Hi, I'm running Flyte on a single cluster deployment (GCP), using helm (https://flyteorg.github.io/flyte v1.3.0) and trying to set up auth using OpenId Connect. I've followed the instructions here: https://docs.flyte.org/en/v1.0.0/deployment/cluster_config/auth_setup.html#openid-connect and managed to set up user authentication with browser and flytectl (i.e. I'm able to log in and list projects). However I'm unable to start workflows; I see errors in

flytescheduler

and

flytepropeller

logs. Logs from

flytescheduler

:

flytescheduler-check panic: rpc error: code = Unauthenticated desc = transport: per-RPC creds failed due to error: oauth2: cannot fetch token: 401 Unauthorized                                           
flytescheduler-check Response: {"error":"invalid_client","error_description":"Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method)."}                                                                                                                                                                                                        │
flytescheduler-check                                                                                                                                                                                      
flytescheduler-check goroutine 1 [running]:                                                                                                                                                               
flytescheduler-check main.main()                                                                                                                                                                          
flytescheduler-check     /go/src/github.com/flyteorg/flyteadmin/cmd/scheduler/main.go:12 +0x85

My current setup is:

configmap:
  adminServer:
    auth:
      authorizedUris:
        - <internal domain>
        - <https://localhost:30081>
        - <http://flyteadmin:80>
        - <http://flyteadmin.flyte.svc.cluster.local:80>
      userAuth:
        openId:
          baseUrl: <https://accounts.google.com>
          clientId: <id>.<http://apps.googleusercontent.com|apps.googleusercontent.com>
          scopes:
            - profile
            - openid
    server:
      httpPort: 8088
      grpcPort: 8089
      security:
        secure: false
        useAuth: true
        allowCors: true
        allowedOrigins:
          # Accepting all domains for Sandbox installation
          - "*"
        allowedHeaders:
          - "Content-Type"

I've tried adding

appAuth

(same level as

userAuth

) but can't seem to figure out a proper configuration. Any help on what to do next would be much appreciated.

Take a look at this thread. My debugging process to get it to work 🙂 (I tagged you in the thread since when I click on this link, it doesn’t bring me to the thread even though the link was created with

Copy link

on the first message 🤔)

Thanks @Fabio Grätz! @Ena Škopelja Please let us know any further question you may have in this regard

Thanks @Fabio Grätz that's exactly what I needed!

@Fabio Grätz Could you tag me as well? I’m not able to click through to the thread

@Alex Papanicolaou that thread is lost on Slack due to the 90 days limit for non-pro accounts. But gladly is captured on discuss: https://discuss.flyte.org/t/3156427/Hey-everyone-slightly-smiling-face-I-m-currently-deploying-a

awesome. Thanks!

@Alex Papanicolaou thanks for confirming! any chance you could contribute your findings to #3363 to make it more accurate?

Sure!