Repository navigation
feat(auth): support pluggable auth modes (aliyun/none/custom) for both consoles - #43
Merged
Merged
Conversation
…h consoles - Add AUTH_MODE env / --auth-mode flag (aliyun default, none, custom) to ai-dashboard and ai-dev-console backends - none: no login, built-in admin with full permissions, no Aliyun credentials or IMS client required at startup (deploy-and-use); legacy DISABLE_AUTH=true still honored as an alias - custom: integrate an external user system by trusting identity headers injected by an upstream gateway (X-Forwarded-User/Groups), with admin user/group lists and optional SSO login URL redirect; role/namespace scope resolved from User CRD per request - dev-console: proxy routes (notebook/vscode/tensorboard/ray) enforce namespace checks for WebSocket upgrades too; K8s token login disabled in custom mode to avoid bypassing the external IdP - frontends: 401 interceptor follows backend-provided loginUrl - charts: wire auth.mode and auth.custom.* into both helm charts, auto skip RAM webapp creation when not in aliyun mode - docs: auth modes section in deploy-guide; README/user-guide/ops-guide updates - fix .gitignore so cmd/server/ Go entry points are tracked (they were shadowed by the 'server' binary rule and never committed)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Introduce a unified auth-mode switch to both ai-dashboard (admin console) and ai-dev-console (developer console), via
AUTH_MODEenv var,--auth-modeflag, or Helmauth.mode:aliyun(default)nonecustomX-Forwarded-User/X-Forwarded-Groups), with admin user/group allowlists and an optional SSO login redirectBackwards compatible: legacy
DISABLE_AUTH=truestill works (mapped tononewith a deprecation warning).Main changes
internal/auth/mode.goin both consoles; middleware dispatches on auth mode; non-aliyun modes skip credential provider / IMS client init and RAM WebApp creation;/login/aliyunredirects to the console home (none) or the configured SSO URL (custom)loginUrl(external SSO) before falling back to the local login pageauth.modeandauth.custom.*values in both charts; RAM WebApp creation is skipped automatically in non-aliyun modes;helm templateverified for all three modesserverrule shadowing thecmd/server/Go entry points (both main.go files were never tracked before)Verification
go build+go test -count=1: all green in both modules (incl. 17 new test cases)helm template: both charts render correctly in all three modes