Using existing Dex SSO

Connect Cased CD to your existing ArgoCD + Dex setup

If you already have ArgoCD configured with Dex (using Okta, LDAP, SAML, GitHub, etc.), Cased CD will automatically detect and use your existing SSO configuration. No additional identity provider setup is required.

How it works

Cased CD queries ArgoCD’s /api/v1/settings endpoint on startup. When it detects a dexConfig, it automatically displays an SSO login button that redirects through ArgoCD’s authentication flow.

User clicks "SSO" → ArgoCD /auth/login → Dex → Your IdP (Okta, etc.)
                                                      ↓
User logged into Cased CD ← ArgoCD callback ← Dex ← IdP authenticates

Prerequisites

• ArgoCD with Dex already configured and working
• Users can successfully log in to the standard ArgoCD UI via SSO

Setup

1. Verify your Dex configuration is working

   Test that SSO works with the standard ArgoCD UI first:

   # Check ArgoCD has dex config
   kubectl get configmap argocd-cm -n argocd -o yaml | grep -A 20 "dex.config"

   You should see your Dex connector configuration (e.g., SAML, OIDC, LDAP).

2. Allow Cased CD as a redirect URL

   ArgoCD validates redirect URLs after SSO. Add your Cased CD URL to additionalUrls in argocd-cm so ArgoCD accepts the redirect back to Cased CD:

   kubectl patch configmap argocd-cm -n argocd --type merge -p '
   data:
     additionalUrls: "https://cased-cd.example.com"
   '

   Replace https://cased-cd.example.com with the URL where Cased CD is accessible. Multiple URLs can be pipe-separated: "https://cased-cd.example.com|https://cased-cd-staging.example.com".

   Note

   The url setting in argocd-cm should continue pointing to your ArgoCD server. Do not change it. The additionalUrls setting tells ArgoCD to also accept redirects to Cased CD.

3. Deploy Cased CD

   helm install cased-cd oci://registry-1.docker.io/casedcontainers/cased-cd-enterprise \
     --namespace argocd \
     --set argocd.url=http://argocd-server.argocd.svc.cluster.local:80

   Tip

   Your existing ArgoCD UI continues to work as before. Both UIs can run side-by-side.

Test the login

1. Navigate to your Cased CD login page
2. You should see an “SSO” button (or “Sign in with SSO”)
3. Click the button
4. You’ll be redirected to your identity provider (Okta, etc.)
5. After authenticating, you’ll be redirected back to Cased CD and logged in

Troubleshooting

SSO button doesn’t appear

Check that ArgoCD returns dex config:

# Port-forward to ArgoCD
kubectl port-forward svc/argocd-server -n argocd 8080:80

# Check settings endpoint
curl -s http://localhost:8080/api/v1/settings | jq '.dexConfig'

If this returns null, ArgoCD doesn’t have Dex configured.

Check Cased CD can reach ArgoCD:

The Cased CD backend must be able to proxy requests to ArgoCD. Verify the argocd.url helm value is correct.

Check browser console:

Open browser dev tools and look for errors fetching /api/v1/settings.

”No argocd-initial-admin-secret”

This is expected when using Dex/SSO. ArgoCD disables the built-in admin password when SSO is configured. Use SSO to log in instead.

If you need local admin access for emergencies:

# Enable local admin (optional)
kubectl patch configmap argocd-cm -n argocd --type merge -p '
data:
  admin.enabled: "true"
'

# Create a password
argocd account bcrypt --password 'your-password'

# Add to argocd-secret
kubectl patch secret argocd-secret -n argocd --type merge -p '
stringData:
  admin.password: "$2a$10$..."
'

Callback redirects to ArgoCD UI instead of Cased CD

Cased CD passes a return_url parameter when initiating the SSO flow so that ArgoCD redirects back to Cased CD after authentication. If you’re landing on the ArgoCD UI instead:

1. Make sure you’re running Cased CD Enterprise (Community edition does not include SSO)
2. Verify your Cased CD URL is listed in additionalUrls in argocd-cm (see step 2 in Setup above)
3. Check that the SSO button URL contains return_url= pointing to your Cased CD domain
4. Verify you’re using a recent version of Cased CD Enterprise (v0.2.25+)

“Invalid redirect URL” error

ArgoCD validates that return_url matches its configured URLs. Add your Cased CD URL to additionalUrls:

kubectl patch configmap argocd-cm -n argocd --type merge -p '
data:
  additionalUrls: "https://cased-cd.example.com"
'

Note

You do not need to change the url setting in argocd-cm. It should continue pointing to your ArgoCD server. Only additionalUrls needs to include your Cased CD URL.

CORS errors in browser console

Ensure Cased CD’s backend is properly proxying to ArgoCD. The frontend should not make direct requests to ArgoCD.

Common Dex configurations

Okta via SAML

dex.config: |
  connectors:
    - type: saml
      id: okta
      name: Okta
      config:
        ssoURL: https://yourcompany.okta.com/app/xxx/sso/saml
        caData: <base64-encoded-cert>
        redirectURI: https://argocd.example.com/api/dex/callback
        usernameAttr: email
        emailAttr: email
        groupsAttr: groups

Okta via OIDC

dex.config: |
  connectors:
    - type: oidc
      id: okta
      name: Okta
      config:
        issuer: https://yourcompany.okta.com
        clientID: $dex.okta.clientID
        clientSecret: $dex.okta.clientSecret
        redirectURI: https://argocd.example.com/api/dex/callback
        scopes:
          - openid
          - profile
          - email
          - groups

GitHub

dex.config: |
  connectors:
    - type: github
      id: github
      name: GitHub
      config:
        clientID: $dex.github.clientID
        clientSecret: $dex.github.clientSecret
        orgs:
          - name: your-org

LDAP

dex.config: |
  connectors:
    - type: ldap
      id: ldap
      name: LDAP
      config:
        host: ldap.example.com:636
        bindDN: cn=admin,dc=example,dc=com
        bindPW: $dex.ldap.bindPW
        userSearch:
          baseDN: ou=users,dc=example,dc=com
          username: uid
          emailAttr: mail
        groupSearch:
          baseDN: ou=groups,dc=example,dc=com
          userMatchers:
            - userAttr: DN
              groupAttr: member

Groups and RBAC

When using Dex, group membership flows through to ArgoCD RBAC. Configure your ArgoCD RBAC policies to use the group names from your identity provider:

kubectl patch configmap argocd-rbac-cm -n argocd --type merge -p '
data:
  policy.csv: |
    p, role:developer, applications, get, */*, allow
    p, role:developer, applications, sync, */*, allow
    p, role:admin, applications, *, */*, allow
    g, developers, role:developer
    g, platform-team, role:admin
'

See Groups for more details on RBAC configuration.

Next steps

• Configure RBAC groups
• Set up audit trail