All 29 RBAC questions
More in RBAC
How do AppProjects and RBAC work together for multi-tenancy? How do you grant fine-grained permissions like sync but not delete? How do you manage RBAC for API/automation accounts (project roles and tokens)? How do you troubleshoot 'permission denied' errors in ArgoCD? How do project roles and tokens enable least-privilege automation? How do you audit and troubleshoot effective permissions for a user? How do you implement break-glass emergency access safely? How do you separate duties between who can create apps and who can sync them? How do you enforce that only signed/approved commits get deployed?
Advertisement
ArgoCD › RBAC

How does the scopes setting affect group mapping?

Advanced

Answer

The scopes field in argocd-rbac-cm tells ArgoCD which token claims to read for subject matching (commonly groups, sometimes email). If it doesn't reference the claim your IdP sends, g bindings won't match and users fall to the default role. Correct scopes are essential for SSO group RBAC to work.
data:
  scopes: '[groups, email]'
Real-world example Adding groups to scopes fixes users landing on readonly because their group claim wasn't being read.

Common follow-ups: Why might group bindings silently fail? | What claims can scopes reference?

Multi-cluster Applications RBAC
All 29 RBAC questions