panic receiving webhooks when auth-mode=sso

[aogier]

Hi, could somebody please advice on a panic I'm getting while on SSO and receiving a webhook from github? When in server auth-mode everything works well, 200 response and submitted workflow, but I really cannot try to make it working on sso.

This is unfortunate as everything looks so promising! But I can't let everything open to the world (obviously) nor put another authentication in front of server as I have to give users different permissions based on their group... am I missing something macroscopic? :)

Thank you all, regards!

time="2021-01-23T17:55:13.343Z" level=debug msg="Attempting to match webhook request" serviceAccountName=workflow-submitter webhookType=
2021/01/23 17:55:13 http: panic serving 10.0.1.74:38158: runtime error: invalid memory address or nil pointer dereference
goroutine 643 [running]:
net/http.(*conn).serve.func1(0xc000697540)
        /usr/local/go/src/net/http/server.go:1767 +0x139
panic(0x1eea1a0, 0x4105510)
        /usr/local/go/src/runtime/panic.go:679 +0x1b2
github.com/argoproj/argo/server/auth/webhook.addWebhookAuthorization(0xc0005ba200, 0x303a560, 0xc0000d62c0, 0x0, 0x0)
        /go/src/github.com/argoproj/argo/server/auth/webhook/interceptor.go:78 +0x7d4
github.com/argoproj/argo/server/auth/webhook.Interceptor.func1(0x2fd2f40, 0xc0009bb260, 0xc0005ba200, 0x2f82b40, 0xc0008827e0)
        /go/src/github.com/argoproj/argo/server/auth/webhook/interceptor.go:38 +0x41
github.com/argoproj/argo/server/apiserver.(*argoServer).newHTTPServer.func2(0x2fd2f40, 0xc0009bb260, 0xc0005ba200)
        /go/src/github.com/argoproj/argo/server/apiserver/argoserver.go:288 +0x58
net/http.HandlerFunc.ServeHTTP(0xc000396d00, 0x2fd2f40, 0xc0009bb260, 0xc0005ba200)
        /usr/local/go/src/net/http/server.go:2007 +0x44
net/http.(*ServeMux).ServeHTTP(0xc00064f340, 0x2fd2f40, 0xc0009bb260, 0xc0005ba200)
        /usr/local/go/src/net/http/server.go:2387 +0x1bd
net/http.serverHandler.ServeHTTP(0xc0009ba000, 0x2fd2f40, 0xc0009bb260, 0xc0005ba200)
        /usr/local/go/src/net/http/server.go:2802 +0xa4
net/http.(*conn).serve(0xc000697540, 0x2fdc400, 0xc001020200)
        /usr/local/go/src/net/http/server.go:1890 +0x875
created by net/http.(*Server).Serve
        /usr/local/go/src/net/http/server.go:2927 +0x38e

[aogier]

now it fails w/ a 401 token not valid for running mode, which is strange given I didn't changed nothing in the last minutes nor is github passing a token afaiu...

[aogier]

dang, an auth-mode client fixed everything. When I have a bit of time I contribute back some documentation because I whink we lack it a bit...

[alexec]

This is a bug. Can you please raise a bug report?

https://github.com/argoproj/argo/issues/new?assignees=&labels=bug&template=bug_report.md

[aogier]

starting argo-server with sso+client mode seems to fix the issue, I'm onsure if this is the proper way and I only had an hard time reading docs or this is indeed a bug. Did not open an issue because the discouraging template + "this is not an helpdesk" message, and frankly speaking was unsure on that this case is :)
Thank you to help me understand which is the proper path for this, ciao!

[aogier]

another issue, dunno if that's by design, is that argo-workflows-webhook-clients must have all the 4 keys defined, otherwise a panic occur, maybe it was just this, now I'm very tired as this session has been very discouraging until I found this working setup, we will see...

[alexec]

All good points. In Golang, panics typically mean bugs, as they always cause the app to crash, you'd never want that. It does seem simple reconfiguration fixes your issue.

Would you be interested in writing up some better docs?

[aogier]

I could definitely send some patches to existing ones, as a new user I probably have a better grasp on day 0 shenanigans. I can also confirm that:

• all the 4 keys in argo-workflows-webhook-clients are required otherwise panic
• auth-mode=sso also requires client mode if we want webhooks to properly work

at least on my setup on the latest released version. Tomorrow I'll pack those infos in a useful form :)