What problem does it solve? A successful Entra SSO login that lands the user with no permissions — an empty Argo CD Applications view or a Grafana Viewer-only session — is an authorization bug, not an authentication bug. This Skill separates the two, proves the USX tenant will not emit a groups claim, and routes role mapping through Entra app roles instead. ## Core Features & Use Cases - Authentication vs. authorization split: Decode the issued token and label each claim set against the running argocd-server pod so stale tokens are never tested against new config. - App-role fallback for missing group claims: Define app roles on the app registration, assign groups or users via appRoleAssignments, and rekey policy.csv subjects to the roles claim. - RBAC policy verification: Enforce the four failure rules — claim name vs. value, single subject kind, correct scopes, and p, rules per role — and verify argocd-rbac-cm contents rather than trusting a green Kustomization. - Use Case: After an Argo CD OIDC login succeeds but shows zero Applications, run the token-claims script, confirm no groups claim exists, assign platform-admin as an app role, and rekey the RBAC policy to scopes: "[roles, groups]". ## Quick Start Diagnose why my Entra SSO login to Argo CD succeeds but shows an empty Applications list, and fix the RBAC policy to use app roles.
