-
Notifications
You must be signed in to change notification settings - Fork 294
[AuthVerifier] Implement IG4 Client Functionality [feature/ig4-authentication] #8388
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[AuthVerifier] Implement IG4 Client Functionality [feature/ig4-authentication] #8388
Conversation
# Conflicts: # server/py/services/api/tests/unit/conftest.py
# Conflicts: # mlrun/common/schemas/constants.py # server/py/framework/utils/clients/iguazio/v3.py # server/py/framework/utils/clients/iguazio/v4.py # server/py/services/api/tests/unit/conftest.py # server/py/services/api/tests/unit/utils/clients/iguazio/test_iguazio_v3.py # tests/system/feature_store/test_feature_store.py
mlrun/common/schemas/constants.py
Outdated
|
|
||
| class CookieNames: | ||
| oauth2_proxy = "_oauth2_proxy" | ||
| iguazio = "session=j:" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please check my comment https://iguazio.atlassian.net/browse/NUC-542 - in some places this cookie is url-encoded and in some it is not, not sure whether it affects mlrun, but if you need to support both, then it won't work for encoded one
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also - technically session is the cookie name. The j: is already part of the content and denotes that the rest is JSON
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@rokatyy I also checked the flow in IG3 for creating a project, and it works fine
quaark
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good!
Minor
mlrun/common/schemas/constants.py
Outdated
|
|
||
| class CookieNames: | ||
| oauth2_proxy = "_oauth2_proxy" | ||
| iguazio = "session=j:" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also - technically session is the cookie name. The j: is already part of the content and denotes that the rest is JSON
quaark
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice!
TomerShor
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
222faa6
into
mlrun:feature/ig4-authentication
…tication] (mlrun#8388) This PR implements the functionality for `iguazio.v4.Client`, including: - Ensuring requests include either an `Authorization` header or an` _oauth2_proxy` cookie - Sending an async request directly to Orca to retrieve user info - Extracting the username and group IDs - Creating an AuthInfo object to pass to OPA for verification - Adding a CookieNames constant - Updating the `iguazio_client` pytest fixture to support both IG3 and IG4 clients Verification is covered by unit tests, as well as by testing on IG4 and IG3 systems https://iguazio.atlassian.net/browse/ML-10294
### 📝 Description <!-- A short summary of what this PR does. --> <!-- Include any relevant context or background information. --> This PR introduces support for MLRun authentication with IG4. It rebases the `feature/ig4-authentication` branch onto `development` This PR includes the following PRs: 1. #8345 2. #8370 3. #8366 4. #8388 5. #8440 6. #8408 7. #8466 8. #8471 9. #8443 10. #8484 11. #8498 12. #8574 13. #8529 14. #8584 15. #8588 16. #8589 17. #8567 18. #8623 19. #8612 20. #8514 21. #8626 22. #8632 23. #8633 24. #8667 25. #8668 26. #8674 27. #8780 28. #8754 29. #8796 30. #8811 --- ### 🛠️ Changes Made <!-- - Key changes (e.g., added feature X, refactored Y, fixed Z) --> To enable IG4 project authorization, set the following configs in mlrun api: ``` MLRUN_HTTPDB__AUTHENTICATION__MODE: iguazio-v4 MLRUN_HTTPDB__AUTHENTICATION__IGUAZIO__SESSION_VERIFICATION_ENDPOINT: v1/identity/self MLRUN_IGUAZIO_API_URL: http://igz-api:8000 ``` Before importing MLRun, you must set: ``` MLRUN_AUTH_WITH_OAUTH_TOKEN__ENABLED=true MLRUN_AUTH_TOKEN_ENDPOINT="https://igz-api.<namespace>.<system-domain>/api/v1/refresh-access-token" ``` --- ### ✅ Checklist - [x] I updated the documentation (if applicable) - [x] I have tested the changes in this PR - [ ] If I introduced a deprecation: - [ ] I followed the [Deprecation Guidelines](./DEPRECATION.md) - [ ] I updated the relevant Jira ticket for documentation --- ### 🧪 Testing <!-- - How it was tested (unit tests, manual, integration) --> <!-- - Any special cases covered. --> Tested on IG4 system + unit tests --- ### 🔗 References - Ticket link: https://iguazio.atlassian.net/browse/ML-9683, https://iguazio.atlassian.net/browse/ML-9870, https://iguazio.atlassian.net/browse/ML-9998 - Design docs links: https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/399179866/Support+IG4+Authentication+in+MLRun+AuthVerifier+HLD, https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/411960071/Support+sdk-side+IG4+authentication+-+token+usage+and+management+HLD, https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD, - External links: https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4 --- ### 🚨 Breaking Changes? - [x] Yes (explain below) - [] No Removed unused API endpoints `- POST /api/v1/user-secrets` which was not in used --- ### 🔍️ Additional Notes How to enable IG4 authentication - https://iguazio.atlassian.net/wiki/spaces/PLAT/pages/457671097/Enable+IG4+Authentication+in+MLRun --------- Co-authored-by: Katerina Molchanova <[email protected]> Co-authored-by: Amit Elbaz <[email protected]>
This PR implements the functionality for
iguazio.v4.Client, including:Authorizationheader or an_oauth2_proxycookieiguazio_clientpytest fixture to support both IG3 and IG4 clientsVerification is covered by unit tests, as well as by testing on IG4 and IG3 systems
https://iguazio.atlassian.net/browse/ML-10294