[FR] Authentication without environment variables

ShootingStarD commented 3 months ago

Willingness to contribute

No. I cannot contribute this feature at this time.

Proposal Summary

I want to authenticate to mlflow without having to use environment variables.

Motivation

I want to make an mlflow server where some users can create/modify experiments and run. On the documentation, it is said that we can identify using UI, Environment variable, config file and request. I do not want to use envrionment variable or config file and prefer to do authentication dynamically.

Details

I tried using the following code to authenticate.

mlflow server --app-name basic-auth

import requests
from mlflow.server import get_app_client

response = requests.get(
    "http://127.0.0.1:5000/",
    auth=("admin", "password"),
)

tracking_uri = "http://127.0.0.1:5000"

auth_client = get_app_client("basic-auth", tracking_uri=tracking_uri)
auth_client.create_user(username="user3", password="pw1")

But the request response only give a response and does not automatically authenticate me on the app

With the environment variable, I can be authenticated, but for me there should be a python way to authenticate yourself in a client connection by providing username and password, without having to use environment variables

What component(s) does this bug affect?

[ ] area/artifacts: Artifact stores and artifact logging
[ ] area/build: Build and test infrastructure for MLflow
[ ] area/deployments: MLflow Deployments client APIs, server, and third-party Deployments integrations
[X] area/docs: MLflow documentation pages
[ ] area/examples: Example code
[ ] area/model-registry: Model Registry service, APIs, and the fluent client calls for Model Registry
[ ] area/models: MLmodel format, model serialization/deserialization, flavors
[ ] area/recipes: Recipes, Recipe APIs, Recipe configs, Recipe Templates
[ ] area/projects: MLproject format, project running backends
[ ] area/scoring: MLflow Model server, model deployment tools, Spark UDFs
[ ] area/server-infra: MLflow Tracking server backend
[X] area/tracking: Tracking Service, tracking client APIs, autologging

What interface(s) does this bug affect?

[ ] area/uiux: Front-end, user experience, plotting, JavaScript, JavaScript dev server
[ ] area/docker: Docker use across MLflow's components, such as MLflow Projects and MLflow Models
[ ] area/sqlalchemy: Use of SQLAlchemy in the Tracking Service or Model Registry
[ ] area/windows: Windows support

What language(s) does this bug affect?

[ ] language/r: R APIs and clients
[ ] language/java: Java APIs and clients
[ ] language/new: Proposals for new client languages

What integration(s) does this bug affect?

[ ] integrations/azure: Azure and Azure ML integrations
[ ] integrations/sagemaker: SageMaker integrations
[ ] integrations/databricks: Databricks integrations

daniellok-db commented 3 months ago

Instead of using get_app_client, would it work for you to use the REST APIs instead?

If including auth in every request is too cumbersome, it should be possible to use a Session instead:

s = requests.Session
s.auth = ("admin", "password")

response = s.post(
    "http://127.0.0.1:5000/api/2.0/mlflow/users/create",
    json={
        "username": "username",
        "password": "password",
    },
)

github-actions[bot] commented 2 months ago

@mlflow/mlflow-team Please assign a maintainer and start triaging this issue.

j-arpit commented 2 months ago

I have implemented Keycloak Auth for mlflow you can check this out

https://github.com/j-arpit/KeycloakPlugin

mlflow / mlflow