Can I restrict MLflow access based on specific user groups?

Yes, the skill configures the mlflow-oidc-auth plugin to map specific Keycloak groups to READ, EDIT, or MANAGE permission levels.

How do I fix SSL certificate verification errors during authentication?

The skill provides troubleshooting guidance on setting SSL_CERT_FILE and REQUESTS_CA_BUNDLE environment variables to handle custom CA bundles in Kubernetes.

Is this configuration compatible with Istio Ambient Mesh?

Yes, the skill includes definitions for Istio Waypoint proxies and AuthorizationPolicies to secure trace ingestion at the network layer.

Does this skill support OpenTelemetry (OTEL) traces?

Yes, it includes specific Python runtime patches to enable the /v1/traces OTLP endpoint which is typically unavailable when using the OIDC auth wrapper.

How does this skill handle MLflow API access for automated pipelines?

It provides implementation patterns for the Client Credentials flow, allowing CI/CD systems to retrieve Bearer tokens from Keycloak for secure, programmatic tracking.

MLflow OIDC Authentication

Name: MLflow OIDC Authentication
Author: kagenti

bykagenti

•

Security & Testing

Configures MLflow Tracking Servers with Keycloak OIDC authentication and group-based authorization.

This skill enables secure, enterprise-grade authentication for MLflow Tracking Servers by integrating the mlflow-oidc-auth plugin with Keycloak. It provides comprehensive support for OpenID Connect (OIDC), group-based access control (READ, EDIT, MANAGE), and seamless session management for both browser and programmatic access. Additionally, it includes advanced configurations for OpenTelemetry (OTEL) trace ingestion, runtime patching for missing routers, and Istio-based security policies, making it an essential tool for building robust MLOps environments that require strict identity and access management.

Key Features

01Support for both browser-based sessions and programmatic Bearer token access

02Runtime patching to enable OpenTelemetry (OTEL) trace ingestion endpoints

03Granular group-based authorization for READ, EDIT, and MANAGE permissions

04Infrastructure patterns for Istio Waypoint proxies and Kubernetes Helm charts

05Keycloak OpenID Connect (OIDC) integration for centralized identity management

0672 GitHub stars

Use Cases

01Securing an internal MLflow Tracking Server with corporate SSO/Keycloak

02Implementing observability with OTEL traces in an Istio-managed service mesh

03Automating MLOps CI/CD pipelines using OAuth2 client credentials flow

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add kagenti/kagenti auth:mlflow-oidc-auth

For use in Claude.ai and ChatGPT

Download Skill