mlflow-oidc-auth

OpenID Connect (OIDC) authentication and authorization plugin for MLflow.

This plugin allows you to use OIDC for user management in MLflow, enabling single sign-on (SSO) capabilities and centralized user management.

Disclaimer

This project is not affiliated with, endorsed by, or sponsored by the MLflow Project, Databricks, the Linux Foundation, or LF Projects, LLC. MLflow and related marks are trademarks of their respective owners. Maintained by Kharkevich Engineering Lab.

Features

OIDC-based authentication for MLflow UI and API
User management through OIDC provider
User-level access control
Group-based access control
Permissions management based on regular expressions (allows or denies access to specific MLflow resources based on regular expressions and assigns permissions to users or groups)
Support for session, JWT, and basic authentication methods
Compatible with mlflow-client (basic auth)

Documentation

For detailed documentation, please refer to the docs. AI generated documentation is available at DeepWiki.

Quick Start

To get the full version (with entire MLflow and all dependencies), run:

python3 -m venv venv
source venv/bin/activate
python3 -m pip install mlflow-oidc-auth[full]
mlflow server --app-name oidc-auth --host 0.0.0.0 --port 8080

Webhook secret encryption key 🔐

Webhook secrets are stored encrypted in the database using a Fernet key. If you plan to use MLflow webhooks with secrets, set the encryption key in the environment variable MLFLOW_WEBHOOK_SECRET_ENCRYPTION_KEY before creating any webhooks. Generate a key with:

MLFLOW_WEBHOOK_SECRET_ENCRYPTION_KEY=$(python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")
export MLFLOW_WEBHOOK_SECRET_ENCRYPTION_KEY

Important: keep this key stable across application restarts and replicas. If the key is lost or changed after webhooks are created, previously stored secrets cannot be decrypted and will cause webhook listing to fail until you restore the original key or remove/rotate the affected webhook secrets.

Development

For development quick start, please refer to the Development and Contribution section. Contribution guidelines are available in CONTRIBUTING.md.

License

Apache 2 Licensed. For more information, please see LICENSE.

Based on MLflow basic-auth plugin

https://github.com/mlflow/mlflow/tree/master/mlflow/server/auth

Release files for mlflow-oidc-auth 7.18.3

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for mlflow-oidc-auth 7.18.3
File	Size	Uploaded
mlflow_oidc_auth-7.18.3.tar.gz	932.2 kB	Sep 22, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for mlflow-oidc-auth 7.18.3
File	Interpreter	ABI	Platform	Reset
mlflow_oidc_auth-7.18.3-py3-none-any.whl 1.2 MB Sep 22, 2026	Python 3	none	any	Details

Total release size: 2.1 MB

Release files / mlflow_oidc_auth-7.18.3.tar.gz

Download URL	mlflow_oidc_auth-7.18.3.tar.gz
Size	932.2 kB
Tags	Source
SHA-256 checksum How to use checksums	`ea2bdb25af5a9e54d1e1542064d194bbc141390d113d0a3aba2e10bf1c794f9b`
BLAKE2b-256 checksum How to use checksums	`ed88040e6a5610b5ebcea9888130e38f0f66fbee8acc6920560842157d53907f`
Upload date	Sep 22, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/mlflow-oidc/mlflow-oidc-auth
Publishing commit: github.com/mlflow-oidc/mlflow-oidc-auth/tree/770e5d10fdb09aee4e95e625dd8045bc5087fb13

Workflow

Publishing configuration: github.com/mlflow-oidc/mlflow-oidc-auth/blob/770e5d10fdb09aee4e95e625dd8045bc5087fb13/.github/workflows/pypi.yml
Publishing logs: github.com/mlflow-oidc/mlflow-oidc-auth/actions/runs/35744161941/attempts/1

Artifact

Subject: mlflow_oidc_auth-7.18.3.tar.gz
SHA-256 checksum: ea2bdb25af5a9e54d1e1542064d194bbc141390d113d0a3aba2e10bf1c794f9b Verifying attestations

Release files / mlflow_oidc_auth-7.18.3-py3-none-any.whl

Download URL	mlflow_oidc_auth-7.18.3-py3-none-any.whl
Size	1.2 MB
Tags	Python 3
SHA-256 checksum How to use checksums	`9fcf8da992fc31d45cf4adb9ccbca42ce0b78d6e6bb8b255723b7794d4972de4`
BLAKE2b-256 checksum How to use checksums	`14be967392d78281b4ea4cd3c5a838627a33c60e3cb1cd4f389b25bf53783870`
Upload date	Sep 22, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/mlflow-oidc/mlflow-oidc-auth
Publishing commit: github.com/mlflow-oidc/mlflow-oidc-auth/tree/770e5d10fdb09aee4e95e625dd8045bc5087fb13

Workflow

Publishing configuration: github.com/mlflow-oidc/mlflow-oidc-auth/blob/770e5d10fdb09aee4e95e625dd8045bc5087fb13/.github/workflows/pypi.yml
Publishing logs: github.com/mlflow-oidc/mlflow-oidc-auth/actions/runs/35744161941/attempts/1

Artifact

Subject: mlflow_oidc_auth-7.18.3-py3-none-any.whl
SHA-256 checksum: 9fcf8da992fc31d45cf4adb9ccbca42ce0b78d6e6bb8b255723b7794d4972de4 Verifying attestations