Setting up Auth for Flyte

[SandraGH5]

We're having trouble setting up auth for flyte. We're using Google SSO. We managed to get FlyteConsole browser login to work with Google but are struggling to get it to work for flytectl for both clients and in our CI pipelines.
We have tried the following appAuth config variants with respectively different problems:

Variant 1 (As in this video from the docs):

  appAuth:
    thirdPartyConfig:
      flyteClient:
        clientId: flytectl
        redirectUri: https://localhost:53593/callback
        scopes:
          - offline
          - all

Result:
Running flytectl opens the browser at https://our.great.domain.com/oauth2/authorize?client_id=flytectl&redirect_uri=http[…]Bfs8xq6Xp0bD1Nb6NWCdnQwsfsY&code_challenge_method=S256
and shows:

{"error":"invalid_request","error_description":"The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. The 'redirect_uri' parameter does not match any of the OAuth 2.0 Client's pre-registered redirect urls."}

This led us on the track of trying with an external auth server so Variant 2

Variant 2 (added external auth server):

  appAuth:
    thirdPartyConfig:
      flyteClient:
        clientId: flytectl
        redirectUri: https://localhost:53593/callback
        scopes:
          - offline
          - all
    authServerType: External
    externalAuthServer:
      baseUrl: https://accounts.google.com
      metadataUrl: .well-known/openid-configuration

Result:
Running flytectl opens google accounts signing in browser with

Error 401: invalid_client
The OAuth client was not found.

This led us to believe that clientId: flytectl was a problem and we changed it to our google ClientID and to Variant 3.

Variant 3 (A desperate hack):

  appAuth:
    thirdPartyConfig:
      flyteClient:
        clientId: 123456789-foobar.apps.googleusercontent.com
        redirectUri: https://localhost:53593/callback
        scopes:
          - profile # These scopes are allowed for Google, "offline" and "all" are not
          - openid
    authServerType: External
    externalAuthServer:
      baseUrl: https://accounts.google.com
      metadataUrl: .well-known/openid-configuration # Gotta set this or it defaults to ".well-known/oauth-authorization-
      server" which results in 404 with google

Result:
Running flytectl opens a browser window with Google login. After login the browser is redirected to https://localhost:53593/callback?... which for obvious reasons doesn't work.
The obvious culprit is the redirectUri: https://localhost:53593/callback up there. But before starting to deviate any further from the docs I thought it might be good to ask here.

@bimtauer

[SandraGH5]

It should be Variant 1, as Variant 2 implies that you can create applications on google auth, which I don’t believe it does.

The only change needed is http://lo… instead of https://lo… for the redirect_uri.

@wild-endeavor
@EngHabu

[SandraGH5]

Thanks everyone for the explanations. You were right, with http://lo... it worked with the internal auth server at least for a human client with a browser.

Also for completeness sake, the entire url params from Variant 1 (copy paste from browser shortens those for me):

client_id=flytectl&redirect_uri=https%3A%2F%2Flocalhost%3A53593%2Fcallback&response_type=code&scope=offline+all&state
=amg1bHA2aDZna2hsaHd0aGRsNGNsNnZsdGJkOWpkeDQ&nonce=dzRwem53eG1ycno5aDJtODQ1NGJneDhoYjhqZGp3c20&
code_challenge=CqAR0emATFrdAJTPn7ZRUUO7lMl8s1b6J5c28OqNIsA&code_challenge_method=S256

@bimtauer

[SandraGH5]

What we're still struggling with now is the client credentials for machine users.
How does one obtain this from the internal auth server?

@bimtauer

[SandraGH5]

#1895

#1895 Update auth_setup.rst
Update draft based on discussion on Flyte Slack where changing to "http://localhost..." was suggested as a fix. It works for us. Unsure if the comment on using https in case of secure: true is correct.
Added unfinished explanation for obtaining to ClientSecret, since this is what we're looking for. We tried both internal auth server and external (Google). In the latter case obtaining the ClientSecret was obvious however Google does not support the grant_type=client_credentials. It would be good to know if the ClientSecret flow is at all possible with the internal auth server and which external providers actually support it.

@EngHabu