourceCodeStart":227,"sourceCodeEnd":263,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/sso.go#L227-L263","documentation":"At SSO configuration load time (newSso), each `sso.filterGroupRegex` entry is compiled with regexp.Compile. If any entry is not a valid Go RE2 regular expression, startup is aborted with this error wrapping the underlying regexp parse error. Argo server cannot serve SSO auth until the config is fixed.","triggerScenarios":"`argo server` starts (or SSO config is reloaded) with an `sso.filterGroupRegex` list in the `argo-workflows-sso` ConfigMap/Secret containing syntactically invalid regex, e.g. unbalanced `(`, trailing `+`, or unsupported PCRE constructs like `(?<=x)` lookahead/lookbehind (Go RE2 does not support them).","commonSituations":"Copying regexes from PCRE/JS-flavored docs into the SSO config; hand-editing YAML and breaking escaping (e.g. `\\b` in a YAML double-quoted string); typos like `^group-(`.","solutions":["Fix the offending regex in the `argo-workflows-sso` config so it is valid Go RE2 syntax","Test the regex locally with `go run` / https://regex101.com (select Go/Golang flavor) before deploying","Remove unsupported constructs (lookaheads/lookbehinds, backreferences) and re-express the pattern","Restart the argo-server and confirm it comes up"],"exampleFix":"// before\nfilterGroupRegex:\n  - \"^argo-(?!readonly)\"   # invalid: negative lookahead unsupported in Go\n// after\nfilterGroupRegex:\n  - \"^argo-[a-z0-9-]+\"    # valid RE2","handlingStrategy":"validation","validationCode":"for _, r := range cfg.FilterGroupsRegex {\n    if _, err := regexp.Compile(r); err != nil {\n        return fmt.Errorf(\"invalid filterGroupRegex %q: %w\", r, err)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate all regexes in CI before applying the SSO config","Use the Go/RE2 flavor in regex testers, never PCRE","Prefer simple anchored prefix patterns over lookarounds","Lint YAML to avoid escaping issues"],"tags":["regex","configuration","sso","startup"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}