[Core] Token auth support in Dashboard head #58209

sampan-s-nayak · 2025-10-27T09:11:30Z

Description

extend token auth support to dashboard head (all API's)

Signed-off-by: sampan <sampan@anyscale.com>

- Created RayAuthTokenLoader singleton class with thread-safe token caching - Loads tokens from RAY_AUTH_TOKEN env, RAY_AUTH_TOKEN_PATH, or ~/.ray/auth_token - Support for token generation with UUID (cross-platform) - Modified GrpcServer to store and pass auth token to ServerCallImpl - Updated RPC_SERVICE_HANDLER macros to pass auth token - GCS server now loads token using RayAuthTokenLoader - Removed auth_token from RayConfig (now loaded via loader) - Token precedence: env var -> path env var -> default file path Signed-off-by: sampan <sampan@anyscale.com>

- Created Python auth_token_loader module with thread-safe token caching - Loads tokens from same precedence as C++: RAY_AUTH_TOKEN, RAY_AUTH_TOKEN_PATH, ~/.ray/auth_token - Added enable_token_auth parameter to ray.init() with auto-generation support - Added --enable-token-auth flag to ray start CLI (fails if no token found) - Only pass enable_token_auth flag via system_config, not the token - Each side (C++/Python) loads tokens independently using their own loaders - ray.init() auto-generates token if not found, ray start fails with helpful error Signed-off-by: sampan <sampan@anyscale.com>

- Test token loading from RAY_AUTH_TOKEN environment variable - Test token loading from RAY_AUTH_TOKEN_PATH file - Test token loading from default ~/.ray/auth_token path - Test precedence order (env var > path env var > default file) - Test token generation with GetToken(true) - Test token caching behavior - Test thread safety with concurrent GetToken calls - Test whitespace trimming from token files - Test behavior when no token is found Signed-off-by: sampan <sampan@anyscale.com>

- Test token loading from RAY_AUTH_TOKEN environment variable - Test token loading from RAY_AUTH_TOKEN_PATH file - Test token loading from default ~/.ray/auth_token path - Test precedence order (env var > path env var > default file) - Test token generation with generate_if_not_found=True - Test token caching behavior across multiple calls - Test has_auth_token() function - Test thread safety with concurrent loads and generation - Test whitespace handling and empty values - Test file permissions on Unix systems (0600) - Test error handling for permission errors - Test integration with fixtures and cleanup Signed-off-by: sampan <sampan@anyscale.com>

Signed-off-by: sampan <sampan@anyscale.com>

edoakes · 2025-10-28T15:31:27Z

lots of test failures

Signed-off-by: sampan <sampan@anyscale.com>

sampan-s-nayak · 2025-10-28T15:43:27Z

lots of test failures

ah I think I missed .py in bazel file.

Signed-off-by: sampan <sampan@anyscale.com>

Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com>

…n_auth_4

Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com>

edoakes · 2025-10-30T14:19:39Z

python/ray/dashboard/tests/test_dashboard_auth.py

+from ray._raylet import Config
+
+
+@pytest.fixture


@sampan-s-nayak I pushed a commit to clean up the fixtures a bit here, FYI

also moved it into the dashboard/tests/ dir

oh I had another pr where I refactored all these fixtures and moved them to conf test

edoakes · 2025-10-30T14:20:01Z

python/ray/includes/rpc_token_authentication.pxi

    return GetAuthenticationMode()


+def validate_authentication_token(provided_token: str) -> bool:


seems like this could be implemented fully in the C++ layer?

Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com>

Extend token auth support to dashboard head (all API's) --------- Signed-off-by: sampan <sampan@anyscale.com> Signed-off-by: Sampan S Nayak <sampansnayak2@gmail.com> Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com> Co-authored-by: sampan <sampan@anyscale.com> Co-authored-by: Edward Oakes <ed.nmi.oakes@gmail.com>

Extend token auth support to dashboard head (all API's) --------- Signed-off-by: sampan <sampan@anyscale.com> Signed-off-by: Sampan S Nayak <sampansnayak2@gmail.com> Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com> Co-authored-by: sampan <sampan@anyscale.com> Co-authored-by: Edward Oakes <ed.nmi.oakes@gmail.com> Signed-off-by: Aydin Abiar <aydin@anyscale.com>

Extend token auth support to dashboard head (all API's) --------- Signed-off-by: sampan <sampan@anyscale.com> Signed-off-by: Sampan S Nayak <sampansnayak2@gmail.com> Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com> Co-authored-by: sampan <sampan@anyscale.com> Co-authored-by: Edward Oakes <ed.nmi.oakes@gmail.com> Signed-off-by: Future-Outlier <eric901201@gmail.com>

sampan and others added 30 commits October 16, 2025 08:35

[Core] Authentication for ray core rpc calls - part 1

021df65

Signed-off-by: sampan <sampan@anyscale.com>

fix lint errors

fcd1d10

Signed-off-by: sampan <sampan@anyscale.com>

missed change

411f6f4

Signed-off-by: sampan <sampan@anyscale.com>

more lint issues

40fcdb5

Signed-off-by: sampan <sampan@anyscale.com>

fix library

223dbf5

Signed-off-by: sampan <sampan@anyscale.com>

more lint

cc89a63

Signed-off-by: sampan <sampan@anyscale.com>

move python side changes to new pr

c079298

Signed-off-by: sampan <sampan@anyscale.com>

remove unused import

34aa7a3

Signed-off-by: sampan <sampan@anyscale.com>

Merge remote-tracking branch 'upstream/grpc_auth_1' into grpc_auth_2

7bde811

Signed-off-by: sampan <sampan@anyscale.com>

remove generate token method from c++ code

733efca

Signed-off-by: sampan <sampan@anyscale.com>

fix lint

16fd74e

Signed-off-by: sampan <sampan@anyscale.com>

refactor code files

7094efd

Signed-off-by: sampan <sampan@anyscale.com>

fix lint

f56d5ee

Signed-off-by: sampan <sampan@anyscale.com>

fix lint

356a38e

Signed-off-by: sampan <sampan@anyscale.com>

add missing imports

899973e

Signed-off-by: sampan <sampan@anyscale.com>

refactor token loader and tests

47f2e5a

Signed-off-by: sampan <sampan@anyscale.com>

refactor token loader + fix build

d6a87e2

Signed-off-by: sampan <sampan@anyscale.com>

fix lint

e579741

Signed-off-by: sampan <sampan@anyscale.com>

Merge branch 'grpc_auth_1' into grpc_auth_2

99b7c22

fix issues + update tests

8678815

Signed-off-by: sampan <sampan@anyscale.com>

missed change

4274544

Signed-off-by: sampan <sampan@anyscale.com>

fix lint

4a5dda9

Signed-off-by: sampan <sampan@anyscale.com>

address comments - version 1

b20e1ef

Signed-off-by: sampan <sampan@anyscale.com>

fix lint

d1fe7b9

Signed-off-by: sampan <sampan@anyscale.com>

missing imports

09359d6

Signed-off-by: sampan <sampan@anyscale.com>

fix lint

886c109

Signed-off-by: sampan <sampan@anyscale.com>

fix typo

e39247d

Signed-off-by: sampan <sampan@anyscale.com>

This comment was marked as outdated.

Sign in to view

sampan and others added 4 commits October 28, 2025 15:54

attempt to fix tests

bf4866a

Signed-off-by: sampan <sampan@anyscale.com>

attempt to fix test in CI

61646af

Signed-off-by: sampan <sampan@anyscale.com>

fix lint

5b3cc5b

Signed-off-by: sampan <sampan@anyscale.com>

Merge branch 'grpc_auth_2' into token_auth_4

3f40f21

sampan-s-nayak requested a review from edoakes October 29, 2025 14:17

Base automatically changed from grpc_auth_2 to master October 30, 2025 13:54

edoakes added 4 commits October 30, 2025 08:55

Merge branch 'master' into token_auth_4

cbf49ba

Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com>

Merge branch 'master' of https://github.com/ray-project/ray into toke…

9687632

…n_auth_4

Fix

0e100db

Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com>

Fix

342727d

Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com>

edoakes reviewed Oct 30, 2025

View reviewed changes

edoakes approved these changes Oct 30, 2025

View reviewed changes

edoakes enabled auto-merge (squash) October 30, 2025 14:20

edoakes added 2 commits October 30, 2025 10:42

Fix

61497e3

Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com>

Fix

3e3f4c5

Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com>

github-actions bot disabled auto-merge October 30, 2025 15:42

edoakes enabled auto-merge (squash) October 30, 2025 15:43

Fix

07ce777

Signed-off-by: Edward Oakes <ed.nmi.oakes@gmail.com>

github-actions bot disabled auto-merge October 30, 2025 16:30

edoakes merged commit fef5fa6 into master Oct 30, 2025
6 checks passed

edoakes deleted the token_auth_4 branch October 30, 2025 21:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Core] Token auth support in Dashboard head #58209

[Core] Token auth support in Dashboard head #58209

Uh oh!

sampan-s-nayak commented Oct 27, 2025 •

edited

Loading

Uh oh!

edoakes commented Oct 28, 2025

Uh oh!

sampan-s-nayak commented Oct 28, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

edoakes Oct 30, 2025

Uh oh!

edoakes Oct 30, 2025

Uh oh!

sampan-s-nayak Oct 31, 2025

Uh oh!

edoakes Oct 30, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		return GetAuthenticationMode()


		def validate_authentication_token(provided_token: str) -> bool:

[Core] Token auth support in Dashboard head #58209

[Core] Token auth support in Dashboard head #58209

Uh oh!

Conversation

sampan-s-nayak commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

edoakes commented Oct 28, 2025

Uh oh!

sampan-s-nayak commented Oct 28, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

edoakes Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

edoakes Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

sampan-s-nayak Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

edoakes Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sampan-s-nayak commented Oct 27, 2025 •

edited

Loading