[User secrets] Create API Endpoint to Store or Update Secret Tokens [feature/ig4-authentication] #8408

moranbental · 2025-08-03T11:49:41Z

This PR introduces a new API endpoint to store or update multiple offline tokens:
PUT /api/v1/user-secrets/tokens

For each token in the request, the following validations and operations are performed:

Token Name Validation – Ensure each token has a non-empty and unique name within the request.
JWT Decoding – Decode the offline token and verify it contains the required claims: sub (user ID) and exp (expiration).
User Ownership Validation – Confirm that the sub in the offline token matches the authenticated user ID
Token Verification – Use the Iguazio SDK to validate all tokens via the refresh_access_tokens call. This will be enabled in a separate PR ([Client v4] Implementing refresh_access_token [feature/ig4-authentication] #8443).
Secret Storage – (Not implemented in this PR) Creation and updating of Kubernetes secrets will be handled in a separate PR.

Response Structure – Return lists of token names categorized by action: created_tokens, updated_tokens, and skipped_tokens.

This functionality has been verified only via unit tests for now

Additional Changes

Renamed api/endpoints/secrets.py → api/endpoints/project_secrets.py.
Extracting the user_id from Orca’s session verification endpoint and saving it in the AuthInfo

https://iguazio.atlassian.net/browse/ML-10487

# Conflicts: # server/py/services/api/tests/unit/conftest.py

…ifier

# Conflicts: # mlrun/common/schemas/constants.py # server/py/framework/utils/clients/iguazio/v3.py # server/py/framework/utils/clients/iguazio/v4.py # server/py/services/api/tests/unit/conftest.py # server/py/services/api/tests/unit/utils/clients/iguazio/test_iguazio_v3.py # tests/system/feature_store/test_feature_store.py

…t + add todo

quaark

Looks good!
Just a minor comment

quaark · 2025-08-06T13:05:26Z

server/py/services/api/crud/secrets.py

+        # iguazio_client = framework.utils.clients.iguazio.v4.Client()
+
+        # TODO: Enable this once it is implemented in the Iguazio client.
+        # iguazio_client.refresh_access_tokens(secret_tokens)


this should be before _validate_and_decode_offline_tokens since you use verify_signature=False there, so first try to use it and only if it works - then decode it.

@quaark The whole point was to perform the check on the mlrun side first and fail fast before sending the request to orca. Then, when decoding, we use verify_signature=False because the signature will be verified on the orca side later.

same - you can now add it in

server/py/framework/utils/clients/iguazio/v4.py

server/py/services/api/api/endpoints/user_secrets.py

server/py/services/api/crud/secrets.py

server/py/services/api/tests/unit/api/test_user_secrets.py

…nding orca

…-authentication] (#8440) ### 📝 Description   This PR adds new HTTPDB SDK methods to store or update one or more token secrets in MLRun. The new methods allow sending offline token JWTs to the MLRun API, which stores each token as a user secret and returns a structured response indicating whether each token was created, updated, or skipped. --- ### 🛠️ Changes Made  Added store_secret_token method to store or update a single token: `db.store_secret_token(secret_token: mlrun.common.schemas.SecretToken, log_warning: bool = True)` Added store_secret_tokens method to store or update multiple tokens: `db.store_secret_tokens(secret_tokens: list[mlrun.common.schemas.SecretToken], log_warning: bool = True)` --- ### ✅ Checklist - [x] I updated the documentation (if applicable) - [x] I have tested the changes in this PR --- ### 🧪 Testing   --- ### 🔗 References - Ticket link: https://iguazio.atlassian.net/browse/ML-10501 - Design docs links: https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD - External links: https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4 --- ### 🚨 Breaking Changes? - [ ] Yes (explain below) - [x] No  --- ### 🔍️ Additional Notes   API side PR - #8408

quaark

Awesome!
I think you may now add the usage of the iguazio sdk - as the relevant methods are implemented.

quaark · 2025-08-13T06:41:55Z

server/py/framework/utils/clients/iguazio/v4.py

+        # TODO: Implement this method once it is available in the Iguazio package
+        pass


It is now implemented

I didn’t add it because no release rc has been published yet, so it will be handled in a different story/pr — #8443.
Also, there is an issue in the CI with importing Iguazio, which is why I added it in a separate pr.

quaark · 2025-08-13T06:42:02Z

server/py/framework/utils/clients/iguazio/v4.py

+        # TODO: Implement this method once it is available in the Iguazio package
+        pass


no, refresh_access_tokens (for many tokens) was not implemented yet, only the refresh_access_token

quaark · 2025-08-13T06:42:27Z

server/py/services/api/crud/secrets.py

+        # iguazio_client = framework.utils.clients.iguazio.v4.Client()
+
+        # TODO: Enable this once it is implemented in the Iguazio client.
+        # iguazio_client.refresh_access_tokens(secret_tokens)


same - you can now add it in

…-authentication] (mlrun#8440)   This PR adds new HTTPDB SDK methods to store or update one or more token secrets in MLRun. The new methods allow sending offline token JWTs to the MLRun API, which stores each token as a user secret and returns a structured response indicating whether each token was created, updated, or skipped. ---  Added store_secret_token method to store or update a single token: `db.store_secret_token(secret_token: mlrun.common.schemas.SecretToken, log_warning: bool = True)` Added store_secret_tokens method to store or update multiple tokens: `db.store_secret_tokens(secret_tokens: list[mlrun.common.schemas.SecretToken], log_warning: bool = True)` --- - [x] I updated the documentation (if applicable) - [x] I have tested the changes in this PR ---   --- - Ticket link: https://iguazio.atlassian.net/browse/ML-10501 - Design docs links: https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD - External links: https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4 --- - [ ] Yes (explain below) - [x] No  ---   API side PR - mlrun#8408

…feature/ig4-authentication] (mlrun#8408) This PR introduces a new API endpoint to store or update multiple offline tokens: `PUT /api/v1/user-secrets/tokens` For each token in the request, the following validations and operations are performed: 1. Token Name Validation – Ensure each token has a non-empty and unique name within the request. 2. JWT Decoding – Decode the offline token and verify it contains the required claims: sub (user ID) and exp (expiration). 3. User Ownership Validation – Confirm that the sub in the offline token matches the authenticated user ID 4. Token Verification – Use the Iguazio SDK to validate all tokens via the `refresh_access_tokens` call. This will be enabled in a separate PR (mlrun#8443). 5. Secret Storage – (Not implemented in this PR) Creation and updating of Kubernetes secrets will be handled in a separate PR. Response Structure – Return lists of token names categorized by action: created_tokens, updated_tokens, and skipped_tokens. This functionality has been verified only via unit tests for now Additional Changes 1. Renamed `api/endpoints/secrets.py` → `api/endpoints/project_secrets.py`. 2. Extracting the user_id from Orca’s session verification endpoint and saving it in the AuthInfo https://iguazio.atlassian.net/browse/ML-10487

### 📝 Description   This PR introduces support for MLRun authentication with IG4. It rebases the `feature/ig4-authentication` branch onto `development` This PR includes the following PRs: 1. #8345 2. #8370 3. #8366 4. #8388 5. #8440 6. #8408 7. #8466 8. #8471 9. #8443 10. #8484 11. #8498 12. #8574 13. #8529 14. #8584 15. #8588 16. #8589 17. #8567 18. #8623 19. #8612 20. #8514 21. #8626 22. #8632 23. #8633 24. #8667 25. #8668 26. #8674 27. #8780 28. #8754 29. #8796 30. #8811 --- ### 🛠️ Changes Made  To enable IG4 project authorization, set the following configs in mlrun api: ``` MLRUN_HTTPDB__AUTHENTICATION__MODE: iguazio-v4 MLRUN_HTTPDB__AUTHENTICATION__IGUAZIO__SESSION_VERIFICATION_ENDPOINT: v1/identity/self MLRUN_IGUAZIO_API_URL: http://igz-api:8000 ``` Before importing MLRun, you must set: ``` MLRUN_AUTH_WITH_OAUTH_TOKEN__ENABLED=true MLRUN_AUTH_TOKEN_ENDPOINT="https://igz-api.<namespace>.<system-domain>/api/v1/refresh-access-token" ``` --- ### ✅ Checklist - [x] I updated the documentation (if applicable) - [x] I have tested the changes in this PR - [ ] If I introduced a deprecation: - [ ] I followed the [Deprecation Guidelines](./DEPRECATION.md) - [ ] I updated the relevant Jira ticket for documentation --- ### 🧪 Testing   Tested on IG4 system + unit tests --- ### 🔗 References - Ticket link: https://iguazio.atlassian.net/browse/ML-9683, https://iguazio.atlassian.net/browse/ML-9870, https://iguazio.atlassian.net/browse/ML-9998 - Design docs links: https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/399179866/Support+IG4+Authentication+in+MLRun+AuthVerifier+HLD, https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/411960071/Support+sdk-side+IG4+authentication+-+token+usage+and+management+HLD, https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD, - External links: https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4 --- ### 🚨 Breaking Changes? - [x] Yes (explain below) - [] No Removed unused API endpoints `- POST /api/v1/user-secrets` which was not in used --- ### 🔍️ Additional Notes How to enable IG4 authentication - https://iguazio.atlassian.net/wiki/spaces/PLAT/pages/457671097/Enable+IG4+Authentication+in+MLRun --------- Co-authored-by: Katerina Molchanova <[email protected]> Co-authored-by: Amit Elbaz <[email protected]>

moranbental added 30 commits July 22, 2025 09:25

use enum class + separate to functions

231ddfd

separate clients

052ae61

fix

bd536c6

call orca directly

9661894

add todo

1cad171

fix test

251ce04

fix test

c7dd8c1

fix some

df8a955

Merge branch 'feature/ig4-authentication' into auth-verifier

dd625e2

implement v4

aecb6cd

use constant + move clients in iguazio folder

4541803

create enum for header prefixes

678de11

Merge branch 'auth-verifier' into session-implementation

a968f1b

# Conflicts: # server/py/services/api/tests/unit/conftest.py

fix tests

20624f3

Merge branch 'auth-verifier' into session-implementation

086c19b

after cr + fix tests

bb145d8

adding cookies and request id to header names

64158ef

Merge commit 'd46ee625da4885d60bf43da6f66b6c6b7c74356d' into auth-ver…

2ef3e5b

…ifier

Merge branch 'auth-verifier' into session-implementation

1074f8c

more implemetations

ef43302

fix test + add cookie and cookies to constant header names

a6394fd

Merge branch 'auth-verifier' into session-implementation

0d0ebdc

add session iguazio cookie to constant

cf1e633

use constant

6d630a3

move patch request to common file + check relationships is a list

1087a2c

add more tests + accept missing relationships

9ddfd41

remove test

e7bf3f4

add logs when unauthorized request + move logger to base client

6baca7a

implement _handle_error_response also for v3 (moving to base)

b4328a3

moranbental added 5 commits August 5, 2025 11:34

after cr

9499df3

add todo

1a1086a

add todo in tests

dd45c8b

remove AuthInfo validation in endpoint + change authorization endpoin…

91e3961

…t + add todo

remove /tokens + remove todo

3af1559

quaark reviewed Aug 6, 2025

View reviewed changes

TomerShor requested changes Aug 7, 2025

View reviewed changes

fix after ct + try to fix iguazio installation

29d8ca4

moranbental mentioned this pull request Aug 10, 2025

[HTTPDB] Create new SDK method to store or update tokens [feature/ig4-authentication] #8440

Merged

4 tasks

fix refresh

fe1b073

moranbental marked this pull request as draft August 11, 2025 10:39

moranbental added 3 commits August 11, 2025 13:39

trying to install iguazio package

47b0d81

not implementing the refresh access token - different pr

26645f7

fix todo

990a9f5

moranbental marked this pull request as ready for review August 11, 2025 11:11

moranbental requested a review from quaark August 11, 2025 11:16

moranbental added 3 commits August 11, 2025 16:13

no need to validate the sub in offline token and no need to decode se…

e673206

…nding orca

fix route

841f982

dd user id to tests

6864af3

moranbental requested review from TomerShor and rokatyy August 13, 2025 06:19

quaark requested changes Aug 13, 2025

View reviewed changes

quaark approved these changes Aug 13, 2025

View reviewed changes

moranbental merged commit 1a5a3d4 into mlrun:feature/ig4-authentication Aug 13, 2025
13 checks passed

moranbental deleted the secret-token branch August 13, 2025 07:10

moranbental mentioned this pull request Oct 16, 2025

[Authentication] Allow authentication against IG4 #8724

Merged

6 tasks

		# TODO: Implement this method once it is available in the Iguazio package
		pass

[User secrets] Create API Endpoint to Store or Update Secret Tokens [feature/ig4-authentication] #8408

[User secrets] Create API Endpoint to Store or Update Secret Tokens [feature/ig4-authentication] #8408

Uh oh!

Conversation

moranbental commented Aug 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

quaark left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

quaark left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

moranbental Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

moranbental commented Aug 3, 2025 •

edited

Loading

moranbental Aug 13, 2025 •

edited

Loading