#148 - Auth Project Design Documents #165

RyaliNvidia · 2025-12-18T00:30:15Z

Description

Design doc for auth sidecar, idp integration, and resource action model

The numbers for the auth sidecar was from #126

Issue #148

Checklist

I am familiar with the Contributing Guidelines.
New or existing tests cover these changes.
The documentation is up to date with these changes.

ecolternv · 2025-12-18T16:20:56Z

projects/auth/PROJ-148-auth-sidecar.md

+
+### Motivation
+
+- **Performance**: Python middleware adds latency to every request; Golang gRPC with caching achieves <5ms authorization checks


This isnt a strong argument for the golang sidecar. We could add caching to the python middleware too

I'll switch this to reference my performance numbers that I gather at the bottom. Those tests are from where both the middleware and the go code had caching and were operating on cache hits.
The main premise of the test is to compare the go code with gRPC against the current python which is on even playing ground

I think the biggest thing I need to figure out is how to connect the auth sidecar with the logging sidecar to send off logs.

But besides this, what are you concerns with using a sidecar in place of the middleware? From my perspective, the sidecar shouldn't actually add much overhead and actually provides more clarity to the service.

I do like the fact that we can just check the container to see the logs/health of the authorization logic. I didn't put this as a selling point because by default, we should add better logging to the logging sidecar for the authorization for no matter if we use the middleware or sidecar.

projects/auth/PROJ-148-auth-sidecar.md

projects/auth/PROJ-148-direct-idp-integration.md

ecolternv · 2025-12-18T16:44:09Z

projects/auth/PROJ-148-direct-idp-integration.md

+osmo user roles remove [email protected] --role osmo-ml-team
+
+# List all users with a role
+osmo role users list osmo-ml-team


Its kind of tricky that the first thing is singular and hte second thing is plural

osmo role users
osmo user roles

I can see myself getting confused and trying osmo roles ... and osmo users ...

Yeah. This section is marked as WIP as I just wanted to put some stuff down as an example, but this is not the final look. I'm still considering whether we even need like osmo user or just osmo role

projects/auth/PROJ-148-direct-idp-integration.md

projects/auth/PROJ-148-resource-action-model.md

projects/auth/PROJ-148-auth-sidecar.md

vvnpn-nv · 2025-12-18T18:12:59Z

projects/auth/PROJ-148-direct-idp-integration.md

+1. [Prerequisites](#prerequisites)
+2. [Microsoft Entra ID (Azure AD)](#microsoft-entra-id-azure-ad)
+3. [Google OAuth2](#google-oauth2)
+4. [Amazon Cognito](#amazon-cognito)


please add integration for okta this is one of the most commonly used SSO providers.

Sounds good. I'll need to look into okta as I'm not too familiar with their auth process

Instead of amazon cognito can we look into Identity Center (AWS SSO) instead

another commonly used auth provider is auth0

Sounds good. I think I'll probably handle Azure AD, Google OAuth2, and AWS SSO for the first verification and then work on supporting the rest. I'll add a section detailing further auth providers we want to support

Updated the content

fernandol-nvidia · 2025-12-18T20:43:29Z

projects/auth/PROJ-148-resource-action-model.md

+        "effect": "Allow",
+        "actions": [
+          "workflow:*",
+          "task:Read", "task:Update", "task:Cancel", "task:Exec", "task:PortForward", "task:Rsync",


question, how do we define a policy for users only able to portforward tasks in their authorized pool?

Ah. So task also uses the pool resource to determine the authorized pool as per the section above. Let me try to fix some examples or update the wording

fernandol-nvidia · 2025-12-18T20:45:40Z

projects/auth/PROJ-148-direct-idp-integration.md

+
+**By removing Keycloak and connecting Envoy directly to the IDP**, we achieve:
+
+- **Single source of truth** for role assignments (OSMO database only)


question, if an IDP also provides roles, do we want to support that? Or is everything done strictly thru OSMO?

Yes the IDP provides roles and we will use that. Ideally to me, we would fetch the IDP roles and then update our DB with the information, so our DB is entirely accurate. As a result, the DB is still the single source of truth for OSMO. However, this option has an issue where if the user has been removed from access in the IDP, OSMO doesn't have real-time trigger to be aware of this so the OSMO DB will only be updated when the user tries to login next.

The other option is from @ecolternv 's suggestion that we don't store the role provided by the IDP and when auth is evaluated, we used the combine IDP value + OSMO specified config to determine access. This removes OSMO's responsibility to be up to date, but I don't really like that we can't tell the user's current access ability. Either way is a simple change, I prefer the first option, but I'm open to either

fernandol-nvidia · 2025-12-18T20:46:13Z

projects/auth/PROJ-148-auth-sidecar.md

+
+**Implementation**: Thread-safe in-memory cache with LRU eviction
+
+**Cache Key**: Sorted, comma-separated role names (e.g., `"osmo-default,osmo-user"`)


can you share what the cache value might look like?

In my test for this, the cache values look like: https://github.com/NVIDIA/OSMO/pull/126/files#diff-0ec6cf70f862a1ea33cc5b4a3973ccca4e83f3dee324794ba2c327c8ccbd0897R44

vvnpn-nv · 2025-12-19T21:15:23Z

projects/auth/PROJ-148-resource-action-model.md

+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Resource-Action Permission Model Design


can we leverage existing libraries such as Casbin for RBAC control
https://casbin.org

I forgot that I actually looked into this as @fernandol-nvidia referenced this to me a couple of weeks ago. The reason why I strayed away from it is because I thought it had a strict compile time definition of the role to policy mapping, but I think I misunderstood. I'll play around with Casbin and see if we can leverage this

Auth Project Design Documents

17c0194

RyaliNvidia requested a review from a team December 18, 2025 00:30

ecolternv reviewed Dec 18, 2025

View reviewed changes

fernandol-nvidia reviewed Dec 18, 2025

View reviewed changes

projects/auth/PROJ-148-auth-sidecar.md Show resolved Hide resolved

RyaliNvidia added 2 commits December 18, 2025 09:39

comment clarifaction and cleanup

2861098

Update motivation logic

d16a50a

vvnpn-nv reviewed Dec 18, 2025

View reviewed changes

RyaliNvidia added 2 commits December 18, 2025 10:26

Update section

889b20c

add more reasons

1d2484b

fernandol-nvidia previously approved these changes Dec 18, 2025

View reviewed changes

Update resource action model

a57d70b

RyaliNvidia dismissed fernandol-nvidia’s stale review via a57d70b December 18, 2025 21:26

RyaliNvidia added 2 commits December 18, 2025 13:30

Update resource action model

c9dbd23

Update IDPs

805a72a

RyaliNvidia temporarily deployed to internal-ci December 18, 2025 21:52 — with GitHub Actions Inactive

fix scope

4ebef94

RyaliNvidia temporarily deployed to internal-ci December 19, 2025 00:11 — with GitHub Actions Inactive

vvnpn-nv reviewed Dec 19, 2025

View reviewed changes


		### Motivation

		- Performance: Python middleware adds latency to every request; Golang gRPC with caching achieves <5ms authorization checks


		By removing Keycloak and connecting Envoy directly to the IDP, we achieve:

		- Single source of truth for role assignments (OSMO database only)


		Implementation: Thread-safe in-memory cache with LRU eviction

		Cache Key: Sorted, comma-separated role names (e.g., `"osmo-default,osmo-user"`)

#148 - Auth Project Design Documents #165

Are you sure you want to change the base?

#148 - Auth Project Design Documents #165

Uh oh!

Conversation

RyaliNvidia commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

RyaliNvidia Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vvnpn-nv Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

RyaliNvidia commented Dec 18, 2025 •

edited

Loading

RyaliNvidia Dec 18, 2025 •

edited

Loading

vvnpn-nv Dec 18, 2025 •

edited

Loading