#3661 [BUG] Flytekit/Pyflyte not configured to handle Auth0 ClientCredentials Flow/Audience Parameter Issue created by PudgyPigeon Related issues #3660 #3659 Describe the bug Pyflyte/Flytekit does not pass in the appropriate

audience

parameter for the ClientSecret/ClientCredentials authorization flow w/ Auth0. The

ClientConfig

,

PlatformConfig

,

ClientCredentialsAuthenticator

classes, the

get_authenticator

function, and the

token_client.get_token

method are not currently configured to accept and pass around the required parameter, and the final get_token method never receives it as an input arg, nor does it pass it into the POST request when requesting a token. This results in a failed auth request as Auth0 requires an audience parameter in the body of the request. Expected behavior Allow the end-user to set the "audience" parameter either in

<flyteconsoleurl>/config/v1/flyte_client

or the

config.yaml

file, and have the pyflyte/flytekit package use this in its auth request for Auth0 integration. Will link fork with changes soon Additional context to reproduce Use an Auth0 external authorization server and attempt to run a

pyflyte run

command with the following config values:

###004-auth.yaml configmap
data: |
  auth:
    userAuth:
      openId:
        clientId: AUTH0_CLIENT_ID
        baseUrl: AUTH0_BASE_URL
        scopes:
          - profile
          - openid
          - offline_access
    appAuth:  
      authServerType: External
      externalAuthServer:
        baseUrl: AUTH0_BASE_URL
        metadataUrl: .well-known/openid-configuration
        allowedAudience: AUTH0_AUDIENCE
      thirdPartyConfig:
        flyteClient:
          clientId: AUTH0_CLIENT_ID
          redirectUri: <http://localhost:53593/callback>
          audience: AUTH0_AUDIENCE
          scopes:
            - read:client_grants
    authorizedUris:
      - uris
  server: 
    security:
      secure: false
      useAuth: true

config.yaml
admin:
  # For GRPC Endpoints you might want to use dns:///flyte.example.com
  #endpoint: dns:///localhost:8089
  endpoint: dns:///<endpointhere>
  authType: ClientSecret
  clientId: <>
  clientSecretLocation: <>
  scopes: 
  - read:client_grants
  #- offline    --------------------- set offline and all if desired, but not strictly necessary
  #- all
  audience: <> --------------------- deriving it from here is nice, but not strictly necessary as config/v1/flyte_client exists

Screenshots No response Are you sure this issue hasn't been raised already? ☑︎ Yes Have you read the Code of Conduct? ☑︎ Yes flyteorg/flyte