flyteorg / flyteorg/flyte

[Docs] EntraID setup for flyte-binary

Open
#6,549 2 comments 0 reactions 0 assignees View on GitHub
documentation untriaged
Dominant language
Go
Stars
7.5k
Forks
886
Avg merge
1d 12h
Merged PRs (30d)
120

Description

### Description

Hi,

I have invested the last 3 full working days to set up Microsoft Entra ID for authentication and authorization. Unfortunately, it has been a very painful process full of trial and error, there are many gotchas on the way hidden in the code and the official [documentation](https://www.union.ai/docs/flyte/deployment/flyte-configuration/configuring-authentication) has been of only a limited help and sometimes more confusing than helpful.

I want to share with the public the exact setup so that others may benefit from it. It would be terrific if this eventually gets into the documentation after some review.

### App registration on Entra ID
Unlike for Okta, which requires 3 independent app registrations, there is only one necessary for Entra ID.

You need to know:
* ``, with TLS ingress enabled (self-signed certificate is enough).

Perform these steps:
* Register a new App, it can be called as you wish.
* In "Authentication", make sure that the redirect URL is `https:///callback` for Platform type Web and `http://localhost:53593/callback` for Platform type Mobile and desktop applications. In Settings tab, activate "Allow public client flows".
* In "Certificates & secrets", generate a secret.
* In "Token configuration", add "email" optional claim for both ID and Access (though this is not probably necessary)
* In "API permissions", add "email", "offline_access", "openid", "profile", "User.Read"
* In "Expose as API", define Application ID URI as `api://` and add a new scope `api:///all` (Admins-only consent). Authorize `` for this scope.

In the end, you'll get these following things out of it:
* `` ("Directory (tenant) ID")
* `` ("Application (client) ID")
* ``

In addition, you need to get via
`python -c 'import bcrypt; import base64; print(base64.b64encode(bcrypt.hashpw("".encode("utf-8"), bcrypt.gensalt(6))))'`

### Deployment configuration (values.yaml)
This comes close to https://www.union.ai/docs/flyte/deployment/flyte-configuration/configuring-authentication/#flyte-core-with-entra-id but not quite exactly.

```
auth:
enabled: true
oidc:
baseUrl: "https://login.microsoftonline.com//v2.0"
clientId:
clientSecret:
internal:
clientId:
clientSecret:
clientSecretHash:
authorizedUris:
-
inline:
auth:
appAuth:
authServerType: External
externalAuthServer:
baseUrl: "https://login.microsoftonline.com//v2.0"
metadataUrl: .well-known/openid-configuration
AllowedAudience:
- api://
thirdPartyConfig:
flyteClient:
clientId:
audience: api://
redirectUri: http://localhost:53593/callback
scopes:
- api:///.default
userAuth:
openId:
baseUrl: "https://login.microsoftonline.com//v2.0"
scopes:
- profile
- openid
- offline_access
clientId:
```

### Are you sure this issue hasn't been raised already?

- [x] Yes

### Have you read the Code of Conduct?

- [x] Yes

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.