Dex bridge

argocd-dex is a thin wrapper around the upstream dexidp/dex OIDC identity broker. It is what Argo CD uses to talk to corporate IdPs (GitHub, Google, Microsoft, Okta, OneLogin, LDAP, SAML, …).

Purpose

• Read the dex.config block from the argocd-cm ConfigMap.
• Render a dex.yaml config and start dex serve.
• Expose Dex on a known port that argocd-server can use as the upstream OIDC issuer.

Where it lives

Path	Purpose
cmd/argocd-dex/commands/	The binary's cobra commands, including gendexcfg and rundex.
util/dex/	Helpers to translate argocd-cm settings into a dex configuration.

The Procfile illustrates how the parts fit together:

dex: ARGOCD_BINARY_NAME=argocd-dex go run ... gendexcfg -o dist/dex.yaml \
     && docker run -p 5556:5556 -v dist/dex.yaml:/dex.yaml ghcr.io/dexidp/dex:vX.Y.Z dex serve /dex.yaml

In production the same idea applies: argocd-dex regenerates the dex config and runs the upstream binary, packaged together so a config change in argocd-cm is picked up automatically.

Why bridge instead of using Dex directly?

• Operators manage the OIDC config in a single Argo CD ConfigMap rather than in a Dex-specific Secret.
• Argo CD-specific defaults (issuer URL, signing keys, redirect URI templates) are baked in.
• Compatibility shims — for example, Argo CD historically supported the oidc.config block on the API server in addition to the Dex bridge.

OIDC at the API server

The actual OIDC consumer is util/oidc/oidc.go inside argocd-server. It:

1. Discovers the issuer URL — either Dex (via the bridge) or a directly-configured external IdP from oidc.config.
2. Implements the authorization code flow with PKCE.
3. Persists the resulting JWT in a cookie or returns it for CLI consumption.
4. Verifies tokens on each request and extracts groups for RBAC.

Templates for the consent/error pages live in util/oidc/templates.go.

Entry points for modification

• Tweak the dex config translation → util/dex/.
• Add a new IdP → that is a Dex feature; contribute upstream to dexidp/dex.
• Skip Dex entirely → set oidc.config in argocd-cm directly and disable Dex in the install.

See features/sso-and-rbac for how SSO and RBAC fit together.