Direct answer
The maximum lifetime of an active Argo CD UI session after IdP credential revocation is controlled by the server-side session cookie, not by the IdP access token. Under default configuration, Argo CD does not perform token introspection or proactive IdP validation on every request. The UI session remains usable until the cookie expires or is explicitly cleared. Personal access tokens (PATs) and service-account tokens are generated and managed by Argo CD itself; revoking the IdP credential does not invalidate them.
What is well-established versus version-dependent
The following behavior is consistent across Argo CD releases that support external OIDC authentication:
- Argo CD issues an opaque, server-side session cookie after OIDC login. The default lifetime is 24 hours.
- The cookie is independent of the IdP access token, ID token, or refresh token.
- By default, there is no per-request call back to the IdP to check whether the user's account is still active.
- PATs and service-account tokens are static bearer tokens stored in Argo CD. They are not bound to the IdP session.
One behavior is version-dependent and should be verified against your specific deployment: newer Argo CD releases introduce an optional oidc.idTokenExpiry setting that can enforce earlier session invalidation based on IdP token expiry. If your version supports this, it may shorten the window, but it still does not provide real-time revocation checking unless combined with explicit introspection configuration.
Forcing immediate logout
If you need to terminate an active session before the cookie expires, the supported approaches are to clear the server-side session store or rotate the Argo CD server cookie secret. Both actions invalidate existing UI sessions globally. There is no built-in, per-user "kill switch" that queries the IdP on each request under default settings.
Effect on API access
Because PATs are issued by Argo CD, disabling or deleting the user in the IdP has no immediate effect on existing PATs. The token continues to work until it expires or is revoked in the Argo CD UI or CLI. Service-account tokens behave the same way. If you need immediate API cutoff after IdP revocation, you must delete or rotate the token inside Argo CD.
Verification steps for your environment
- Log in to Argo CD via OIDC and inspect the session cookie in your browser. Note its expiry timestamp.
- Disable the user in the IdP while the browser session is still open.
- Continue using the Argo CD UI. If access persists until the cookie expiry, the default behavior is confirmed.
- Generate a PAT, disable the IdP account, and call the Argo CD API with the token. The call should still succeed.
- Check your Argo CD version and documentation to determine whether
oidc.idTokenExpiry is available and whether token introspection is configured.
One diagnostic detail needed
Which Argo CD version are you running? The availability of oidc.idTokenExpiry and any introspection options differs between 2.x and 3.x, and that changes whether you can reduce the session window without custom tooling.
argocd