Flyte Project isolation

[robert-ulbrich-mercedes-benz]

Motivation

Flyte allows having multiple tenants by using projects and domains. Flyte also comes with an authentication that only
allows access to Flyte if the user is successfully authenticated. Once the user is successfully authenticated, she has full access to all projcets and domains in Flyte e.g. submit a workflow in any Flyte project.

Functional description

In order to protect data from unauthorized access, it makes sense to isolate the Flyte projects from each other.
That way a user can only submit workflows in the project he or she is assigned to. If trying to register a launchplan,
submitting a Flyte workflow or a task in a project the user is not assigned to, will cause an error.

Implementation idea

The projects a user is assigned to, will be identified by reading a claim from an identity token that is issued in the course
of the authentication process. The claim to be read for this purpose is configured in Flyte's configuration file. Also a mapping
between the claim's value and the actual project to be assigned to is maintained in the Flyte configuration.

Limits

So this approach only aims on isolating single Flyte tenants from each other and there is no intention to introduce a full blown
IAM concept including user roles. So any member of a Flyte project still has full access to their project's launch plans data etc.

[kumare3]

IMO using oauth2 for AuthZ is usually frowned upon and leads to problems. Maintaining claims and projects in configuration is also hard. Flyte has API's to create projects, this becomes hard. Also returning all claims will slow down authentication. I am not an expert at this, but seems like we need to think way more deeply about this

[robert-ulbrich-mercedes-benz]

I agree, that it won't be really easy. But I do not understand, why it is hard to maintain claims and project configuration in configuration. Of course we should also add fields to the API to configure a mapping between claims (and their values) and the projects to create.

Can you also please explain how returning claims slows down authentication? I guess the list of claims and their values for projects can be kept in memory and iterating over them with the identity token, I personally do not see a big performance degradation risk, as least as there not thousands of different projects.