Unable to use SSO via bitbucket cloud connector

[longthanhtran]

I have upgraded ArgoCD to latest version after found out SSO no longer work due to a recent change from bitbucket.

The change from dexidp/dex project already covered this issue and catched up via helm chart 9.4.8 on ArgoCD project.

My config on argocd-cm ConfigMap looks like this

data:
  url: https://my-site.com
  dex.config: |
    logger:
      level: debug
      format: json
    connectors:
      - type: bitbucket-cloud
        id: bitbucket-cloud
        name: Bitbucket Cloud
        config:
          clientID: $dex.config.client_id
          clientSecret: $dex.config.client_secret
          scopes:
          - account
          - email

but the dex-server keep gives me the log .."err":"bitbucket: get user teams: 410 Gone.. which I think the scope still includes "teams" while I didn't add this in my config.

I don't know if any thing wrong in my config so can you please guide me the right settings?

Thanks.

[longthanhtran]

I think the reason is dexidp has not included the fix in its final release.

[lohitkolluri]

Yeah, you're spot on. The fix in dex PR #4687 has been merged but it hasn't been included in any dex release yet. Even if ArgoCD bumps the dex dependency version in a helm chart update, it won't help until dex actually ships a release with that change.

The reason you're still getting the 410 Gone error even without teams in your config is that the bitbucket-cloud connector in dex always fetches the user's teams internally—regardless of what scopes you specify. That's exactly what PR #4687 is meant to fix.

Unfortunately there isn't a clean config-only workaround for this. Options you have:

1. Build a custom dex image — Check out dex at the commit with PR #4687, build it, and point your ArgoCD to use that image. Not ideal for production but it works.

2. Switch SSO provider temporarily — If Bitbucket isn't a hard requirement, use GitHub, Google, or another OIDC provider as a stopgap.

3. Use ArgoCD's direct OIDC (skip dex) — ArgoCD can integrate with OIDC providers directly. Bitbucket Cloud doesn't support OIDC though (it's OAuth 2.0 only), so this won't work for Bitbucket specifically.

4. Wait for the next dex release — The fix is merged and will ship in a future dex release. Once it does, a subsequent ArgoCD update will pick it up.

It's frustrating when it's blocked upstream like this, I know. Hope that saves you some head-scratching!

[longthanhtran]

yes, I actually did think about some options as you mentioned and try with oauth2 (connector) config but it doesn't work. So for now I have to fallback to local account since the team size also very small at the moment to wait until the new release from dexidp.

I understand the nature of sub-component like this in ArgoCD project, same as many dependencies in other codebase, sometimes we have to wait :)