Access Control in Langflow

The authentication and authorization components in Langflow are designed to secure your workflows by validating user credentials, checking permissions, and controlling access to resources. These components ensure that only authorized users can perform specific actions on designated resources.

They handle critical security tasks like verifying tokens, confirming permissions, and managing access control, ensuring smooth and secure operations within your workflows.

JWT Validator

This component verifies JSON Web Tokens (JWT) using JSON Web Key Sets (JWKs) and extracts the user's identifier. It performs a thorough validation process, including signature checks, expiration date verification, and key validation via the specified JWKs endpoint.

To optimize performance, the component automatically fetches and caches the JWKs from the provided URL, handling key rotations efficiently and reducing unnecessary HTTP requests. It supports the RS256 algorithm and retrieves the subject claim (sub) as the user identifier.

Inputs

Configuration

Outputs

Permissions Check

This component evaluates whether a user has permission to perform a specific action on a resource. It integrates with Permit.io's Policy Decision Point (PDP) to enforce fine-grained access control based on your defined policies.

It supports context-aware authorization by optionally including tenant information, enabling real-time policy evaluations for multi-tenant environments.

Inputs

Configuration

Outputs

Data Protection

This component retrieves and filters the list of resources a user is allowed to access. It can either fetch all permissions for a given resource type or filter a specific set of resource IDs based on the user's permissions.

The component supports bulk permission checks and uses caching to enhance performance when evaluating multiple resources.

Inputs

Configuration

Outputs

How These Components Work Together

These components implement the four security perimeters for LLM applications:

1. Prompt Filtering: Use JWT Validator to authenticate users and filter inputs
2. RAG Data Protection: Use Data Protection to control access to RAG data
3. Secure External Access: Use Permissions Check for API and external service access
4. Response Enforcement: Use Data Protection to filter sensitive information from responses

Each component can be used individually or combined to create comprehensive security flows.

When setting up these components, ensure your Permit.io policies are properly configured, and your JWKs endpoint is accessible. The components are designed to handle errors gracefully, providing clear messages for issues such as invalid tokens, network problems, or denied permissions.