Authentifier les comptes via OpenID Connect¶
Note
L’authentification OpenID Connect est une fonctionnalité d’entreprise Flower. Voir Flower Enterprise pour plus de détails.
In this guide, you’ll learn how to configure SuperLink with account authentication and
how to log in using the flwr CLI. Once logged in, Flower accounts can run CLI
commands that interact with the SuperLink.
Important
Account authentication does not replace resource-level access checks. Run ownership, federation membership and roles, and entitlements continue to constrain what an authenticated account can access.
Prérequis¶
To enable account authentication, the SuperLink must be deployed with an OpenID Connect (OIDC) provider. The OIDC provider verifies account identity and supplies the account information used by SuperLink’s ownership, federation, and entitlement checks.
Enable Account Authentication on the SuperLink¶
Set the following environment variables on the SuperLink process:
FLWR_OIDC_ENABLED=1
FLWR_OIDC_ISSUER=https://<domain>/realms/<realm>
FLWR_OIDC_CLIENT_ID=<client_id>
FLWR_OIDC_CLIENT_SECRET=<client_secret>
FLWR_OIDC_VERIFY_TLS=1
FLWR_OIDC_ENABLED defaults to 0. FLWR_OIDC_VERIFY_TLS defaults to 1. As
with other Flower binary environment variables, use 1 for true and 0 for false.
Control authentication remains NoOp unless FLWR_OIDC_ENABLED=1, even when
credentials are present. FLWR_OIDC_VERIFY_TLS affects only requests to the OIDC
provider.
Start the SuperLink with these variables in its environment:
$ FLWR_OIDC_ENABLED=1 \
FLWR_OIDC_ISSUER=https://<domain>/realms/<realm> \
FLWR_OIDC_CLIENT_ID=<client_id> \
FLWR_OIDC_CLIENT_SECRET=<client_secret> \
flower-superlink <other flags>
Connectez-vous au SuperLink¶
Once a SuperLink with account authentication is up and running, an account can interface
with it after installing the flwr PyPI package via the Flower CLI. Configure the
SuperLink connection in your Flower Configuration file (typically located at
$HOME/.flwr/config.toml):
[superlink]
default = "my-prod-superlink" # Set the default connection configuration
[superlink.my-prod-superlink]
address = "<SUPERLINK-ADDRESS>:<CONTROL-API-PORT>" # Address of the SuperLink Control API
root-certificate = "<PATH/TO/ca.crt>" # TLS certificate set for the SuperLink. Required for self-signed certificates.
Note
Account authentication is only supported with TLS connections.
La mise en place de la connexion par défaut est facultative. Si vous n’installez pas le SuperLink par défaut, vous pouvez spécifier explicitement le nom de la connexion dans chaque commande, par exemple :
flwr login my-prod-superlink.
En savoir plus sur le fichier de configuration Flower dans la référence Flower Configuration.
Vous devez vous connecter en premier avant que d’autres commandes CLI puissent être exécutées. Lorsque vous exécutez flwr login, une URL sera retournée par le plugin d’authentification dans le SuperLink. Cliquez dessus et authentifiez-vous directement contre le fournisseur OIDC.
$ flwr login
A browser window has been opened for you to log into your Flower account.
If it did not open automatically, use this URL:
https://account.flower.blue/realms/flower/device?user_code=...
# [... follows URL and logs in ... in the meantime the CLI will wait ...]
✅ Login successful.
Une fois l’authentification réussie, les informations de compte retournées par le fournisseur OIDC via le SuperLink seront stockées localement. Les jetons seront envoyés transparentement avec chaque demande flwr CLI ultérieure vers le SuperLink, et il transmettra ceux-ci au fournisseur OIDC pour effectuer les contrôles d’authentification.
Run authenticated flwr CLI commands¶
With the above steps completed, you can now run flwr CLI commands against a
SuperLink setup with account authentication. For example, you can run the flwr run
command to start a Flower app:
$ flwr run
🎊 Successfully started run 1859953118041441032
SuperLink uses the authenticated account identity to enforce access to specific runs and federations through ownership, federation membership and roles, and entitlement checks.