{"record":{"id":"b9ee47674d928ee6","repo":"argoproj/argo-workflows","slug":"must-specify-at-least-one-auth-mode","errorCode":null,"errorMessage":"must specify at least one auth mode","messagePattern":"must specify at least one auth mode","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"server/auth/gatekeeper.go","lineNumber":74,"sourceCode":"type ClientForAuthorization func(authorization string, config *rest.Config) (*rest.Config, *servertypes.Clients, error)\n\ntype gatekeeper struct {\n\tModes Modes\n\t// global clients, not to be used if there are better ones\n\tclients                *servertypes.Clients\n\trestConfig             *rest.Config\n\tssoIf                  sso.Interface\n\tclientForAuthorization ClientForAuthorization\n\t// The namespace the server is installed in.\n\tnamespace    string\n\tssoNamespace string\n\tnamespaced   bool\n\tcache        *cache.ResourceCache\n}\n\nfunc NewGatekeeper(modes Modes, clients *servertypes.Clients, restConfig *rest.Config, ssoIf sso.Interface, clientForAuthorization ClientForAuthorization, namespace string, ssoNamespace string, namespaced bool, cache *cache.ResourceCache) (Gatekeeper, error) {\n\tif len(modes) == 0 {\n\t\treturn nil, fmt.Errorf(\"must specify at least one auth mode\")\n\t}\n\treturn &gatekeeper{\n\t\tmodes,\n\t\tclients,\n\t\trestConfig,\n\t\tssoIf,\n\t\tclientForAuthorization,\n\t\tnamespace,\n\t\tssoNamespace,\n\t\tnamespaced,\n\t\tcache,\n\t}, nil\n}\n\nfunc (s *gatekeeper) UnaryServerInterceptor() grpc.UnaryServerInterceptor {\n\treturn func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp any, err error) {\n\t\tctx, err = s.ContextWithRequest(ctx, req)\n\t\tif err != nil {","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/gatekeeper.go#L56-L92","documentation":"NewGatekeeper builds the Argo Server's auth interceptor and requires at least one authentication mode (client, server, or sso). If the Modes map derived from server configuration is empty, startup fails immediately with 'must specify at least one auth mode'. This is a fail-fast configuration guard so the API server is never exposed without a defined auth strategy.","triggerScenarios":"Starting `argo server` with a workflow-controller-configmap whose `server` section enables no auth methods: e.g. sso.enabled=false while authorizationMode excludes both client and server, or `--auth-mode` flags omitted entirely, or an invalid authorizationMode value that fails to parse leaving zero modes.","commonSituations":"Misediting the server authMode config when disabling SSO; deploying with a configmap that sets `authorization: ''`; helm values that empty the auth mode list; upgrading and the deprecated auth-mode key no longer being read.","solutions":["Set authorization mode(s) in the workflow-controller-configmap `server.authorizationMode` to one or more of: client, server, sso.","If launching manually, pass `--auth-mode client --auth-mode server` (and/or sso) to `argo server`.","Check helm chart values (server.authMode / extraArgs) so at least one mode reaches the server args.","Validate the configmap for typos — an unrecognized mode value is dropped, potentially leaving zero modes.","If you intended SSO only, ensure sso.enabled=true and sso config (issuer, clientId) is valid so the sso mode registers."],"exampleFix":"// before: workflow-controller-configmap.yaml\ndata:\n  config: |\n    server:\n      sso:\n        enabled: false   # SSO off and no authorizationMode -> zero modes\n// after\ndata:\n  config: |\n    server:\n      authorizationMode: client,server\n      sso:\n        enabled: false","handlingStrategy":"validation","validationCode":"modes := parseAuthModes(config.Server.AuthorizationMode, ssoEnabled)\nif len(modes) == 0 {\n    return fmt.Errorf(\"config error: enable at least one of client/server/sso in server.authorizationMode before starting argo server\")\n}","typeGuard":"func hasAuthMode(cfg Config) bool {\n    return len(cfg.Server.AuthorizationMode) > 0 || cfg.Server.SSO.Enabled\n}","tryCatchPattern":"gk, err := auth.NewGatekeeper(modes, clients, restConfig, ssoIf, clientForAuth, ns, ssoNs, namespaced, cache)\nif err != nil {\n    if strings.Contains(err.Error(), \"must specify at least one auth mode\") {\n        log.Fatalf(\"server misconfigured: set server.authorizationMode (client|server|sso) in the workflow-controller-configmap\")\n    }\n    return err\n}","preventionTips":["Always pin authorizationMode in the workflow-controller-configmap when deploying via helm/kustomize.","If disabling SSO, explicitly set authorizationMode: client,server.","Run a config preflight (helm template + grep authorizationMode) in CI.","After Argo upgrades, re-check deprecated auth flags still map to modes."],"tags":["argo-workflows","authentication","configuration","startup"],"backgroundTag":"missing-auth-mode-config","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}