is it possible to use local users and dex OIDC in parallel

[treenerd]

Dear ArgoCD community,

ArgoCD version v2.8.3+77556d9

I have a situation where I would like to use dex OIDC and local users.
Tried to follow the docs, but run always into issues with the local user.
I checked if the user got created with argocd cli with argocd account list and the user was created.
So I followed the docs and set a password for the user.
But when I try to login, I always got Invalid user or password .
I tried to check if the user and password combination is the issue multiple times :-D . But who knows ..

So my question is:
Is it possible to have dex config (OIDC) and local user accounts at the same time?
Or is dex replacing the local user management completely if enabled?

time="2023-10-31T08:16:14Z" level=warning msg="User testuser failed login 1 time(s)"
time="2023-10-31T08:16:14Z" level=info msg="finished unary call with code Unauthenticated" error="rpc error: code = Unauthenticated desc = Invalid username or password" grpc.code=Unauthenticated grpc.method=Create grpc.service=session.SessionService grpc.start_time="2023-10-31T08:16:14Z" grpc.time_ms=593.857 span.kind=server system=grpc

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-cm
data:
  accounts.testuser: apiKey, login
  # disables user. User is enabled by default
  accounts.testuser.enabled: "true"
  url: https://****
  exec.enabled: "true"
  dex.config: |
    connectors:
    - config:
        issuer: https://accounts.google.com
        clientID: *****
        clientSecret: ******
      type: oidc
      id: google
      name: Google

Thank you

[tmccoy]

Hi @treenerd did you ever figure out if this was possible? We're running into the same issue.

[rcrisan-gpsw]

The solution for me was to store the password in the argocd-secret instead of updating password with the argocd cli tool as referenced in the docs.
argocd-secret:

apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
  namespace: argocd
data:
  accounts.local-user.password: <bcrypt_hash>

Generate bcrypt hash for any password with the argocd cli tool:
argocd account bcrypt --password YOUR_PASSWORD

argocd-cm:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  accounts.local-user: login