Configure Azure SSO for Argo CD

[adamrushuk]

Todo

• Add missing Sign on URL in Ent App Basic SAML Configuration SSO config

• Add missing email user.userprincipalname claim in User Attributes & Claims SSO config

• Add missing SAML Signing Certificate in Ent App SSO config: https://docs.microsoft.com/en-us/graph/application-saml-sso-configure-api?tabs=http#step-4-configure-signing-certificate

• https://argoproj.github.io/argo-cd/operator-manual/user-management/microsoft/

• Fix RBAC using AAD Group ID - default rbac roles not required

• Investigate using Terraform for all AAD requirements

  • Manually configure AAD Enterprise Application, then use azuread_application data source to view properties: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/application
    • Create a Service Principle to make an App Reg and Enterprise App: Support for AzureAD Enterprise Applications & Proxy Resources hashicorp/terraform-provider-azuread#7 (comment)
    • UPDATE: Enterprise Apps are not supported atm, but possible workaround here: How to create a SAML-enabled service principal that's linked to the application registration hashicorp/terraform-provider-azuread#173 (comment)
    • workaround? Assigning Users or Groups to an Enterprise Application in Azure hashicorp/terraform-provider-azuread#164 (comment)
  • Enterprise Application Certificate (Base64) will need downloading, and base64 output
  • SSO URLs can be interpolated using templatefile function: https://www.terraform.io/docs/configuration/functions/templatefile.html

• Use kubectl merge patch to update Argo CD ConfigMaps

[adamrushuk]

Leaving this as partially automated, and waiting for Terraform to support new Graph API.
Claims Mapping is a PITA for a one-off setting: https://docs.microsoft.com/en-us/graph/application-saml-sso-configure-api?tabs=http#step-3-configure-claims-mapping