OIDC: PKCE Incorrectly Uses Base Redirect URL for ArgoCD Hosted Under Custom Path

[ptr1120]

Checklist:

• [ x] I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• [x ] I've included steps to reproduce the bug.
• [x ] I've pasted the output of argocd version.

Describe the bug

I'm hosting ArgoCD at a custom base path (mycompany.org/infra/argocd) and using Keycloak as an external IdP. The configuration functions as expected until I enable PKCE (Proof Key for Code Exchange). Specifically, when enablePKCEAuthentication is set to true in the argocd-cm config map, the ArgoCD frontend incorrectly uses window.location.origin as the redirect URL, as demonstrated in the getPKCERedirectURI function located in utils.ts.

To Reproduce

• Host Argocd under a sub-path, e.g. https://mycompany.org/infra/argocd/
• Configure an Idp Provider

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
data:
  url: https://mycompany.org/infra/argocd/
  enablePKCEAuthentication: true
  oidc.config: >-
    name: Keycloak
    issuer: https://<redacted>
    clientID: <redacted>
    clientSecret: $oidc.keycloak.clientSecret
    requestedScopes:
    - openid
    - profile
    - email
    - roles
    logoutURL: https://<redacted>/protocol/openid-connect/logout?redirect_uri={{logoutRedirectURL}}&id_token_hint={{token}}

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cmd-params-cm
data:
  - server.rootpath=/infra/argocd
  - server.basehref=/infra/argocd

• Click on Login via Keycloak button

Expected behavior

ArgoCD should respect one of the configured parameters (server.rootpath, server.basehref, or url from the argocd-cm or argocd-cmd-params-cm config map) to determine the correct base URL for redirects.

Version

v2.11.0-rc3+20fd621

[Marvin9]

So the expected redirect url should be https://mycompany.org/infra/argocd/pkce/verify instead of https://mycompany.org/pkce/verify?

[ptr1120]

Exactly, it schould be https://mycompany.org/infra/argocd/pkce/verify

[Marvin9]

Thanks @ptr1120 , normally if you navigate through pages does that prefix /infra/argocd is preserved in your browser URL?

[ptr1120]

Yes @Marvin9 it is preserved in my browser Url but window.location.origin seems to be only about the host part of the Url. See also

[Marvin9]

Alright thanks. Then the only problem to solve is to discover the root URL in browser and then we can pass to the function mentioned in the issue. I will look into this once I get time.

[ptr1120]

thanks @Marvin9