After implementing authentication without custom authorization, using the internal authorization mechanism. The login seems to work but projects and workflows have disappeared. The only error I see in the Flyte logs is

"Could not detect existing cookie [flyte_rt]. Error: http: named cookie not present"

this is what the ingress protion of the chart looks like

ingressClassName = "nginx"

      commonAnnotations = {
        "<http://ingress.kubernetes.io/rewrite-target|ingress.kubernetes.io/rewrite-target>"     = "/"
        "<http://nginx.ingress.kubernetes.io/ssl-redirect|nginx.ingress.kubernetes.io/ssl-redirect>" = "true"
      }
      httpAnnotations = {
        "<http://nginx.ingress.kubernetes.io/proxy-buffer-size|nginx.ingress.kubernetes.io/proxy-buffer-size>" = "10k"
        "<http://nginx.ingress.kubernetes.io/app-root|nginx.ingress.kubernetes.io/app-root>"          = "/console"
      }
      grpcAnnotations = {
        "<http://nginx.ingress.kubernetes.io/backend-protocol|nginx.ingress.kubernetes.io/backend-protocol>" = "GRPC"
      }

Also, is there more in-depth documentation on how the Flyte internal authorization works?

@boundless-lifeguard-61788 what IdP are you using?

projects and workflows have disappeared.

This is, from the console or even from the DB?

is there more in-depth documentation on how the Flyte internal authorization wor

This page is intended to do so, and includes mermaid diagrams to explain better, but they are not rendering and fix is still in progress

1. Okta 2. The projects exist in the database, they do not appear in the console. 3. There is no document on that page ?

1. Could you verify that the redirect_uri you setup in Okta an your Ingress/callback host match? 3. There is but the diagrams are not rendering, and that's like the whole point of that page

1. yes I did not set up a redirect_uri in okta as we are not using the custom authorization server

for #1 I mean the signing redirect URI that you should configure in Okta, even if using it only for OIDC, as described here: https://docs.flyte.org/en/latest/deployment/configuration/auth_setup.html#identity-management-layer-oidc

I see. Yes I believe so. Lets say our ingress is

https::<//mycompany.net>

okta : oauth_redirect_uris =

https::<//mycompany.net/callback>

fqnd in chart:

https::<//mycompany.net>

Right, well, without the double

:

oops yes, only one :

hey @boundless-lifeguard-61788 for the diagrams, we're pushing the fix today: https://github.com/flyteorg/flyte/pull/5467

it turned out to be not related to the auth

Uh, what was it?

proxies 😅