Configure dex session timeout for argocd

[MikeK184]

Hi there, I've been trying to configure the dex.config thats included in argocd to have a session timeout after a given time. But the token the user gets assigned is always valid till the session ends.

've tried a couple of ways to set the expiry date/time but unfortunately the expiry date never changes. My knowledge of dex is very limited so I've been just trying Expiry settings I've found on the dex documentation. My dex.config in argocd looks like this:

  dex.config: |
    connectors:
      - type: ldap
        id: ad
        name: Active-Directory
        config:
          host: XXX
          insecureSkipVerify: true
          bindDN: XXX
          bindPW: $ldap.bindPW
          expiry: 
            idTokens: "5m"
            deviceRequests: "2m"
            signingKeys: "1m"
            refreshTokens:
              absoluteLifetime: "5m"
          userSearch:
            baseDN: XXX
            filter: "(objectClass=person)"
            username: userPrincipalName
            idAttr: DN
            emailAttr: mail
            nameAttr: sn
          groupSearch:
            baseDN: XXX
            filter: "(objectClass=group)"
            userAttr: DN
            groupAttr: member
            nameAttr: cn

[nabokihms]

Hello!

1. expiration settings should be on the same level as the settings of the connectors.

dex.config: |
    expiry: 
      idTokens: "5m"
      deviceRequests: "2m"
      signingKeys: "1m"
      refreshTokens:
        absoluteLifetime: "5m"
    connectors:
      - type: ldap
        id: ad
        name: Active-Directory
        config:
          host: XXX
          insecureSkipVerify: true
          bindDN: XXX
          bindPW: $ldap.bindPW
          userSearch:
            baseDN: XXX
            filter: "(objectClass=person)"
            username: userPrincipalName
            idAttr: DN
            emailAttr: mail
            nameAttr: sn
          groupSearch:
            baseDN: XXX
            filter: "(objectClass=group)"
            userAttr: DN
            groupAttr: member
            nameAttr: cn

2. Do not set the signingKeys lifetime to small intervals. Something like 6h is fine.

[MikeK184]

Hi,

that worked, thanks😃! Just out of interest, as I couldn't find proper info regarding the signingkey, what does it do?

Thanks, Mike

[nabokihms]

This is the interval of keys rotation. Keys are used to signing id tokens.
If tokens lifetime is more than the rotation period, Dex needs to keep all public keys for the JWKs endpoint.

[MikeK184]

Awesome thanks for the info! By any chance do you know if some extra configuration is needed in order to use refreshtokens? I've added it like that to the config but it doesn't seem to have any impact.
The docs say to pass offline_access but in which scope? Is there any example files one can go through?

[nabokihms]

I think you need to add it to the argocd config.

requestedScopes - https://argoproj.github.io/argo-cd/operator-manual/user-management/#existing-oidc-provider