Hello I am trying to configure auth across azure AD I added

Question

Hello I am trying to configure auth across azure AD I added the following as configuration ``` auth enabled true oidc baseUrl clientId CLIENT ID clientSecret CLIENT SECRET scopes openid email profile internal clientSecret CLIENT SECRET clientSecretHash CLIENT SECRET HASHED flyteClient clientId CLIENT ID redirectUri scopes all authorizedUris ``` When trying to login I can walk through azure login step but then receive a 403 from After an increase of the log level I can see the following ``` json src handlers go 238 level debug msg Running authentication gRPC interceptor ts 2023 06 27T14 31 08Z json src token go 83 level debug msg Could not retrieve bearer token from metadata rpc error code = Unauthenticated desc = Request unauthenticated with Bearer ts 2023 06 27T14 31 08Z json src handlers go 248 level info msg Failed to parse Access Token from context Will attempt to find IDToken Error JWT VERIFICATION FAILED Could not retrieve bearer token from metadata caused by rpc error code = Unauthenticated desc = Request unauthenticated with Bearer ts 2023 06 27T14 31 08Z json src token go 103 level debug msg Could not retrieve id token from metadata rpc error code = Unauthenticated desc = Request unauthenticated with IDToken ts 2023 06 27T14 31 08Z json src cookie go 79 level info msg Could not detect existing cookie flyte idt Error http named cookie not present ts 2023 06 27T14 31 08Z json src handlers go 65 level error msg Failed to retrieve tokens from request redirecting to login handler Error EMPTY OAUTH TOKEN Failure to retrieve cookie flyte idt caused by http named cookie not present ts 2023 06 27T14 31 08Z json src handlers go 121 level debug msg Setting CSRF state cookie to tb9f2xhb2y and state to 2419390fb3ddca455183ba94811c3c6a3a9d988b99536691fde913716e22cd65 n ts 2023 06 27T14 31 08Z json src composite workqueue go 88 level debug msg Subqueue handler batch round ts 2023 06 27T14 31 08Z json src composite workqueue go 98 level debug msg Dynamically configured batch size 1 ts 2023 06 27T14 31 08Z json src composite workqueue go 129 level debug msg Exiting SubQueue handler batch round ts 2023 06 27T14 31 08Z json src handlers go 141 level debug msg Running callback handler for RequestURI callback code=XXXXXX``` I am behind an azure application gateway as ingress and as far as I know appgw does not support gRPC can it be the issue Or should I look somewhere else

David Espejo (he/him) · Answer

so you re using Azure AD only for OIDC Also yes I ve seen similar errors in the past in other environments where the Ingress controller didn t support gRPC

Samhita Alla · Answer

I also recommend you to take a look at <https discuss flyte org t 2197578 opened pr 2746 97daa7fe 3d17 4600 b341 64314ea89e89> thread

laborde joris · Answer

Thanks < David Espejo he him > did you manage to fix your issue or did you change ingress controller

laborde joris · Answer

Thanks < Samhita Alla> gonna look at it +1

laborde joris · Answer

< Samhita Alla> This threads did not helped me so much my oidc client secret seems the right one After deeper investigation I found the following logs under pod logs ``` json src cookie manager go 146 level error msg Error generating encrypted accesstoken cookie SECURE COOKIE ERROR Error creating secure cookie caused by securecookie the value is too long ts 2023 06 28T10 46 10Z json src handlers go 162 level error msg Error setting encrypted JWT cookie SECURE COOKIE ERROR Error creating secure cookie caused by securecookie the value is too long ts 2023 06 28T10 46 10Z ``` Any idea why

Samhita Alla · Answer

< laborde joris> looks like an issue has been created already Could you please upvote it < David Espejo he him > is it possible for you to discuss this issue in the contributors meeting Looks like many of our users are encountering it

David Espejo (he/him) · Answer

< laborde joris> in that case they changed the ingress from nginx to ALB So from your config I understand you re using Azure AD only for OIDC and using the internal auth server with the `flyte core` chart Is that the case

laborde joris · Answer

< David Espejo he him > In fact I am also using azure application gateway as ingress and I am not sure that I am allowed to change that cry I am using the flyte binary chart

David Espejo (he/him) · Answer

ok I lm trying to repro and will let you know

Alexander Sarson · Answer

Hi < David Espejo he him > do you think this problem will be fixed within a few weeks