🗺️ Authentication Support

[mikeldking]

Phoenix has evolved from a notebook tool to an application backed by a database and deployed as an OCI container. Since building persistence into Phoenix, the most common ask from end users has been the ability to deploy Phoenix with authorization. While it's currently possible to secure an instance of Phoenix by deploying it behind a reverse-proxy and implementing custom authentication, this requires significant effort and expertise on the part of the user. Not only are spans, traces, and datasets potentially private, but certain planned features such as prompt playground require the storage of API keys. Building auth will allow users to easily and securely store sensitive data in deployed instances of Phoenix and will unlock development on a new set of features.

Our goal is to enable users to deploy authenticated instances of Phoenix in a straightforward and secure way.

👓 Tech spec

Preliminaries

• [auth] ☂️ migrate to pydantic #3855
• [auth] auth tech-spec #4013
• [auth] research best authlib #3741
• [auth] [server] investigate cryptographic hash functions for basic auth flow #4021
• [auth] find reference implementation for access / refresh #4266

First Milestone (Local Auth)

Database

• [auth] add auth-related tables #4043
• [auth][db] create users and roles table #4012
• [auth][db] create api_keys table #4057
• [auth][db] add token tables #4368
• [auth][db] add uniqueness constraints on the users table #4231
• [auth][db] standardize format of audit tables #4185
• [auth][db] remove cascade delete on user role foreign key relation in user table #4497
• [auth][db] add unique constraint to foreign key relation between access and refresh tokens #4607

Server

• [auth] plumb through ENABLE_AUTH setting through frontend #4192
• [auth][server] add PHOENIX_DANGEROUSLY_ENABLE_EXPERIMENTAL_AUTH env var #4041
• [auth][server] add PHOENIX_CLIENT_SECRET environment variable #3728
• [auth][server] implement password salting and verification #4193
• [auth][server] rename auth environment variable to PHOENIX_ENABLE_AUTH #4042
• [auth] add validation checks for PHOENIX_SECRET to ensure a strong symmetric key is used #4177
• [auth] scaffold system and admin user on boot with auth_enabled true #4277
• [auth][server] support distributed nodes without sticky routing #4540
• [auth] Parameterize the access / refresh duration #4584
• [auth][bug] user should be able to log out with just the refresh token after the access token expires #4683

Client

• [auth][client] make client accept api key via api_key parameter and PHOENIX_API_KEY env var #4056
• [auth] ensure client code is aware of environment variables #4613

UI

• [auth][ui] add admin page #4047
• [auth][ui] add users table #4048
• [auth][ui] functionality context #4199
• [auth][ui] profile page #4223
• [auth][ui] viewer context and react based RBAC guards #4454
• [auth][ui] system api keys #4269
• [ui] create user modal on the users card in settings #4278
• [auth] login page #4311
• [auth][ui] delete system keys UI #4360
• [auth][ui] admin can view user keys and delete UI #4361
• [auth][ui] user profile page with api keys #4273
• [auth][ui] delete user keys UI #4362
• [auth][ui] force repeat password in admin page #4483
• [auth][ui] create personal API keys modal #4484
• [auth][ui] reset password route and page #4492
• [auth][ui] edit profile #4552
• [auth][ui] delete users #4553
• [auth][UI] guidance on how to store and save the API key #4564
• [auth][UI]prompt the user to use authentication headers in the UI #4576
• [auth][UI] add a "returnURL" parameter to login if a user accesses a page without credentials #4605
• [auth][ui] add ability for admins to manage users, reset passwords, change roles #4612

GraphQL API

• [auth][graphql] User node type #4040
• [auth][graphql] APIKey node type #4063
• [auth][graphql] create admin permission #4050
• [auth][graphql] create permission to require access token #4051
• [auth][graphql] attach user id onto context #4062
• [auth][graphql] createUser resolver #4037
• [auth][graphql] UserRole resolver and dataloader #4220
• [auth][graphql] getUsers resolver #4049
• [auth][graphql] add the viewer resolver that is the current user #4421
• [auth][graphql] patchUser resolver #4038
• [auth][graphql] deleteUsers resolver #4039
• [auth][graphql] patchSelfUser resolver #4052
• [auth][graphql] getUserAPIKeys resolver #4061
• [auth][graphql] createUserAPIKey mutation #4058
• [auth][graphql] deleteUserAPIKeys mutation #4059
• [auth][graphql] getSystemAPIKeys resolver #4233
• [auth][graphql] createSystemAPIKey resolver #4234
• [auth][graphql] deleteSystemAPIKey mutation #4272
• [auth][graphql] exclude system users from the users table #4227
• [auth][graphql] user roles resolver #4222
• [auth][graphql] login and logout mutations #4326
• [auth][graphql] prevent login and logout stacktraces from being logged #4335
• [auth][graphql] ip-based rate-limiting on public resolvers #4344
• [auth][graphql] RBAC on queries #4363
• [auth][graphql] RBAC on mutations #4364
• [auth][graphql] resolve the access token's user and attach the User + Role on graphql context #4366
• [auth][graphql] the view node on query (extends User) #4367
• [auth][graphql] user api keys on viewer node (personal keys) #4452
• [auth][gql] reset password flow support #4448
• [auth][graphql] needsResetPassoword field on user #4491
• [auth][graphql] secure graphql api when auth is enabled #4507
• [auth][gql] update permissions on deleteUserAPIKey mutation to allow for a member user to delete their own keys #4513
• [auth][graphql] soft-delete users #4561

REST API

• [auth][rest] public login and logout routes #4045
• [auth] add /v1/auth/login POST for login #4453
• [auth][rest] refresh token route #4433
• [auth][rest] session authentication middleware or dependency #4064
• [auth][rest] api key authentication middleware or dependency #4065
• [auth] propagate authentication settings to the swagger UI #4275
• [auth] ensure /exports route is protected when auth is enabled #4588

gRPC API

• [auth] add key-based authentication to gRPC server #4274

CI

• [auth][docker] create docker image off of auth feature branch #4515
• [auth][kubernetes] update kubernetes manifest to deploy phoenix with and without auth #4516

Testing

• [auth][test] run migrations in tests #4179
• [auth][testing] test cases (Auth tests) #4493
• [auth] API load testing #4539
• [auth][UI] Testing #4541

Documentation

• [auth][docs] auth deployment guide #4542
• [auth][docs] document admin password reset flow when no smtp integration is configured #4022
• [auth][docs] provide guide on how to handle security breaches #4568
• [auth][docs] permission matrix in the docs #4567
• [auth][docs] guidance on how to set credentials in the requests #4582
• [auth][docs] guidance on user management #4569
• [auth] document system keys vs user keys #4577
• [auth][docs] oath configuration #4583
• [auth][docs] oauth2 configuration #4660
• [auth][docs] smpt configuration #4661

Cleanup

• [auth] rename environment variables #4184
• [auth] refactor migration file and clean up ci #4551
• [auth] unnest auth-related models #4183
• [auth] ensure auth env vars are read once #4586
• [auth] simplify Facilitator logic #4594
• [auth][cleanup] fully delete user tuples #4676
• [auth][ui][bug] settings dots icon breaks #4677
• [auth][rest][bug] rate limiters are not associated with correct routes #4691
• [auth][ui][bug] don't show reset password button in oauth2 user profiles #4727
• [auth] require username #4733
• [auth] infer origin url #4736
• [auth] strengthen auth method constraint #4743
• [auth] ensure consistent origin url #4747
• [auth] run tests with tox #4761

Punt

• [auth] enable users to change their own email #4678
• [auth] enable admins to change emails #4679

Second Milestone (SMTP Integration)

• [auth][smtp] wire up smtp #4602
• [auth] email template #4659

Server

• [auth][server] add smtp env vars #4054
• [auth][server] password reset email #4055

Third Milestone (OAuth2 support)

• [auth][oauth] add initial oauth2 support #4649
• [auth][oauth] remove dependency on pyjwt #4650
• [auth][oauth][tests] add tests for oauth2 flows #4651
• [auth][oauth] add convenience environment variables for microsoft and aws idps #4652
• [oauth] support returnUrl query parameter #4653
• [oauth] add rate limiter to oauth endpoints #4654
• [auth][oauth] store state and nonce for oauth2 authorization code flow in cookies #4657
• [auth][oauth] automatically resolve username collisions when creating oauth2 users #4675
• [auth][oauth] set oauth2 state and nonce cookies with "lax" samesite policy #4685
• [auth][oauth] ensure return url is a relative path #4686
• [auth][oauth] add computed column for auth method #4687
• [auth][oauth] add check constraint between local and oauth fields on users table #4688
• [auth][oauth] add oauth2 origin env var #4690
• [auth][oauth] simplify and rename config #4712
• [auth] implement authorization code flow for github oauth #4550

[monuminu]

when are we planning to do this?

[mikeldking]

when are we planning to do this?

We will start in the coming month.

[xwang-otterai]

Thank you for planning this! This would be very helpful!

[anandsainath]

Would be amazing to see this in the product! Commenting to follow progress.

[mikeldking]

Marking this milestone closed as Auth and RBAC is shipped in 5.0. Please feel free to file enhancement requests and we will triage them as follow-ups!