{"record":{"id":"e4f69ea6d18f4e8e","repo":"argoproj/argo-workflows","slug":"invalid-sso-logoutredirecturl-w","errorCode":null,"errorMessage":"invalid sso.logoutRedirectUrl: %w","messagePattern":"invalid sso\\.logoutRedirectUrl: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/apiserver/argoserver.go","lineNumber":153,"sourceCode":"func getResourceCacheNamespace(managedNamespace string) string {\n\tif managedNamespace != \"\" {\n\t\treturn managedNamespace\n\t}\n\treturn v1.NamespaceAll\n}\n\nfunc NewArgoServer(ctx context.Context, opts ArgoServerOpts) (Server, error) {\n\tconfigController := config.NewController(opts.Namespace, opts.ConfigName, opts.Clients.Kubernetes)\n\tlog := logging.RequireLoggerFromContext(ctx)\n\tvar resourceCache *cache.ResourceCache\n\tssoIf := sso.NullSSO\n\tif opts.AuthModes[auth.SSO] {\n\t\tc, err := configController.Get(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif err = logout.ValidateRedirectURL(c.SSO.LogoutRedirectURL); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid sso.logoutRedirectUrl: %w\", err)\n\t\t}\n\t\tssoIf, err = sso.New(ctx, c.SSO, opts.Clients.Kubernetes.CoreV1().Secrets(opts.Namespace), opts.BaseHRef, opts.TLSConfig != nil)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif ssoIf.IsRBACEnabled() {\n\t\t\t// resourceCache is only used for SSO RBAC\n\t\t\tresourceCache = cache.NewResourceCache(opts.Clients.Kubernetes, getResourceCacheNamespace(opts.ManagedNamespace))\n\t\t\tresourceCache.Run(ctx.Done())\n\t\t}\n\t\tlog.Info(ctx, \"SSO enabled\")\n\t} else {\n\t\tlog.Info(ctx, \"SSO disabled\")\n\t}\n\tgatekeeper, err := auth.NewGatekeeper(opts.AuthModes, opts.Clients, opts.RestConfig, ssoIf, auth.DefaultClientForAuthorization, opts.Namespace, opts.SSONamespace, opts.Namespaced, resourceCache)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/apiserver/argoserver.go#L135-L171","documentation":"At ArgoServer construction, logout.ValidateRedirectURL rejected the sso.logoutRedirectUrl from the argo-server config map. The wrapped error explains the specific problem (bad URL, disallowed host); the server refuses to start with SSO enabled and an invalid logout redirect.","triggerScenarios":"Thrown at server/apiserver/argoserver.go:153 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix sso.logoutRedirectUrl in the argo-server configmap to a valid absolute URL","Ensure the URL matches the issuer/allowed hosts requirements for OIDC logout"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}