{"record":{"id":"b8d7b2500f40e615","repo":"argoproj/argo-workflows","slug":"not-implemented","errorCode":null,"errorMessage":"not implemented","messagePattern":"not implemented","errorType":"exception","errorClass":null,"httpStatus":501,"severity":"warning","filePath":"server/auth/sso/null_sso.go","lineNumber":31,"sourceCode":"\nfunc (n nullService) LogoutURL() string {\n\treturn \"\"\n}\n\nfunc (n nullService) LogoutRedirectURL() string {\n\treturn \"\"\n}\n\nfunc (n nullService) ClientID() string {\n\treturn \"\"\n}\n\nfunc (n nullService) IsRBACEnabled() bool {\n\treturn false\n}\n\nfunc (n nullService) Authorize(string) (*types.Claims, error) {\n\treturn nil, fmt.Errorf(\"not implemented\")\n}\n\nfunc (n nullService) HandleRedirect(w http.ResponseWriter, _ *http.Request) {\n\tw.WriteHeader(http.StatusNotImplemented)\n}\n\nfunc (n nullService) HandleCallback(w http.ResponseWriter, _ *http.Request) {\n\tw.WriteHeader(http.StatusNotImplemented)\n}\n","sourceCodeStart":13,"sourceCodeEnd":41,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/sso/null_sso.go#L13-L41","documentation":"nullService is the placeholder SSO implementation used when SSO is not configured. Its Authorize method always returns an error 'not implemented' because there is no real OIDC provider behind it to validate tokens. Any code path calling Authorize while SSO is disabled will get this error, signaling that SSO-backed authorization is not available.","triggerScenarios":"Calling sso.Authorize(token) — e.g. an HTTP/gRPC interceptor checking an SSO token — while the argo-server was started without an SSO ConfigMap, so the nullService was installed instead of the real OIDC service; also exercised directly by sso package tests.","commonSituations":"Client sends Authorization: Bearer tokens expecting SSO auth but server runs with SSO disabled; the SSO ConfigMap failed to load at startup and argo-server fell back to nullService; code/tests invoking the interface without checking IsRBACEnabled first.","solutions":["Configure SSO: create the argo-server SSO ConfigMap (issuer, clientId, clientSecret, redirectUrl) and restart argo-server so the real OIDC service replaces nullService","Check argo-server startup logs for SSO config load failures and fix the underlying ConfigMap/key errors","Guard callers with `if sso.IsRBACEnabled()` before calling Authorize, and use service-account/client auth modes when SSO is intentionally disabled"],"exampleFix":"// before\nclaims, _ := sso.Authorize(token)\n// after\nif !sso.IsRBACEnabled() {\n    return fmt.Errorf(\"SSO is not configured\")\n}\nclaims, err := sso.Authorize(token)","handlingStrategy":"type-guard","validationCode":"if !sso.IsRBACEnabled() {\n    return errors.New(\"SSO is not configured on this argo-server; use client or server auth mode\")\n}","typeGuard":"func ssoAvailable(s sso.Interface) bool {\n    return s != nil && s.IsRBACEnabled()\n}","tryCatchPattern":"claims, err := sso.Authorize(token)\nif err != nil && err.Error() == \"not implemented\" {\n    http.Error(w, \"SSO is not configured\", http.StatusNotImplemented)\n    return\n}","preventionTips":["Check IsRBACEnabled() before any Authorize call","Confirm the SSO ConfigMap is present and loaded by inspecting argo-server startup logs","Use `argo auth token` / client credentials in environments where SSO is intentionally disabled","Alert on startup fallback to nullService — it usually means SSO config failed to load"],"tags":["sso","oidc","authentication","not-implemented"],"backgroundTag":"sso-not-configured","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}