Use Email for SSO RBAC with Google OIDC

[avifried1]

Summary

When using SSO auth mode with Google's OIDC, the issuer identifier (subject) is a unique user ID that isn't very useful and is hard to use for identifying users and managing RBAC permissions in a scalable way.

It will be more useful to use the user's email as the subject when using google as the OIDC provider.
per Google's OIDC documentation:

{
  "iss": "https://accounts.google.com",
  "azp": "1234987819200.apps.googleusercontent.com",
  "aud": "1234987819200.apps.googleusercontent.com",
  "sub": "10769150350006150715113082367",
  "at_hash": "HK6E_P6Dh8Y93mRNtsDB1Q",
  "hd": "example.com",
  "email": "jsmith@example.com",
  "email_verified": "true",
  "iat": 1353601026,
  "exp": 1353604926,
  "nonce": "0394852-3190485-2490358"
}

Use Cases

When google is set as the OIDC provider (issuer https://accounts.google.com). This is very useful for teams using G suite.

---

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

[alexec]

This should be easy for you to create a PR

type Claims struct {
	jwt.Claims
	Groups []string `json:"groups,omitempty"`
}

That needs an Email field, e.g.:

type Claims struct {
	jwt.Claims
        Email string `json:"email,omitempty"`
	Groups []string `json:"groups,omitempty"`
}

Also need to update the docs and your config to add email to sso.groups

[avifried1]

Will also be better to use Email, if available, in the workflows.argoproj.io/creator label

[alexec]

I've created a dev build for you to test to see that it does what you need:

docker pull argoproj/argocli:fix-4612

Please see #4644 for how to add email to your scopes, how to use it in your RBAC annotations, and how the email is re-formatted for the label.

[avifried1]

Checked new tag fix-4612 on minikube v1.15.1. Looks good.

• role annotations using email object:

email in [
      'me@mycompany.com'
      ]

• Tested user is assigned to correct SA
• Tested other users are assigned to default SA
• Tested annotation is added to new workflows:

workflows.argoproj.io/creator: 100000000003345678987654
workflows.argoproj.io/creator-email: me.at.mycompany.com

• After logging in with OIDC and redirecting back to Argo, Login page needs refresh in order to show email & email verified entries.

[simster7]

This is out on https://github.com/argoproj/argo/releases/tag/v2.12.6

[advithVashist]

Hi @simster7 @alexec!
I know this issue is closed, but my coworker made a PR referencing this issue: #10927. What is the process of getting this PR into the next release?