RBAC with Dex & GitHub Actions: how to match on user_id?

[iainlane]

I've not actually got this working yet, but I'm close. Once it's all good I'll be happy to write it up for the project somewhere.

After dexidp/dex@dcf7b18 in Dex, we can now get an ID token - exchanged from another one - which will work with Argo WF. This is great 🥳.

I've exchanged a token from GitHub's OIDC for a Dex ID token which looks like this:

{
  "aud": [
    "argo-workflows-sso",
    "argo-workflows-gha"
  ],
  "azp": "argo-workflows-gha",
  "exp": 1696959264,
  "federated_claims": {
    "connector_id": "github-actions",
    "user_id": "repo:<myorg>/iain-test-dex-argo:ref:refs/heads/main"
  },
  "iat": 1696872864,
  "iss": "https://dex.<mydomain>",
  "sub": "<sub>"
}

Now I'd like to write RBAC rules which will let these tokens submit workflows. Of all the claims in there I think the only one which is really useful is federated_claims.user_id (I'll also try to verify the audience too as a static string). But I can't see how to access it in the configmap. Can anyone help? For now I'd be okay with checking it starts with repo:<myorg>/, and then eventually I'll do more fancy stuff like restricting repos to work with jobs their own namespace.

[iainlane]

Update: I found out this wasn't possible anyway, for another reason - the Dex token isn't accepted by Argo WF since it's not signed. Discussion continues: #12049