ArgoCD and Oauth: policies/roles can only be assigned to groups, not to users?

[kastl-ars]

Dear all,

I am trying to wrap my head around ArgoCD RBAC policies.

Everything is working fine, but only if I assing policies to groups. Assigning policies to users is not being respected apparently.

For a demo setup I have enabled the "applications in any namespace" feature and can see my application in the my-namespace namespace.

As a user (my-user, which is part of the my-group group) I can "read" the applications, but syncing or deleting is not allowed, despite the last line. The username and the groups show up in the user info in the UI.

  policy.default: ""
  policy.csv: |
    g, cluster-admin, role:admin
    g, admin, role:admin                                                                                                                                                                                                                                     

    g, my-group, role:readonly                                                                                                                                                                                                                     

    p, my-user, applications, *, */my-namespace/*, allow                                                                                                                                                                                                

I found the warning that polices cannot be assigned to groups unless the group gets assigned a role first.
https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md?plain=1#L67

OK, that should not be a problem, as my group gets a role and I want to target a user.

But not matter what I try, the last line never takes effect. Whether or not I use */* or the syntax with the namespace, same result.

Funny thing: When I replace the user's name with the group's name, it suddenly works.

p, my-group, applications, *, */my-namespace/*, allow

Any ideas? Can I not target users in policies? Did I mess up the syntax? Is there a difference in the users whether they are local or come from Oauth (which is the case for me)?

[kastl-ars]

Hmm, working around this by creating a group for each user and then granting permissions to the group works, but is ugly.

Is it really not possible to target individual users?

[s3onghyun]

The pattern you are seeing is right (a group p/g works, an identical line with the user does not), but the lever is not quite "user vs group". It is which OIDC claims Argo CD examines during RBAC enforcement.

The argocd-rbac-cm has a scopes field that lists the OIDC scopes/claims checked in addition to sub, and it defaults to [groups]. That is why group policies work out of the box (the groups claim is examined) while a p, my-user, ... line does not match: the username/email claim is not being examined unless you add it. Also, for SSO the subject used is derived from the token (with Dex, federated_claims.user_id), not the display name shown in the UI.

So you have two clean options:

1. Assign via groups (the common practice), which already works.
2. If you must target individuals, add the claim to scopes and write policies against that claim value, for example:

# argocd-rbac-cm
data:
  scopes: '[groups, email]'
  policy.csv: |
    p, user@example.org, applications, *, */my-namespace/*, allow

Local (non-SSO) accounts are different: their login name is the subject, so p, <localuser>, ... works directly. You can verify how a subject resolves with argocd admin settings rbac can against a built policy.

[kastl-ars]

Thanks for the reply and the explanation!