[Docs] EntraID setup for flyte-binary
- Dominant language
- Go
- Stars
- 7.5k
- Forks
- 886
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 120
Description
### Description
Hi,
I have invested the last 3 full working days to set up Microsoft Entra ID for authentication and authorization. Unfortunately, it has been a very painful process full of trial and error, there are many gotchas on the way hidden in the code and the official [documentation](https://www.union.ai/docs/flyte/deployment/flyte-configuration/configuring-authentication) has been of only a limited help and sometimes more confusing than helpful.
I want to share with the public the exact setup so that others may benefit from it. It would be terrific if this eventually gets into the documentation after some review.
### App registration on Entra ID
Unlike for Okta, which requires 3 independent app registrations, there is only one necessary for Entra ID.
You need to know:
* ``, with TLS ingress enabled (self-signed certificate is enough).
Perform these steps:
* Register a new App, it can be called as you wish.
* In "Authentication", make sure that the redirect URL is `https:///callback` for Platform type Web and `http://localhost:53593/callback` for Platform type Mobile and desktop applications. In Settings tab, activate "Allow public client flows".
* In "Certificates & secrets", generate a secret.
* In "Token configuration", add "email" optional claim for both ID and Access (though this is not probably necessary)
* In "API permissions", add "email", "offline_access", "openid", "profile", "User.Read"
* In "Expose as API", define Application ID URI as `api://` and add a new scope `api:///all` (Admins-only consent). Authorize `` for this scope.
In the end, you'll get these following things out of it:
* `` ("Directory (tenant) ID")
* `` ("Application (client) ID")
* ``
In addition, you need to get via
`python -c 'import bcrypt; import base64; print(base64.b64encode(bcrypt.hashpw("".encode("utf-8"), bcrypt.gensalt(6))))'`
### Deployment configuration (values.yaml)
This comes close to https://www.union.ai/docs/flyte/deployment/flyte-configuration/configuring-authentication/#flyte-core-with-entra-id but not quite exactly.
```
auth:
enabled: true
oidc:
baseUrl: "https://login.microsoftonline.com//v2.0"
clientId:
clientSecret:
internal:
clientId:
clientSecret:
clientSecretHash:
authorizedUris:
-
inline:
auth:
appAuth:
authServerType: External
externalAuthServer:
baseUrl: "https://login.microsoftonline.com//v2.0"
metadataUrl: .well-known/openid-configuration
AllowedAudience:
- api://
thirdPartyConfig:
flyteClient:
clientId:
audience: api://
redirectUri: http://localhost:53593/callback
scopes:
- api:///.default
userAuth:
openId:
baseUrl: "https://login.microsoftonline.com//v2.0"
scopes:
- profile
- openid
- offline_access
clientId:
```
### Are you sure this issue hasn't been raised already?
- [x] Yes
### Have you read the Code of Conduct?
- [x] Yes
Contributor guide
Assessment
This issue has not been assessed yet.