Support LDAP authentication in Feast UI
- Dominant language
- Python
- Stars
- 7.3k
- Forks
- 1.4k
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 15
Description
**Is your feature request related to a problem? Please describe.**
Feast UI has no built-in authentication. In enterprise deployments, this leaves feature store metadata, feature views, and data sources exposed to anyone with network access, with no way to integrate with existing LDAP / Active Directory identity systems.
**Describe the solution you'd like**
Optional LDAP authentication for Feast UI, configurable in `feature_store.yaml` or via environment variables, so existing deployments are unaffected:
- Configurable LDAP server URI (`ldap://` / `ldaps://`), `base_dn`, `bind_dn`, `bind_password`.
- Support both anonymous and authenticated (manager) bind.
- Configurable user search filter (e.g. `(uid={})`, `(sAMAccountName={})`) for OpenLDAP and AD compatibility.
- Backend validates credentials against LDAP and issues a session cookie; frontend redirects unauthenticated users to a login page.
- Optional: LDAP group-based RBAC and TLS / STARTTLS.
**Describe alternatives you've considered**
1. Reverse proxy (nginx / Apache) with LDAP auth — pushes auth outside Feast and complicates fine-grained authorization.
2. OAuth2 / OIDC SSO — more modern, but many enterprises still rely on LDAP / AD without an OIDC provider.
3. Service mesh / API gateway — overkill for smaller deployments.
**Additional context**
- LDAP / AD remains the de-facto identity standard in enterprises.
- Comparable tools (Superset, Airflow, Grafana) ship built-in LDAP auth; Feast users expect the same.
- Happy to help validate against OpenLDAP and Active Directory instances.
Contributor guide
Research direction
Start by locating the Feast UI backend and frontend entry points, then inspect how feature_store.yaml and environment variables are currently handled. Define the initial LDAP scope, including server and bind settings, user search, credential validation, sessions, and login redirects; done means optional authentication works without affecting existing deployments and the requested OpenLDAP and Active Directory cases are validated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend, frontend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100