Skip to content

Conversation

@moranbental
Copy link
Member

@moranbental moranbental commented Jul 23, 2025

In this PR:

  1. Introduced a new client for IG4 on the server side.
  2. Created a BaseClient to hold shared logic between clients.
  3. Added iguazio.v3.Client (for IG3) and iguazio.v4.Client (for IG4), with the appropriate client selected based on mlrun.mlconf.httpdb.authentication.mode.
  4. Introduced a new AuthenticationMode enum to represent the available authentication modes.
  5. Removed the verify_request_session method from the sync client, as it is no longer used.
  6. Moved all HTTP header keys to the HeaderNames constants module.
  7. Introduced a new AuthorizationHeaderPrefixes enum for commonly used header value prefixes (e.g., Bearer, Basic).

Notes:

  1. This PR does not yet support sending requests using the Iguazio SDK package, this will be handled in a separate story/PR - https://iguazio.atlassian.net/browse/ML-10644.
  2. The iguazio.v4.Client implementation is not yet complete, this PR only includes the initial file restructuring.

https://iguazio.atlassian.net/browse/ML-10294

@moranbental moranbental requested review from a team, alonmr, liranbg, quaark and yaelgen as code owners July 23, 2025 11:14
@moranbental moranbental marked this pull request as draft July 23, 2025 11:14
@moranbental moranbental marked this pull request as ready for review July 23, 2025 11:35
@moranbental moranbental requested a review from rokatyy July 23, 2025 18:20
Copy link
Member

@rokatyy rokatyy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking very good, just two very minor things

@moranbental moranbental requested a review from a team as a code owner July 24, 2025 09:36
Copy link
Member

@TomerShor TomerShor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor comments

@moranbental moranbental requested a review from TomerShor July 24, 2025 12:17
Copy link
Member

@TomerShor TomerShor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@moranbental moranbental merged commit ba6e104 into mlrun:feature/ig4-authentication Jul 27, 2025
13 checks passed
@moranbental moranbental deleted the auth-verifier branch July 27, 2025 09:50
moranbental added a commit to moranbental/mlrun that referenced this pull request Oct 15, 2025
…thentication] (mlrun#8366)

In this PR:

1. Introduced a new client for IG4 on the server side.
2. Created a `BaseClient` to hold shared logic between clients.
3. Added `iguazio.v3.Client` (for IG3) and `iguazio.v4.Client` (for
IG4), with the appropriate client selected based on
`mlrun.mlconf.httpdb.authentication.mode`.
4. Introduced a new `AuthenticationMode` enum to represent the available
authentication modes.
5. Removed the `verify_request_session` method from the sync client, as
it is no longer used.
6. Moved all HTTP header keys to the `HeaderNames` constants module.
7. Introduced a new `AuthorizationHeaderPrefixes` enum for commonly used
header value prefixes (e.g., Bearer, Basic).

**Notes:**
1. This PR does not yet support sending requests using the Iguazio SDK
package, this will be handled in a separate story/PR -
https://iguazio.atlassian.net/browse/ML-10644.
2. The `iguazio.v4.Client` implementation is not yet complete, this PR
only includes the initial file restructuring.

https://iguazio.atlassian.net/browse/ML-10294
liranbg pushed a commit that referenced this pull request Nov 3, 2025
### 📝 Description
<!-- A short summary of what this PR does. -->
<!-- Include any relevant context or background information. -->
This PR introduces support for MLRun authentication with IG4.
It rebases the `feature/ig4-authentication` branch onto `development`

This PR includes the following PRs:

1. #8345
2. #8370
3.  #8366
4. #8388
5. #8440
6. #8408
7. #8466
8. #8471
9. #8443
10. #8484
11. #8498
12. #8574
13. #8529
14. #8584
15. #8588
16. #8589
17. #8567
18. #8623
19. #8612
20. #8514
21. #8626
22. #8632
23. #8633
24. #8667
25. #8668
26. #8674
27. #8780
28. #8754
29. #8796
30. #8811
---

### 🛠️ Changes Made
<!-- - Key changes (e.g., added feature X, refactored Y, fixed Z) -->
To enable IG4 project authorization, set the following configs in mlrun
api:

```
MLRUN_HTTPDB__AUTHENTICATION__MODE: iguazio-v4
MLRUN_HTTPDB__AUTHENTICATION__IGUAZIO__SESSION_VERIFICATION_ENDPOINT: v1/identity/self
MLRUN_IGUAZIO_API_URL: http://igz-api:8000
```

Before importing MLRun, you must set:
```
MLRUN_AUTH_WITH_OAUTH_TOKEN__ENABLED=true
MLRUN_AUTH_TOKEN_ENDPOINT="https://igz-api.<namespace>.<system-domain>/api/v1/refresh-access-token"
```

---

### ✅ Checklist
- [x] I updated the documentation (if applicable)
- [x] I have tested the changes in this PR
- [ ] If I introduced a deprecation:
  - [ ] I followed the [Deprecation Guidelines](./DEPRECATION.md)
  - [ ] I updated the relevant Jira ticket for documentation

---

### 🧪 Testing
<!-- - How it was tested (unit tests, manual, integration) -->  
<!-- - Any special cases covered. -->  
Tested on IG4 system + unit tests

---

### 🔗 References
- Ticket link: https://iguazio.atlassian.net/browse/ML-9683,
https://iguazio.atlassian.net/browse/ML-9870,
https://iguazio.atlassian.net/browse/ML-9998
- Design docs links:
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/399179866/Support+IG4+Authentication+in+MLRun+AuthVerifier+HLD,
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/411960071/Support+sdk-side+IG4+authentication+-+token+usage+and+management+HLD,
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD,
- External links:
https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4

---

### 🚨 Breaking Changes?

- [x] Yes (explain below)
- [] No

Removed unused API endpoints `- POST /api/v1/user-secrets` which was not
in used

---

### 🔍️ Additional Notes


How to enable IG4 authentication -
https://iguazio.atlassian.net/wiki/spaces/PLAT/pages/457671097/Enable+IG4+Authentication+in+MLRun

---------

Co-authored-by: Katerina Molchanova <[email protected]>
Co-authored-by: Amit Elbaz <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants