René's URL Explorer Experiment

Title: feat: Extended OIDC support to extract groups & namespaces and token injection with multiple methods by aniketpalu · Pull Request #6089 · feast-dev/feast · GitHub

Open Graph Title: feat: Extended OIDC support to extract groups & namespaces and token injection with multiple methods by aniketpalu · Pull Request #6089 · feast-dev/feast

X Title: feat: Extended OIDC support to extract groups & namespaces and token injection with multiple methods by aniketpalu · Pull Request #6089 · feast-dev/feast

Description: What this PR does / why we need it: Extends OIDC authentication in Feast to support GroupBasedPolicy and NamespaceBasedPolicy for OIDC users, adds flexible client token injection, and wires up operator support for OIDC deployments. Previously, the OIDC token parser only extracted preferred_username and resource_access roles from the JWT. GroupBasedPolicy, NamespaceBasedPolicy, and CombinedGroupNamespacePolicy could never grant access for OIDC users because the User object was always created with empty groups and namespaces. Server Side Changes Files: oidc_token_parser.py, oidc_service.py, utils.py When auth.type: oidc, the Feast server now handles two types of incoming tokens: Keycloak JWTs (human users via UI, Swagger, or notebooks) are validated against the OIDC provider's JWKS. The parser extracts preferred_username (with upn fallback for Azure AD / Entra ID), groups claim, and resource_access..roles. GroupBasedPolicy uses the groups. client_id is optional; when absent, roles default to empty and groups still work. Kubernetes SA tokens (workbench pods) are detected via the kubernetes.io claim in an initial unverified decode. These are delegated to a lightweight TokenReview that validates the token and extracts the namespace from the SA identity. NamespaceBasedPolicy uses the namespace. No RBAC queries are performed, only tokenreviews/create is needed. Additional server improvements: verify_ssl field (default true) controls TLS verification for OIDC discovery and JWKS endpoints. Set to false for self-signed certificates. ca_cert_path field allows specifying a custom CA certificate for the OIDC provider when verify_ssl: true. SSL certificate errors now produce clear, actionable log messages instead of generic "Invalid token" errors. PyJWKClientError is now caught (previously only InvalidTokenError was caught), preventing 500 responses when JWKS endpoints are unreachable or keys are not found. Malformed tokens in the intra-communication check no longer crash the parser. Server Configuration (feature_store.yaml) auth: type: oidc auth_discovery_url: https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration client_id: feast-server # optional, needed only for role extraction verify_ssl: true # optional, default true ca_cert_path: /path/to/ca.crt # optional, for custom CA certs Keycloak Setup Required The OIDC client in Keycloak must have a Groups claim mapper configured: Client > Mappers > Add "Group Membership" mapper > claim name: groups Without this mapper, JWTs will not contain the groups claim and GroupBasedPolicy will deny all access. Client Side Changes Files: oidc_authentication_client_manager.py, auth_model.py, repo_config.py OidcAuthClientManager.get_token() now supports multiple token sources with a clear priority: token field in config: static JWT, returned directly, no network calls token_env_var field: reads from the named environment variable on every call (supports token refresh). If the variable is configured but missing, raises PermissionError immediately with no fallback. client_secret field (with auth_discovery_url and client_id): fetches token from the IDP via client_credentials or ROPG flow FEAST_OIDC_TOKEN environment variable: last resort fallback for bare {type: oidc} configs Kubernetes SA token file at /var/run/secrets/kubernetes.io/serviceaccount/token: for workbench pods running inside Kubernetes token, token_env_var, and client_secret are mutually exclusive (enforced by a Pydantic validator at config load time). Client Configuration Examples Zero config (workbench pods or kube-authkit users): auth: type: oidc Picks up FEAST_OIDC_TOKEN env var if set, otherwise reads the mounted SA token. Named environment variable (supports external token refresh): auth: type: oidc token_env_var: MY_APP_TOKEN Static token (testing / CI): auth: type: oidc token: "eyJhbGciOiJSUzI1NiIs..." Client credentials flow (service to service): auth: type: oidc auth_discovery_url: https://keycloak.example.com/realms/myrealm/.well-known/openid-configuration client_id: feast-client client_secret: my-secret Operator Changes Files: featurestore_types.go, repo_config.go, tls.go, services_types.go, authz.go The operator now generates separate server and client OIDC configs: Server config gets auth_discovery_url (resolved from three sources), optional client_id/client_secret from Secret, verify_ssl, and ca_cert_path. Client config gets only {type: oidc} with an optional token_env_var. Client pods never see server credentials. New CRD Fields on OidcAuthz Field Type Description issuerUrl string OIDC issuer URL. Operator appends /.well-known/openid-configuration to derive the discovery endpoint. secretRef LocalObjectReference (optional) Secret with OIDC properties (auth_discovery_url, client_id, client_secret). secretKeyName string Key in the Secret containing all OIDC properties as a single YAML value. tokenEnvVar string Env var name for client pods to read an OIDC token from. verifySSL bool Verify SSL certificates for the OIDC provider. Defaults to true. caCertConfigMap object (name, key) ConfigMap with the CA certificate for self-signed OIDC providers. Discovery URL Resolution Priority CR issuerUrl field (derives discovery URL by appending /.well-known/openid-configuration) Secret auth_discovery_url key (used verbatim) OIDC_ISSUER_URL environment variable on the operator pod (for RHOAI/ODH zero config) CA Certificate Resolution Priority CRD caCertConfigMap field (user specified ConfigMap, mounted at /etc/pki/tls/oidc-ca/ca.crt) Auto detected odh-trusted-ca-bundle ConfigMap with odh-ca-bundle.crt key (RHOAI/ODH clusters) System CA store (default when no custom CA is configured) RBAC When authz: oidc is configured, the operator provisions a ClusterRole and ClusterRoleBinding granting the Feast server SA tokenreviews/create permission. This enables the SA token delegation path for workbench pods. Operator CR Example Upstream (with issuerUrl): spec: authz: oidc: issuerUrl: "https://keycloak.example.com/realms/myrealm" secretRef: name: feast-oidc-secret verifySSL: true caCertConfigMap: name: keycloak-ca key: ca.crt ODH (OpenDataHub) zero config (platform injects OIDC_ISSUER_URL): spec: authz: oidc: {} Permission Examples from feast.permissions.permission import Permission from feast.permissions.policy import GroupBasedPolicy, NamespaceBasedPolicy from feast.permissions.action import AuthzedAction, ALL_ACTIONS from feast.feast_object import ALL_RESOURCE_TYPES from feast.feature_view import FeatureView # Grant full access to users in the "feast-admins" Keycloak group admin_perm = Permission( name="admin_permissions", types=ALL_RESOURCE_TYPES, policy=GroupBasedPolicy(groups=["feast-admins"]), actions=ALL_ACTIONS, ) # Grant read access to users in the "data-readers" Keycloak group reader_perm = Permission( name="reader_permissions", types=[FeatureView], policy=GroupBasedPolicy(groups=["data-readers"]), actions=[AuthzedAction.DESCRIBE, AuthzedAction.READ_ONLINE], ) # Grant full access to workbench pods in the "feast" namespace workbench_perm = Permission( name="workbench_permissions", types=ALL_RESOURCE_TYPES, policy=NamespaceBasedPolicy(namespaces=["feast"]), actions=ALL_ACTIONS, ) Which issue(s) this PR fixes: #6088 Misc

Open Graph Description: What this PR does / why we need it: Extends OIDC authentication in Feast to support GroupBasedPolicy and NamespaceBasedPolicy for OIDC users, adds flexible client token injection, and wires up ope...

X Description: What this PR does / why we need it: Extends OIDC authentication in Feast to support GroupBasedPolicy and NamespaceBasedPolicy for OIDC users, adds flexible client token injection, and wires up ope...

Opengraph URL: https://github.com/feast-dev/feast/pull/6089

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width