Skip to content

Conversation

@moranbental
Copy link
Member

@moranbental moranbental commented Jul 28, 2025

This PR implements the functionality for iguazio.v4.Client, including:

  • Ensuring requests include either an Authorization header or an _oauth2_proxy cookie
  • Sending an async request directly to Orca to retrieve user info
  • Extracting the username and group IDs
  • Creating an AuthInfo object to pass to OPA for verification
  • Adding a CookieNames constant
  • Updating the iguazio_client pytest fixture to support both IG3 and IG4 clients

Verification is covered by unit tests, as well as by testing on IG4 and IG3 systems
https://iguazio.atlassian.net/browse/ML-10294

# Conflicts:
#	server/py/services/api/tests/unit/conftest.py
# Conflicts:
#	mlrun/common/schemas/constants.py
#	server/py/framework/utils/clients/iguazio/v3.py
#	server/py/framework/utils/clients/iguazio/v4.py
#	server/py/services/api/tests/unit/conftest.py
#	server/py/services/api/tests/unit/utils/clients/iguazio/test_iguazio_v3.py
#	tests/system/feature_store/test_feature_store.py
@moranbental moranbental requested review from a team and alonmr as code owners July 28, 2025 13:22
@moranbental moranbental requested a review from quaark as a code owner July 28, 2025 13:22
@moranbental moranbental changed the title [AuthVerifier] mplement IG4 Client Functionality [feature/ig4-authentication] [AuthVerifier] Implement IG4 Client Functionality [feature/ig4-authentication] Jul 28, 2025

class CookieNames:
oauth2_proxy = "_oauth2_proxy"
iguazio = "session=j:"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please check my comment https://iguazio.atlassian.net/browse/NUC-542 - in some places this cookie is url-encoded and in some it is not, not sure whether it affects mlrun, but if you need to support both, then it won't work for encoded one

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also - technically session is the cookie name. The j: is already part of the content and denotes that the rest is JSON

Copy link
Member Author

@moranbental moranbental Jul 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rokatyy I also checked the flow in IG3 for creating a project, and it works fine

Copy link
Member

@quaark quaark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!
Minor


class CookieNames:
oauth2_proxy = "_oauth2_proxy"
iguazio = "session=j:"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also - technically session is the cookie name. The j: is already part of the content and denotes that the rest is JSON

@moranbental moranbental requested review from quaark and rokatyy July 29, 2025 10:54
Copy link
Member

@quaark quaark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

Copy link
Member

@TomerShor TomerShor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@moranbental moranbental merged commit 222faa6 into mlrun:feature/ig4-authentication Jul 30, 2025
13 checks passed
@moranbental moranbental deleted the session-implementation branch July 30, 2025 10:58
moranbental added a commit to moranbental/mlrun that referenced this pull request Oct 15, 2025
…tication] (mlrun#8388)

This PR implements the functionality for `iguazio.v4.Client`, including:

- Ensuring requests include either an `Authorization` header or an`
_oauth2_proxy` cookie
- Sending an async request directly to Orca to retrieve user info
- Extracting the username and group IDs
- Creating an AuthInfo object to pass to OPA for verification
- Adding a CookieNames constant
- Updating the `iguazio_client` pytest fixture to support both IG3 and
IG4 clients

Verification is covered by unit tests, as well as by testing on IG4 and
IG3 systems
https://iguazio.atlassian.net/browse/ML-10294
liranbg pushed a commit that referenced this pull request Nov 3, 2025
### 📝 Description
<!-- A short summary of what this PR does. -->
<!-- Include any relevant context or background information. -->
This PR introduces support for MLRun authentication with IG4.
It rebases the `feature/ig4-authentication` branch onto `development`

This PR includes the following PRs:

1. #8345
2. #8370
3.  #8366
4. #8388
5. #8440
6. #8408
7. #8466
8. #8471
9. #8443
10. #8484
11. #8498
12. #8574
13. #8529
14. #8584
15. #8588
16. #8589
17. #8567
18. #8623
19. #8612
20. #8514
21. #8626
22. #8632
23. #8633
24. #8667
25. #8668
26. #8674
27. #8780
28. #8754
29. #8796
30. #8811
---

### 🛠️ Changes Made
<!-- - Key changes (e.g., added feature X, refactored Y, fixed Z) -->
To enable IG4 project authorization, set the following configs in mlrun
api:

```
MLRUN_HTTPDB__AUTHENTICATION__MODE: iguazio-v4
MLRUN_HTTPDB__AUTHENTICATION__IGUAZIO__SESSION_VERIFICATION_ENDPOINT: v1/identity/self
MLRUN_IGUAZIO_API_URL: http://igz-api:8000
```

Before importing MLRun, you must set:
```
MLRUN_AUTH_WITH_OAUTH_TOKEN__ENABLED=true
MLRUN_AUTH_TOKEN_ENDPOINT="https://igz-api.<namespace>.<system-domain>/api/v1/refresh-access-token"
```

---

### ✅ Checklist
- [x] I updated the documentation (if applicable)
- [x] I have tested the changes in this PR
- [ ] If I introduced a deprecation:
  - [ ] I followed the [Deprecation Guidelines](./DEPRECATION.md)
  - [ ] I updated the relevant Jira ticket for documentation

---

### 🧪 Testing
<!-- - How it was tested (unit tests, manual, integration) -->  
<!-- - Any special cases covered. -->  
Tested on IG4 system + unit tests

---

### 🔗 References
- Ticket link: https://iguazio.atlassian.net/browse/ML-9683,
https://iguazio.atlassian.net/browse/ML-9870,
https://iguazio.atlassian.net/browse/ML-9998
- Design docs links:
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/399179866/Support+IG4+Authentication+in+MLRun+AuthVerifier+HLD,
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/411960071/Support+sdk-side+IG4+authentication+-+token+usage+and+management+HLD,
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD,
- External links:
https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4

---

### 🚨 Breaking Changes?

- [x] Yes (explain below)
- [] No

Removed unused API endpoints `- POST /api/v1/user-secrets` which was not
in used

---

### 🔍️ Additional Notes


How to enable IG4 authentication -
https://iguazio.atlassian.net/wiki/spaces/PLAT/pages/457671097/Enable+IG4+Authentication+in+MLRun

---------

Co-authored-by: Katerina Molchanova <[email protected]>
Co-authored-by: Amit Elbaz <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants