Answers: <p>It looks like MLFlow doesn't natively support any authentication schemes and <a href="https://groups.google.com/forum/#!topic/mlflow-users/E9QW4HdS8a8" rel="nofollow noreferrer">the recommendation</a> is to use a reverse proxy such as Nginx to only forward requests to MLFlow if a valid authentication cookie is provided, redirecting any requests without a cookie or an invalid cookie back to the Identity Provider.</p>
  
  <h2>Azure AD Application Proxy</h2>
  
  <p>You can <a href="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy" rel="nofollow noreferrer">configure Azure AD Application Proxy</a> to add authentication, although you will also need to protect MLFlow from unauthorised access by putting it in a virtual network or creating rules to only accept connections from Azure AD Application Proxy.</p>
  
  <h2>Used managed ML Flow in Azure</h2>
  
  <p>There is also the potential of using MLFlow that is part of <a href="https://docs.azuredatabricks.net/" rel="nofollow noreferrer">Azure Databricks</a>, which probably also includes authentication.</p>
  
  <h2>Nginx</h2>
  
  <p>There are <a href="https://www.nginx.com/blog/conditional-access-control-with-microsoft-azure-active-directory/" rel="nofollow noreferrer">complete instructions</a> on setting this up on the Nginx for a generic application. In summary, however, you will need to:</p>
  
  <ul>
  <li>configure Nginx as a reverse proxy</li>
  <li>prevent access to MLFlow from anything other than Nginx</li>
  <li>create an application in Azure Active Directory for Nginx</li>
  <li>configure Nginx to look for the JWT token and validate it</li>
  </ul>
  
  <p>You would also be able to use other products such as <a href="https://cloud.google.com/iap/" rel="nofollow noreferrer">Google's Identity Aware Proxy</a> and <a href="https://www.forgerock.com/platform/identity-gateway" rel="nofollow noreferrer">ForgeRock's Identity Gateway</a>.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-10-23T09:51:35.527Z
Answers: 2019-10-23T09:51:35.527Z
Answers: Richard Slater
Body: <p>What are the ways to get authorized access to mlflow through Azure Active Directory?</p>
  
  <p>Requirements:</p>
  
  <ul>
  <li>I need to grant access to the mlflow web interface installed on a Ubuntu 16 Virtual Machine in Azure cloud to only allow authorized users.</li>
  <li>Granting access will be done through group membership in Azure Active Directory.</li>
  </ul>
  
Tags: <azure><active-directory>
Title: What are the ways to get authorized access to mlflow through Azure Active Directory?
UserDisplayName: stackuser
ThreadText: # What are the ways to get authorized access to mlflow through Azure Active Directory?
  
  (Asked by: username_0 on 2019-10-22)
  
  What are the ways to get authorized access to mlflow through Azure Active Directory?
  
  Requirements:
  
  * I need to grant access to the mlflow web interface installed on a Ubuntu 16 Virtual Machine in Azure cloud to only allow authorized users.
  * Granting access will be done through group membership in Azure Active Directory.
  
  **Tags:** azure, active-directory
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-10-23. Score: 0
  
  It looks like MLFlow doesn't natively support any authentication schemes and [the recommendation](https://groups.google.com/forum/#!topic/mlflow-users/E9QW4HdS8a8) is to use a reverse proxy such as Nginx to only forward requests to MLFlow if a valid authentication cookie is provided, redirecting any requests without a cookie or an invalid cookie back to the Identity Provider.
  
  ## Azure AD Application Proxy
  
  You can [configure Azure AD Application Proxy](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy) to add authentication, although you will also need to protect MLFlow from unauthorised access by putting it in a virtual network or creating rules to only accept connections from Azure AD Application Proxy.
  
  ## Used managed ML Flow in Azure
  
  There is also the potential of using MLFlow that is part of [Azure Databricks](https://docs.azuredatabricks.net/), which probably also includes authentication.
  
  ## Nginx
  
  There are [complete instructions](https://www.nginx.com/blog/conditional-access-control-with-microsoft-azure-active-directory/) on setting this up on the Nginx for a generic application. In summary, however, you will need to:
  
  * configure Nginx as a reverse proxy
  * prevent access to MLFlow from anything other than Nginx
  * create an application in Azure Active Directory for Nginx
  * configure Nginx to look for the JWT token and validate it
  
  You would also be able to use other products such as [Google's Identity Aware Proxy](https://cloud.google.com/iap/) and [ForgeRock's Identity Gateway](https://www.forgerock.com/platform/identity-gateway).
  
  
  ---
  
  