two questions: 1. how can I communicate user iden...
# flyte-support
c
two questions: 1. how can I communicate user identity to flyte when using the pyflyte CLI to run a workflow? we currently are directly connecting to flyte without authorization enabled within a private VPC. I want someway to pass the current user’s $USER into flyte and filter executions based on different user aliases 2. we currently use a reverse proxy for authentication when accessing flyte console outside of the VPC. how can I have my reverse proxy convey the current user identity to flyte? is there a way to pass a HTTP Header with this information?
w
c
we use a reverse proxy in front of flyte http that handles our internal authentication
w
If you follow the docs the above you shouldn’t need the reverse proxy anymore no?
c
we don't want traffic to hit flyte at all until it goes through our authentication proxy. we have a fairly bespoke setup at our company
I think we have something similar to what's described here: • https://github.com/flyteorg/flyte/issues/3965https://github.com/flyteorg/flytekit/pull/1787/
f
@curved-whale-1505 then you can supply a custom
--principal
but we prefer that the oauth2 layer goes to flyte
its hard for it to get all the identity information
c
is there a way in the UI to see the principal/user per execution in the table and filter on it? if not, would you be open to a contribution adding this?
f
yes
it is stored as a column
in union we show the principal in the ui ifyou see (we have a different ui - multi tenant etc) and you can filter by only my executions etc
c
hey @freezing-airport-6809, I'm having trouble finding this
--principal
flag - looks like it was supported in the old
flyte-cli
here but I can't find this flag in
pyflyte
is there a way I can handle the auth myself (in the reverse proxy) and just send flyte an http header that tells it the identify of the current user?
if you see execute has it, but currently enabled for
oauth2
automatic replacement. we used to work without auth. https://github.com/flyteorg/flytekit/blob/989eb678f1f119471c302ba71ea4cf71a263f977/flytekit/remote/remote.py#L1601 You can make this an option on the run command, or inject it using a reverse proxy