ArgoCD behind an auth proxy

[bennesp]

I was wondering if ArgoCD supports a setup where it is put behind an auth proxy, maybe similar to what Grafana allows to do.

In this setup, ArgoCD should not ask the user for credentials, while instead it should look somewhere else (e.g.: an HTTP header) to get the username and, optionally, the role.

I tried to search this, but I only found ways of integrating existing SSO in ArgoCD. Unfortunately, that would mean having two different setups for the same purpose: the existing one with a centralized auth proxy and all the apps behind it, and the other one with ArgoCD exposed without the auth proxy, but configured to use the same configuration the auth proxy is using. Of course, I would like to avoid the latter.

Do you think this is possible?

[hyec]

I found dex support the authproxy connector, but this config doesn't work.
I have no idea what's wrong and how to debug it.

dex.config: |
  connectors:
    - type: authproxy
      id: oauth2-proxy
      name: OAuth2-Proxy
      config:
        userHeader: X-Forwarded-User
        groupHeader: X-Forwarded-Group
        staticGroups:
          - default