argoproj/argo-workflows · warning

not implemented

Error message

not implemented

What it means

nullService is the placeholder SSO implementation used when SSO is not configured. Its Authorize method always returns an error 'not implemented' because there is no real OIDC provider behind it to validate tokens. Any code path calling Authorize while SSO is disabled will get this error, signaling that SSO-backed authorization is not available.

Source

Thrown at server/auth/sso/null_sso.go:31

func (n nullService) LogoutURL() string {
	return ""
}

func (n nullService) LogoutRedirectURL() string {
	return ""
}

func (n nullService) ClientID() string {
	return ""
}

func (n nullService) IsRBACEnabled() bool {
	return false
}

func (n nullService) Authorize(string) (*types.Claims, error) {
	return nil, fmt.Errorf("not implemented")
}

func (n nullService) HandleRedirect(w http.ResponseWriter, _ *http.Request) {
	w.WriteHeader(http.StatusNotImplemented)
}

func (n nullService) HandleCallback(w http.ResponseWriter, _ *http.Request) {
	w.WriteHeader(http.StatusNotImplemented)
}

View on GitHub (pinned to 35bff19146)

Solutions

1. Configure SSO: create the argo-server SSO ConfigMap (issuer, clientId, clientSecret, redirectUrl) and restart argo-server so the real OIDC service replaces nullService
2. Check argo-server startup logs for SSO config load failures and fix the underlying ConfigMap/key errors
3. Guard callers with `if sso.IsRBACEnabled()` before calling Authorize, and use service-account/client auth modes when SSO is intentionally disabled

Example fix

// before
claims, _ := sso.Authorize(token)
// after
if !sso.IsRBACEnabled() {
    return fmt.Errorf("SSO is not configured")
}
claims, err := sso.Authorize(token)

if !sso.IsRBACEnabled() {
    return errors.New("SSO is not configured on this argo-server; use client or server auth mode")
}

func ssoAvailable(s sso.Interface) bool {
    return s != nil && s.IsRBACEnabled()
}

claims, err := sso.Authorize(token)
if err != nil && err.Error() == "not implemented" {
    http.Error(w, "SSO is not configured", http.StatusNotImplemented)
    return
}

When it happens

Trigger: Calling sso.Authorize(token) — e.g. an HTTP/gRPC interceptor checking an SSO token — while the argo-server was started without an SSO ConfigMap, so the nullService was installed instead of the real OIDC service; also exercised directly by sso package tests.

Common situations: Client sends Authorization: Bearer tokens expecting SSO auth but server runs with SSO disabled; the SSO ConfigMap failed to load at startup and argo-server fell back to nullService; code/tests invoking the interface without checking IsRBACEnabled first.

Related errors

• failed to marshall claims: %w
• failed to load system cert pool: %w
• failed to append certificates from PEM string
• issuer empty
• clientID empty

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/b8d7b2500f40e615. Report an issue: GitHub.