@ancient-wolf-19325 how do I setup device code authentication to use with

pyflyte

. I have setup the OIDC authentication on flyte admin

To set up device code authentication for use with

pyflyte

, configure your Flyte client to use the DeviceFlow auth type. Add the following to your

~/.flyte/config.yaml

(or

~/.flyte/demo-config.yaml

):

admin:
  endpoint: dns:///<your-flyte-endpoint>
  authType: DeviceFlow

After this, when you run a remote command such as

pyflyte run --remote ...

, you will be prompted to authenticate by visiting a URL and entering a code in your browser. This enables headless authentication for environments without a browser. For more details, see the example and explanation in the Flyte 1.5 release blog and related documentation. DeviceFlow is supported for OIDC-enabled FlyteAdmin deployments and is triggered automatically by the config above. According to the available sources, no additional steps are required beyond the config change and having OIDC set up on FlyteAdmin. Would you like a step-by-step breakdown or troubleshooting tips? Sources: - Flyte 1.5 streaming support, pod templates, partial tasks, and more 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 when I use your suggestion, I get this error:

MissingSchema: Invalid URL '': No scheme supplied. Perhaps you meant https://?

The error

MissingSchema: Invalid URL '': No scheme supplied.

indicates that the

endpoint

field in your config is either missing or empty. The

endpoint

must be set to your FlyteAdmin gRPC endpoint, for example:

dns:///my-org.my-company.com

or

dns:///localhost:30081

. Make sure your

config.yaml

includes a valid

endpoint

value under the

admin

section as shown in the official documentation. Would you like more detail on how to determine the correct endpoint for your deployment? Sources: - Using the configuration file 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 I have a valid

endpoint

under the

admin

section the my

config.yaml

file. What else could be wrong?

If you have a valid

endpoint

in your

config.yaml

but still see

MissingSchema: Invalid URL ''

, it may be due to a missing or misconfigured

authType

, or other required fields for authentication. Ensure that

authType

is set (e.g.,

DeviceFlow

), and that all required OIDC parameters (such as

clientId

, and possibly

clientSecretLocation

or

clientSecretEnvVar

if using confidential clients) are present and correct, as described in the Flyte configuration documentation. If these are set and the error persists, double-check for typos, indentation issues, or missing values in your YAML file. Also, ensure that the Flyte version you are using supports the

DeviceFlow

authentication method. Would you like a checklist or example config for troubleshooting? Sources: - Flyte configuration documentation 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 what versions of flyte support device code authentication? I'm using v1.16

It seems likely that device code authentication (DeviceFlow) is supported in Flyte v1.16, as this feature was introduced in Flyte 1.5 and highlighted in the Flyte 1.5 release blog. There is no indication in the available sources that this support was removed or changed in v1.16. Would you like more detail on how to verify your setup or check for compatibility issues? Sources: - Flyte 1.5 streaming support, pod templates, partial tasks, and more 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 I have correctly set

clientId

. Why is the error message asking to use an a scheme such as

https

and not

dns

?

The error message suggesting to use a scheme like

https

(instead of

dns

) typically means a URL field in your config or code is being interpreted as an HTTP endpoint, not a gRPC endpoint. In Flyte, the

endpoint

for gRPC should use the

dns:///

scheme, but if another field (such as OIDC

baseUrl

or

redirectUri

) is empty or missing, Flyte or an underlying library may try to construct an HTTP request with an invalid or empty URL, triggering this error. This is not related to the

endpoint

field itself, but to another URL field that expects an HTTP(S) scheme, such as

baseUrl

for OIDC. Check that all required URL fields (especially

baseUrl

under

userAuth.openId

or

oidc.baseUrl

) are set to a valid

https://...

URL, as shown in the Flyte OIDC configuration examples. Would you like an example config highlighting these fields? Sources: - flyteadmin_config.yaml 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 show me an example of using redirectUri

An example of using

redirectUri

in Flyte authentication config is:

auth:
  appAuth:
    thirdPartyConfig:
      flyteClient:
        clientId: flytectl
        redirectUri: http://localhost:53593/callback
        scopes:
          - offline
          - all

The

redirectUri

should match the value registered with your OIDC provider and is typically set to

http://localhost:53593/callback

for local development, as shown in the Flyte Helm values.yaml. Would you like more details or a full configuration example? Sources: - Flyte Helm values.yaml 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 What should that value be if a use an okta idp provider?

For Okta as your IdP, the

redirectUri

should be set to

http://localhost:53593/callback

for local tools like

flytectl

or

pyflyte

, and this exact URI must also be registered as a valid redirect URI in your Okta application's settings. This is confirmed in the flyteadmin_config.yaml example. Would you like a step-by-step guide for Okta application setup? Sources: - flyteadmin_config.yaml example 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 the device_code_endpoint url returned by flyteadmin to flytekit is empty, thus causing the error. What could be wrong in the flyteadmin config?

It seems likely that the device code endpoint is empty because the OIDC provider configuration in your FlyteAdmin config is missing or incomplete—specifically, the

baseUrl

under

userAuth.openId

(or

auth.oidc.baseUrl

) may not be set, or is set incorrectly. FlyteAdmin uses this

baseUrl

to discover OIDC endpoints (including the device code endpoint) via the provider’s

.well-known/openid-configuration

URL. If

baseUrl

is missing or invalid, FlyteAdmin cannot populate the device code endpoint, resulting in an empty value sent to clients like flytekit. See the flyteadmin_config.yaml example for the correct structure. Would you like a sample config or troubleshooting steps for your OIDC section? Sources: - flyteadmin_config.yaml example 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 device code flow is only supported with an external authorization server

Yes, device code flow is only supported when Flyte is configured to use an external authorization server (such as Okta, Keycloak, or Azure AD) and not with FlyteAdmin’s internal/self-hosted auth server. This is confirmed in the Flyte community discussions and configuration examples, where device code endpoints are only available via OIDC-compliant external providers (flyteadmin_config.yaml). Would you like more detail on how to configure Flyte with an external auth server for device code flow? Sources: - flyteadmin_config.yaml 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 I'm getting an invalid audience error when using DeviceFlow auth from pyflyte. How do I setup the audience correctly in flyte configuration?

To fix the invalid audience error with DeviceFlow auth, set the

audience

field in your Flyte configuration to match the audience expected by your OIDC provider. For Flyte, this is typically set under

auth.appAuth.externalAuthServer.allowedAudience

and/or

auth.appAuth.thirdPartyConfig.flyteClient.audience

in your Flyte deployment config (e.g., Helm values or server YAML). The audience value must exactly match what your IdP expects in the token’s

aud

claim (values.yaml example). Would you like a concrete YAML example or troubleshooting steps? Sources: - values.yaml example 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 what is the thirdPartyConfig used for?

The

thirdPartyConfig

section in Flyte's authentication configuration is used to specify settings for external OAuth2/OIDC clients, such as

flytectl

or

pyflyte

, that interact with FlyteAdmin. It defines parameters like

clientId

,

redirectUri

,

scopes

, and

audience

for these clients, ensuring they can authenticate via your external identity provider as shown in flyteadmin/auth/config/third_party_config.go. Would you like more detail or an example configuration? Sources: - flyteadmin/auth/config/third_party_config.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 give me more detail

Certainly! The

thirdPartyConfig

section in Flyte's authentication configuration is specifically designed to provide the necessary OAuth2/OIDC client settings for third-party tools that interact with FlyteAdmin, such as

flytectl

,

pyflyte

, or other custom clients. This section is nested under

auth.appAuth

and is typically called

thirdPartyConfig.flyteClient

. Its purpose is to ensure that these clients have the correct credentials and parameters to perform OAuth2 authentication against your configured identity provider (IdP). The fields you can set in

thirdPartyConfig.flyteClient

include: - `clientId`: The public identifier for the client application (e.g.,

flytectl

). - `redirectUri`: The callback URI registered with your IdP for the client (commonly

http://localhost:53593/callback

for local tools). - `scopes`: The list of OAuth2 scopes the client should request (e.g.,

["all", "offline"]

). - `audience`: The audience value to use when initiating OAuth2 authorization requests, which must match what your IdP expects. When a user runs a command with

flytectl

or

pyflyte

, these tools use the values from

thirdPartyConfig

to initiate the OAuth2 flow, obtain tokens, and authenticate with FlyteAdmin. This configuration is critical for enabling secure, standards-compliant authentication for all external clients, and must be kept in sync with your IdP's registered application settings. For more, see the source code. Sources: - flyteadmin/auth/config/third_party_config.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 what is the meaning of the flyte client configuration value useAudienceFromAdmin?'

The

useAudienceFromAdmin

configuration value in the Flyte client determines whether the client should use the audience value provided by the FlyteAdmin server's public endpoint configuration, instead of a locally specified audience. If set to

true

, the client fetches and uses the audience from FlyteAdmin; if

false

, it uses the audience specified in the client's own config (flyteidl/clients/go/admin/config_flags.go). Would you like more detail or an example of how this affects authentication? Sources: - flyteidl/clients/go/admin/config_flags.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 what audience exactly is it going to use in this case?

If

useAudienceFromAdmin

is set to

true

, the Flyte client will use the audience value that is configured and exposed by the FlyteAdmin server’s public endpoint (i.e., the audience specified in FlyteAdmin’s OIDC or external auth server configuration, such as

auth.appAuth.externalAuthServer.allowedAudience

). This value is fetched dynamically from the server, rather than relying on a hardcoded or locally configured audience in the client (flyteidl/clients/go/admin/config_flags.go). Would you like more detail on how FlyteAdmin exposes this value or how to configure it? Sources: - flyteidl/clients/go/admin/config_flags.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.