{"record":{"id":"983939958e21253a","repo":"argoproj/argo-workflows","slug":"issuer-empty","errorCode":null,"errorMessage":"issuer empty","messagePattern":"issuer empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/sso/sso.go","lineNumber":126,"sourceCode":"func providerFactoryOIDC(ctx context.Context, issuer string) (providerInterface, error) {\n\treturn oidc.NewProvider(ctx, issuer)\n}\n\nfunc New(ctx context.Context, c Config, secretsIf corev1.SecretInterface, baseHRef string, secure bool) (Interface, error) {\n\treturn newSso(ctx, providerFactoryOIDC, c, secretsIf, baseHRef, secure)\n}\n\nfunc newSso(\n\tctx context.Context,\n\tfactory providerFactory,\n\tc Config,\n\tsecretsIf corev1.SecretInterface,\n\tbaseHRef string,\n\tsecure bool,\n) (Interface, error) {\n\tbaseHRef = authcookie.NormalizePath(baseHRef)\n\tif c.Issuer == \"\" {\n\t\treturn nil, fmt.Errorf(\"issuer empty\")\n\t}\n\tif c.ClientID.Name == \"\" || c.ClientID.Key == \"\" {\n\t\treturn nil, fmt.Errorf(\"clientID empty\")\n\t}\n\tif c.ClientSecret.Name == \"\" || c.ClientSecret.Key == \"\" {\n\t\treturn nil, fmt.Errorf(\"clientSecret empty\")\n\t}\n\tclientSecretObj, err := secretsIf.Get(ctx, c.ClientSecret.Name, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Create http client\n\thttpClientConfig := HTTPClientConfig{\n\t\tInsecureSkipVerify: c.InsecureSkipVerify,\n\t\tRootCA:             c.RootCA,\n\t}\n\thttpClient, err := createHTTPClient(httpClientConfig)","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/sso.go#L108-L144","documentation":"newSso validates the SSO configuration loaded from the argo-server ConfigMap before constructing the OIDC service. The very first check requires a non-empty Issuer; if sso.issuer is missing, it returns 'issuer empty'. The issuer URL is the root of the OIDC discovery endpoint, so without it no provider metadata can be fetched and SSO cannot function.","triggerScenarios":"The argo-server SSO ConfigMap exists but lacks the `sso.issuer` key (or it is an empty string), and argo-server calls New → newSso during startup; also triggered in unit tests that construct Config without Issuer.","commonSituations":"Fresh SSO setup where the ConfigMap was created from an incomplete template; issuer key removed or misspelled (e.g. `issuer:` with no value or nested under the wrong YAML level); an IssuerAlias-only setup where the actual issuer was accidentally dropped.","solutions":["Add `sso.issuer: https://<your-provider>/...` to the argo-server SSO ConfigMap (e.g. https://accounts.google.com, https://your-domain/dex) and restart argo-server","Verify the ConfigMap name/key matches what argo-server mounts (`argo-server-sso` by default) and the YAML nesting is correct","Check argo-server logs for the full config dump (HTTPClientConfig etc.) to confirm which sso.* keys were actually loaded"],"exampleFix":"# ConfigMap\n# before\ndata:\n  sso.clientId: ...\n# after\ndata:\n  sso.issuer: https://accounts.google.com\n  sso.clientId: ...","handlingStrategy":"validation","validationCode":"var cfg sso.Config\nyaml.Unmarshal(cm.Data, &cfg) // after mapping keys like sso.issuer\nif cfg.Issuer == \"\" {\n    return errors.New(\"ConfigMap is missing sso.issuer\")\n}\nresp, err := http.Get(strings.TrimSuffix(cfg.Issuer, \"/\") + \"/.well-known/openid-configuration\")","typeGuard":"func issuerConfigured(cfg sso.Config) bool { return cfg.Issuer != \"\" }","tryCatchPattern":"svc, err := sso.New(ctx, controller, mode, cm, secretsIf, baseHRef, secure)\nif err != nil && strings.Contains(err.Error(), \"issuer empty\") {\n    return fmt.Errorf(\"argo-server SSO ConfigMap lacks sso.issuer: %w\", err)\n}","preventionTips":["Always include sso.issuer as the first SSO key when templating the ConfigMap","Verify the issuer with curl '<issuer>/.well-known/openid-configuration' returns 200","Don't confuse IssuerAlias (display rewriting) with Issuer (required discovery URL)","Validate the ConfigMap with a lint/schema check before applying"],"tags":["sso","oidc","configuration","configmap"],"backgroundTag":"sso-issuer-missing","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}