mlflow-oidc-auth
OpenID Connect (OIDC) authentication and authorization plugin for MLflow.
This plugin allows you to use OIDC for user management in MLflow, enabling single sign-on (SSO) capabilities and centralized user management.
Disclaimer
This project is not affiliated with, endorsed by, or sponsored by the MLflow Project, Databricks, the Linux Foundation, or LF Projects, LLC. MLflow and related marks are trademarks of their respective owners. Maintained by Kharkevich Engineering Lab.
Features
- OIDC-based authentication for MLflow UI and API
- User management through OIDC provider
- User-level access control
- Group-based access control
- Permissions management based on regular expressions (allows or denies access to specific MLflow resources based on regular expressions and assigns permissions to users or groups)
- Support for session, JWT, and basic authentication methods
- Compatible with mlflow-client (basic auth)
Documentation
For detailed documentation, please refer to the docs. AI generated documentation is available at DeepWiki.
Quick Start
To get the full version (with entire MLflow and all dependencies), run:
python3 -m venv venv
source venv/bin/activate
python3 -m pip install mlflow-oidc-auth[full]
mlflow server --app-name oidc-auth --host 0.0.0.0 --port 8080
Webhook secret encryption key 🔐
Webhook secrets are stored encrypted in the database using a Fernet key. If you plan to use MLflow webhooks with secrets, set the encryption key in the environment variable MLFLOW_WEBHOOK_SECRET_ENCRYPTION_KEY before creating any webhooks. Generate a key with:
MLFLOW_WEBHOOK_SECRET_ENCRYPTION_KEY=$(python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")
export MLFLOW_WEBHOOK_SECRET_ENCRYPTION_KEY
Important: keep this key stable across application restarts and replicas. If the key is lost or changed after webhooks are created, previously stored secrets cannot be decrypted and will cause webhook listing to fail until you restore the original key or remove/rotate the affected webhook secrets.
Development
For development quick start, please refer to the Development and Contribution section. Contribution guidelines are available in CONTRIBUTING.md.
License
Apache 2 Licensed. For more information, please see LICENSE.
Based on MLflow basic-auth plugin
https://github.com/mlflow/mlflow/tree/master/mlflow/server/auth
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file mlflow_oidc_auth-7.3.5.tar.gz.
File metadata
- Download URL: mlflow_oidc_auth-7.3.5.tar.gz
- Upload date:
- Size: 680.1 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/6.1.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
9bcc1c8a81b31119c0332ae35ae8de181eab2f133a7581957c1f1616623ca7ff
|
|
| MD5 |
64c9442e42b64c13ae4156086623c6ff
|
|
| BLAKE2b-256 |
e498f5e2ea8b19db947421efd67c3c217509e0713eb5771879668ec043bcc54b
|
Provenance
The following attestation bundles were made for mlflow_oidc_auth-7.3.5.tar.gz:
Publisher:
pypi.yml on mlflow-oidc/mlflow-oidc-auth
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
mlflow_oidc_auth-7.3.5.tar.gz -
Subject digest:
9bcc1c8a81b31119c0332ae35ae8de181eab2f133a7581957c1f1616623ca7ff - Sigstore transparency entry: 2230379557
- Sigstore integration time:
-
Permalink:
mlflow-oidc/mlflow-oidc-auth@152f134a42d2367bc23144826defe6fda7733583 -
Branch / Tag:
refs/heads/main - Owner: https://github.com/mlflow-oidc
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
pypi.yml@152f134a42d2367bc23144826defe6fda7733583 -
Trigger Event:
push
-
Statement type:
File details
Details for the file mlflow_oidc_auth-7.3.5-py3-none-any.whl.
File metadata
- Download URL: mlflow_oidc_auth-7.3.5-py3-none-any.whl
- Upload date:
- Size: 869.2 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/6.1.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
8866bcf00cb44dc0e5be6de614f451f42a77bb77628d4e2a399113dabbb9b4fb
|
|
| MD5 |
d49bd22ac250f80520d5679f6d1fa37b
|
|
| BLAKE2b-256 |
aa5c489a066a0b0dec1c7bacce50a917f8fb97aa3b54f8b65398363ef6fade26
|
Provenance
The following attestation bundles were made for mlflow_oidc_auth-7.3.5-py3-none-any.whl:
Publisher:
pypi.yml on mlflow-oidc/mlflow-oidc-auth
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
mlflow_oidc_auth-7.3.5-py3-none-any.whl -
Subject digest:
8866bcf00cb44dc0e5be6de614f451f42a77bb77628d4e2a399113dabbb9b4fb - Sigstore transparency entry: 2230380468
- Sigstore integration time:
-
Permalink:
mlflow-oidc/mlflow-oidc-auth@152f134a42d2367bc23144826defe6fda7733583 -
Branch / Tag:
refs/heads/main - Owner: https://github.com/mlflow-oidc
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
pypi.yml@152f134a42d2367bc23144826defe6fda7733583 -
Trigger Event:
push
-
Statement type:
