<p>It looks like MLFlow doesn't natively support any authentication schemes and <a href="https://groups.google.com/forum/#!topic/mlflow-users/E9QW4HdS8a8" rel="nofollow noreferrer">the recommendation</a> is to use a reverse proxy such as Nginx to only forward requests to MLFlow if a valid authentication cookie is provided, redirecting any requests without a cookie or an invalid cookie back to the Identity Provider.</p>

<h2>Azure AD Application Proxy</h2>

<p>You can <a href="https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy" rel="nofollow noreferrer">configure Azure AD Application Proxy</a> to add authentication, although you will also need to protect MLFlow from unauthorised access by putting it in a virtual network or creating rules to only accept connections from Azure AD Application Proxy.</p>

<h2>Used managed ML Flow in Azure</h2>

<p>There is also the potential of using MLFlow that is part of <a href="https://docs.azuredatabricks.net/" rel="nofollow noreferrer">Azure Databricks</a>, which probably also includes authentication.</p>

<h2>Nginx</h2>

<p>There are <a href="https://www.nginx.com/blog/conditional-access-control-with-microsoft-azure-active-directory/" rel="nofollow noreferrer">complete instructions</a> on setting this up on the Nginx for a generic application. In summary, however, you will need to:</p>

<ul>
<li>configure Nginx as a reverse proxy</li>
<li>prevent access to MLFlow from anything other than Nginx</li>
<li>create an application in Azure Active Directory for Nginx</li>
<li>configure Nginx to look for the JWT token and validate it</li>
</ul>

<p>You would also be able to use other products such as <a href="https://cloud.google.com/iap/" rel="nofollow noreferrer">Google's Identity Aware Proxy</a> and <a href="https://www.forgerock.com/platform/identity-gateway" rel="nofollow noreferrer">ForgeRock's Identity Gateway</a>.</p>

CC BY-SA 4.0
2019-10-23T09:51:35.527Z
2019-10-23T09:51:35.527Z
Richard Slater
<p>What are the ways to get authorized access to mlflow through Azure Active Directory?</p>

<p>Requirements:</p>

<ul>
<li>I need to grant access to the mlflow web interface installed on a Ubuntu 16 Virtual Machine in Azure cloud to only allow authorized users.</li>
<li>Granting access will be done through group membership in Azure Active Directory.</li>
</ul>

<azure><active-directory>
What are the ways to get authorized access to mlflow through Azure Active Directory?
stackuser
# What are the ways to get authorized access to mlflow through Azure Active Directory?

(Asked by: username_0 on 2019-10-22)

What are the ways to get authorized access to mlflow through Azure Active Directory?

Requirements:

* I need to grant access to the mlflow web interface installed on a Ubuntu 16 Virtual Machine in Azure cloud to only allow authorized users.
* Granting access will be done through group membership in Azure Active Directory.

**Tags:** azure, active-directory


---

## 1 answers

### Answer by username_1 on 2019-10-23. Score: 0

It looks like MLFlow doesn't natively support any authentication schemes and [the recommendation](https://groups.google.com/forum/#!topic/mlflow-users/E9QW4HdS8a8) is to use a reverse proxy such as Nginx to only forward requests to MLFlow if a valid authentication cookie is provided, redirecting any requests without a cookie or an invalid cookie back to the Identity Provider.

## Azure AD Application Proxy

You can [configure Azure AD Application Proxy](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy) to add authentication, although you will also need to protect MLFlow from unauthorised access by putting it in a virtual network or creating rules to only accept connections from Azure AD Application Proxy.

## Used managed ML Flow in Azure

There is also the potential of using MLFlow that is part of [Azure Databricks](https://docs.azuredatabricks.net/), which probably also includes authentication.

## Nginx

There are [complete instructions](https://www.nginx.com/blog/conditional-access-control-with-microsoft-azure-active-directory/) on setting this up on the Nginx for a generic application. In summary, however, you will need to:

* configure Nginx as a reverse proxy
* prevent access to MLFlow from anything other than Nginx
* create an application in Azure Active Directory for Nginx
* configure Nginx to look for the JWT token and validate it

You would also be able to use other products such as [Google's Identity Aware Proxy](https://cloud.google.com/iap/) and [ForgeRock's Identity Gateway](https://www.forgerock.com/platform/identity-gateway).


---

