https://flyte.org logo
Join Slack
Powered by
Has anyone successfully setup authentication via J...
# flyte-support
b
Has anyone successfully setup authentication via Jumpcloud for Flyte Console, Control, and Propeller? I recall this was mentioned a few months ago but the messages were older than 90 days so they are gone. If anyone has been able to set it up do you have any tips or instructions you could share? We're running into issues on configuring an authorization server. The step after #25. See here:https://github.com/davidmirror-ops/flyte-the-hard-way/blob/main/docs/aws/10-prepare-for-auth.md
a
@bumpy-ghost-16726 do you plan to use the External auth server or the one that runs with flyteadmin would suffice?
b
@cuddly-energy-9218
c
@average-finland-92144 i work with Hal
runs with flyteadmin should be fine.
a
cool, so you won't need to complete the steps in that section
you'd just need to register a single app on Jumpcloud (not sure how that is done) and complete the steps in this section to let Flyte use an Identity token provided by Jumpcloud for flyteconsole, and the internal auth server for the rest of the components https://docs.flyte.org/en/latest/deployment/configuration/auth_setup.html#apply-oidc-configuration
c
is this look fine?
Copy code
auth:
      enabled: true 
      enableAuthServer: true 
      oidc:
        baseUrl: <https://oauth.id.jumpcloud.com/oauth2/auth> ##
        clientId: <clintid-from-jumpcloud>
        clientSecret: <client-secret-from-jump-cloud>
      internal:
        clientSecret: 'random-secret'
        clientSecretHash: <encrypted-random-secret>
      authorizedUris:
        - <https://rpeter-flyte-testing.mydomain.com>
is this looks fine?
a
it does
c
while i try to login, i get with that config. small fix current 
baseUrl: <https://oauth.id.jumpcloud.com/>
i was under the assumption i can use the 
Internal authorization server
a
you should, yes
anything interesting in the flyte-binary Pod logs?
c
while trying to login, no specific log message.
may be i should change the log level
a
yeah, I guess something should be logged eventually, especially due to that banner
c
what log level i should try?
a
6 is the max If I remember correctly
c
ok
Copy code
{"json":{"src":"cookie.go:77","x-request-id":"a-rc25h8hpvqf486p9dnfl"},"level":"info","msg":"Could not detect existing cookie [flyte_idt]. Error: http: named cookie not present","ts":"2024-06-17T22:41:00Z"}
{"json":{"src":"handlers.go:293"},"level":"debug","msg":"Running authentication gRPC interceptor","ts":"2024-06-17T22:41:00Z"}
{"json":{"src":"token.go:80"},"level":"debug","msg":"Could not retrieve bearer token from metadata rpc error: code = Unauthenticated desc = Request unauthenticated with Bearer","ts":"2024-06-17T22:41:00Z"}
{"json":{"src":"handlers.go:303"},"level":"info","msg":"Failed to parse Access Token from context. Will attempt to find IDToken. Error: [JWT_VERIFICATION_FAILED] Could not retrieve bearer token from metadata, caused by: rpc error: code = Unauthenticated desc = Request unauthenticated with Bearer","ts":"2024-06-17T22:41:00Z"}
{"json":{"src":"token.go:100"},"level":"debug","msg":"Could not retrieve id token from metadata rpc error: code = Unauthenticated desc = Request unauthenticated with IDToken","ts":"2024-06-17T22:41:00Z"}
{"json":{"src":"cookie.go:77","x-request-id":"a-492jw6h9vstdgvp4vmld"},"level":"info","msg":"Could not detect existing cookie [flyte_idt]. Error: http: named cookie not present","ts":"2024-06-17T22:41:00Z"}
{"json":{"src":"handlers.go:293"},"level":"debug","msg":"Running authentication gRPC interceptor","ts":"2024-06-17T22:41:00Z"}
{"json":{"src":"token.go:80"},"level":"debug","msg":"Could not retrieve bearer token from metadata rpc error: code = Unauthenticated desc = Request unauthenticated with Bearer","ts":"2024-06-17T22:41:00Z"}
{"json":{"src":"handlers.go:303"},"level":"info","msg":"Failed to parse Access Token from context. Will attempt to find IDToken. Error: [JWT_VERIFICATION_FAILED] Could not retrieve bearer token from metadata, caused by: rpc error: code = Unauthenticated desc = Request unauthenticated with Bearer","ts":"2024-06-17T22:41:00Z"}
{"json":{"src":"token.go:100"},"level":"debug","msg":"Could not retrieve id token from metadata rpc error: code = Unauthenticated desc = Request unauthenticated with IDToken","ts":"2024-06-17T22:41:00Z"}
👀 1
a
c
Copy code
{"json":{"src":"cookie.go:77"},"level":"info","msg":"Could not detect existing cookie [flyte_idt]. Error: http: named cookie not present","ts":"2024-06-17T22:41:02Z"}
{"json":{"src":"handlers.go:86"},"level":"error","msg":"Failed to retrieve tokens from request, redirecting to login handler. Error: [EMPTY_OAUTH_TOKEN] Failure to retrieve cookie [flyte_idt], caused by: http: named cookie not present","ts":"2024-06-17T22:41:02Z"}
{"json":{"src":"handlers.go:142"},"level":"debug","msg":"Setting CSRF state cookie to xyeml3mydp and state to 5dc357d8275ec96312712f02ce7979c4183b3b8b937b71e50977a454a172fae8\n","ts":"2024-06-17T22:41:02Z"}
{"json":{"src":"handler_utils.go:169"},"level":"debug","msg":"validating whether redirect url: <https://rpeter-flyte-testing.labs.domain.com/console/projects/flytesnacks/domains/development> is authorized","ts":"2024-06-17T22:41:02Z"}
{"json":{"src":"handler_utils.go:172"},"level":"debug","msg":"authorizing redirect url: <https://rpeter-flyte-testing.labs.domain.com/console/projects/flytesnacks/domains/development> against authorized uri: <https://rpeter-flyte-testing.labs.domain.com>","ts":"2024-06-17T22:41:02Z"}
a
how your anonymized config on JumpCloud look like? If we ever make this work, a docs PR would be great 🙂
👍 1
💯 1
c
You prefer a screenshot?
a
yeah, that works
c
Screenshot 2024-06-17 at 3.48.14 PM.png
@average-finland-92144 just making sure thats the info you looking for.
a
sorry for the delay can you try making the Login URL without appending the 
/console
? Not a Jumpcloud user here but considering the experience with other IdPs, and how that exactly is not the login page, maybe we can try
Hey @cuddly-energy-9218 did you manage to make this work?
c
Yes
a
great. any learning you could share here for others trying to use Jumpcloud? 🤓
c
Absolutely, i can send you my values file, if you prefer.
and i do not think its perfect, Jumpcloud just do the auth, authorization is not handled by Jumpcloud.
Happy to jump on a call with you or share what you looking. Keep in mind, I'm very very new to flyte. so keep a very low expectation 😄
LMK
a
yeah, I think we can have a chat, mainly to see both side of the configs (Jumpcloud and Flyte) Issue is that next week I'll be OOO so it had to be this week or later
c
Feel free to ping me. im online during PST hours.
42 Views
Open in Slack
PreviousNext
Powered by