SSO and RBAC: how can I get more logs?

[LeJav]

Hello,
I am setting SSO and RBAC. I am using v2.12.0-rc5
I have a rule like that for a serviceaccount:
"'XXXXX' in myClaim"
I am using keycloak as auth server.
According to keycloak configuration (can be checked with 'evaluate' which displays the generated token), I have a claim myClaim which is an array, and includes string XXXXX.
But service account is not found by argo.
If I replace the rule with:
"'XXXXX' in ['YYYYY', 'XXXXX']"
it is working well.
How can I log the token claims in order to check what is wrong?
Or how can I troubleshoot?
Many thanks for your help

[alexec]

Claims, such as groups, issuer, subject, are shown in the user info page of the user interface - once you are logged in. Not helpful if you are not logged in. You should try and run the argo-server with verbose logging, e.g. args: ["-v", "server"].

[LeJav]

Thanks for your help.
I have defined my scope, let's say: myScope
This scope returns OIDC token, with subject... and also a claim named: myClaim = ['XXX', 'YYY']
For the serviceaccount, I have the rule: "'XXX' in myClaim"
But this does not work.
If I authenticate (by setting "true" for the rule), user info shows:

Issuer: argo-server
Subject: b0db3f13-ce94-4f41-b635-c5ed7e14b21d
Groups: -

Is 'groups' mandatory? It is not possible to use myScope and myClaim like in my example?
Sorry but I am a little bit lost...

[LeJav]

I have named my claim "groups" and it is now working.
My understanding is that argo has the claim name hardcoded.
Maybe this could be made clearer in the documentation.

[alexec]

They are hard-coded - you're correct - and only subject' and groups` is supported in v2.12. Maybe we need to allow more flexibility.

[LeJav]

Many thanks for your support.
You can close this request (do not know for a question if it can be closed)

[alexec]

You can mark as "answered"