OIDC fails on 2.14.x

[OteemoSanjay]

Describe the bug

When enabling OIDC via the argocd-cm.json. On a newer version OIDC fails.
If i revert to 2.13.2 then same OIDC file functions correctly

To Reproduce

1. Install ArgoCD 2.14.2
2. Apply the argocd-cm.json from an old backup.
3. If I try to access the ArgoCD UI, OIDC connects to our OIDC server
4. This fails.

Expected behavior

1. Normal behavior would be that we can login via OIDC.
2. If I click the Login button after OIDC is enabled.
3. This is in the logs (shown below)
4. Reverting to old argoCD (2.13.2) and same OIDC file functions

Screenshots

Version

argoCD 2.14.2

Logs

time="2025-02-08T15:13:30Z" level=info msg="Initializing OIDC provider (issuer: https://www.XXX.edu/cas/oidc)"
time="2025-02-08T15:13:31Z" level=info msg="OIDC supported scopes: [openid profile email address phone offline_access groups]"
time="2025-02-08T15:13:31Z" level=info msg="Performing authorization_code flow login: https://www.XXX.edu/cas/oidc/oidcAuthorize?client_id=AQ6GkRYKQ3Q94lfsFmQvmqOoXOoa5SGA4PAh&redirect_uri=https%3A%2F%2Fdeployment.sand.lib.XXX.edu%2Fauth%2Fcallback&response_type=code&scope=openid+profile+email+groups&state=IuVpGVzxCerCYQuvJVZufxur"
time="2025-02-08T15:13:42Z" level=info msg="Callback: /auth/callback?code=OC-240-FzeiLReG-AIj02bQhQzlKgMS6PrdZtP-&state=IuVpGVzxCerCYQuvJVZufxur"
time="2025-02-08T15:13:45Z" level=warning msg="Failed to resync revoked tokens. retrying again in 1 minute: WRONGPASS invalid username-password pair or user is disabled."
time="2025-02-08T15:14:45Z" level=warning msg="Failed to resync revoked tokens. retrying again in 1 minute: WRONGPASS invalid username-password pair or user is disabled."
time="2025-02-08T15:15:45Z" level=info msg="invalidated cache for resource in namespace: argocd with the name: argocd-notifications-cm"```

[stvishw]

Form your logs, WRONGPASS invalid username-password pair or user is disabled.
Seems issue is with token validation.
RIght.

[OteemoSanjay]

Yeah but its not. Because if I revert the ArgoCD version, then the same username and password work From: stvishw ***@***.***> Date: Sunday, 9 February 2025 at 23:30 To: argoproj/argo-cd ***@***.***> Cc: Sanjay Jairam ***@***.***>, Author ***@***.***> Subject: Re: [argoproj/argo-cd] OIDC fails on 2.14.x (Issue #21825) Form your logs, WRONGPASS invalid username-password pair or user is disabled. Seems issue is with token validation. RIght. — Reply to this email directly, view it on GitHub<#21825 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BBKOQB4H2NXONCVJL76LYCD2PA2QFAVCNFSM6AAAAABWX6QCBCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNBWHE2TMOBVHE>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[OteemoSanjay]

hi

But its not. Because if you see the description, if I revert back to 2.13.2 and kubectl the argocd-cm.json file.
Then that token and hence username and password work fine on 2.13.2

rgds sanj