How does ArgoCD handle SSO and what identity providers does it support?

ArgoCD supports Single Sign-On (SSO) through two integration paths: built-in Dex (bundled OpenID Connect identity broker) and external OIDC providers (configured directly in argocd-cm without Dex).

Built-in Dex

Dex acts as an OIDC proxy that federates authentication to upstream identity providers. You configure connectors in the argocd-cm ConfigMap under the dex.config key. Dex supports: GitHub/GitHub Enterprise (OAuth), GitLab, LDAP, SAML 2.0, Microsoft (Azure AD), Google, and any generic OIDC provider.

# argocd-cm
data:
  dex.config: |
    connectors:
      - type: github
        id: github
        name: GitHub
        config:
          clientID: $dex-github-client-id
          clientSecret: $dex-github-client-secret
          orgs:
            - name: my-org

External OIDC

If you already have an OIDC provider (Okta, Auth0, Keycloak, Azure AD with OIDC), you can bypass Dex entirely by configuring ArgoCD to accept tokens directly:

data:
  oidc.config: |
    name: Okta
    issuer: https://my-org.okta.com
    clientID: <client-id>
    clientSecret: $oidc-client-secret
    requestedScopes: [openid, profile, email, groups]

After SSO is configured, groups from the identity provider are mapped to ArgoCD roles in the RBAC policy using g, <group-name>, <argocd-role> lines. This means managing ArgoCD access becomes a matter of IdP group membership rather than per-user ArgoCD configuration.