feast-dev / feast-dev/feast

Support LDAP authentication in Feast UI

Open
#6,694 0 comments 0 reactions 0 assignees View on GitHub
kind/feature
Dominant language
Python
Stars
7.3k
Forks
1.4k
Avg merge
3d 16h
Merged PRs (30d)
15

Description

**Is your feature request related to a problem? Please describe.**
Feast UI has no built-in authentication. In enterprise deployments, this leaves feature store metadata, feature views, and data sources exposed to anyone with network access, with no way to integrate with existing LDAP / Active Directory identity systems.

**Describe the solution you'd like**
Optional LDAP authentication for Feast UI, configurable in `feature_store.yaml` or via environment variables, so existing deployments are unaffected:

- Configurable LDAP server URI (`ldap://` / `ldaps://`), `base_dn`, `bind_dn`, `bind_password`.
- Support both anonymous and authenticated (manager) bind.
- Configurable user search filter (e.g. `(uid={})`, `(sAMAccountName={})`) for OpenLDAP and AD compatibility.
- Backend validates credentials against LDAP and issues a session cookie; frontend redirects unauthenticated users to a login page.
- Optional: LDAP group-based RBAC and TLS / STARTTLS.

**Describe alternatives you've considered**
1. Reverse proxy (nginx / Apache) with LDAP auth — pushes auth outside Feast and complicates fine-grained authorization.
2. OAuth2 / OIDC SSO — more modern, but many enterprises still rely on LDAP / AD without an OIDC provider.
3. Service mesh / API gateway — overkill for smaller deployments.

**Additional context**
- LDAP / AD remains the de-facto identity standard in enterprises.
- Comparable tools (Superset, Airflow, Grafana) ship built-in LDAP auth; Feast users expect the same.
- Happy to help validate against OpenLDAP and Active Directory instances.

Contributor guide

Open the contributing guide

Research direction

Start by locating the Feast UI backend and frontend entry points, then inspect how feature_store.yaml and environment variables are currently handled. Define the initial LDAP scope, including server and bind settings, user search, credential validation, sessions, and login redirects; done means optional authentication works without affecting existing deployments and the requested OpenLDAP and Active Directory cases are validated.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend, frontend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.