argoproj/argo-workflows · error

invalid sso.logoutRedirectUrl: %w

Error message

invalid sso.logoutRedirectUrl: %w

What it means

At ArgoServer construction, logout.ValidateRedirectURL rejected the sso.logoutRedirectUrl from the argo-server config map. The wrapped error explains the specific problem (bad URL, disallowed host); the server refuses to start with SSO enabled and an invalid logout redirect.

Source

Thrown at server/apiserver/argoserver.go:153

func getResourceCacheNamespace(managedNamespace string) string {
	if managedNamespace != "" {
		return managedNamespace
	}
	return v1.NamespaceAll
}

func NewArgoServer(ctx context.Context, opts ArgoServerOpts) (Server, error) {
	configController := config.NewController(opts.Namespace, opts.ConfigName, opts.Clients.Kubernetes)
	log := logging.RequireLoggerFromContext(ctx)
	var resourceCache *cache.ResourceCache
	ssoIf := sso.NullSSO
	if opts.AuthModes[auth.SSO] {
		c, err := configController.Get(ctx)
		if err != nil {
			return nil, err
		}
		if err = logout.ValidateRedirectURL(c.SSO.LogoutRedirectURL); err != nil {
			return nil, fmt.Errorf("invalid sso.logoutRedirectUrl: %w", err)
		}
		ssoIf, err = sso.New(ctx, c.SSO, opts.Clients.Kubernetes.CoreV1().Secrets(opts.Namespace), opts.BaseHRef, opts.TLSConfig != nil)
		if err != nil {
			return nil, err
		}
		if ssoIf.IsRBACEnabled() {
			// resourceCache is only used for SSO RBAC
			resourceCache = cache.NewResourceCache(opts.Clients.Kubernetes, getResourceCacheNamespace(opts.ManagedNamespace))
			resourceCache.Run(ctx.Done())
		}
		log.Info(ctx, "SSO enabled")
	} else {
		log.Info(ctx, "SSO disabled")
	}
	gatekeeper, err := auth.NewGatekeeper(opts.AuthModes, opts.Clients, opts.RestConfig, ssoIf, auth.DefaultClientForAuthorization, opts.Namespace, opts.SSONamespace, opts.Namespaced, resourceCache)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 35bff19146)

Solutions

1. Fix sso.logoutRedirectUrl in the argo-server configmap to a valid absolute URL
2. Ensure the URL matches the issuer/allowed hosts requirements for OIDC logout

When it happens

Trigger: Thrown at server/apiserver/argoserver.go:153 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/e4f69ea6d18f4e8e. Report an issue: GitHub.