Configure authentication and configure an identity provider on Astronomer Software

An auth system determines how users can log in to Astronomer Software. By default, Astronomer Software allows users to create an account and authenticate using one of the following methods:

• Google OAuth
• GitHub OAuth
• Local username/password

Integrating an external identity provider (IdP) greatly increases the security of your platform. When you integrate your IdP into Astronomer Software:

• Users no longer need to repeatedly login and remember credentials for their account.
• You have complete ownership over credential configuration and management on Astro.
• You can enforce multi-factor authentication (MFA) for users.

In addition to the default methods, Astronomer provides the option to integrate any IdP that follows the Open Id Connect (OIDC) protocol. This includes (but is not limited to):

• Microsoft Entra ID
• Okta
• IdPs managed through Auth0
• Amazon Cognito

After you integrate your IdP, you can invite users that already have an account on your IdP to Astronomer Software. For a more advanced integration, you can configure SCIM so that you can manage users directly from your IdP and import batches of users into Astronomer Software as Teams.

1
# Required configuration for all secrets
2
kind: Secret
3
apiVersion: v1
4
metadata:
5
     name: oauth-client-secret
6
type: Opaque
7
# Specify a key and value for the data you want to encrypt
8
data:
9
    client_secret:  "<encoded-client-secret-value>"

1
astronomer:
2
  houston:
3
    # Add/extend astronomer.houston.secret section if using IDP Group Sync
4
    #secret:
5
    #  - envName: "AUTH__OPENID_CONNECT__MICROSOFT__CLIENT_SECRET"
6
    #    secretName: "oauth-client-secret"
7
    #    secretKey: "client_secret"
8
    config:
9
      auth:
10
        openidConnect:
11
          flow: "code"
12
          google:
13
            enabled: false
14
          microsoft:
15
            enabled: true
16
            clientId: <your-client-id>
17
            discoveryUrl: https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration
18
            baseDomain: login.microsoftonline.com
19
            authUrlParams:
20
              audience: <your-client-id>
21
        github:
22
          enabled: false

Running behind an HTTPS proxy

Integrating an external identity provider with Astronomer requires that the platform’s Houston API component is able to make outbound HTTPS requests to those identity providers in order to fetch discovery documents, sign keys, and ask for user profile information upon login/signup.

If your install is configured without a direct connection to the internet you will need to configure an HTTPS proxy server for Houston.

Configure an HTTPS proxy server for Houston

To configure the proxy server used we need to set the GLOBAL_AGENT_HTTPS_PROXY Environment Variable for the Houston deployment.

To do so, add the following to the Houston section of the values.yaml file in your astronomer directory:

1
astronomer:
2
  houston:
3
    config:
4
      auth:
5
        openidConnect:
6
          custom:
7
            enabled: true
8
            displayName: My Oauth Provider
9
            clientId: ...
10
            discoveryUrl: ...
11
    env:
12
      - name: GLOBAL_AGENT_HTTPS_PROXY
13
        value: http://my-proxy:3129

Then, push the configuration change to your platform as described in Apply a config change.

Configure a custom OAuth flow

Starting with Astronomer v0.27, you can set up a custom OAuth authorization flow as an alternative to Astronomer’s default implicit flow. You can customize Astronomer’s existing Okta, Google, and GitHub OAuth flows or import an entirely custom OAuth flow.

Step 1: Configure your authorization flow on Astronomer

To use a custom Oauth authorization code flow:

1. In your values.yaml file, set the astronomer.houston.config.auth.openidConnect.flow value to "code":

   1
   astronomer:
   2
     houston:
   3
       config:
   4
         auth:
   5
           # Local database (user/pass) configuration.
   6
           local:
   7
             enabled: true
   8
           openidConnect:
   9
             # Valid values are "code" and "implicit"
   10
             flow: "code"

2. Configure the section of your values.yaml file specific to your identity provider with each of the following values:

   • enabled: Set this value to true under the section for your own identity provider.
   • clientId: Your Client ID and Client secret
   • discoveryURL: Your base Discovery URL
   • authUrlParams: Additional parameters to append to your discovery URL. At a minimum, you must configure audience. Refer to your identity provider’s documentation for information on how to find this value (Auth0 maintains this information in their glossary, for example).

   For example, a custom configuration of Okta might look like the following.

   1
   astronomer:
   2
     houston:
   3
       secret:
   4
         - envName: "AUTH__OPENID_CONNECT__OKTA__CLIENT_SECRET"
   5
           secretName: "oauth-client-secret"
   6
           secretKey: "client_secret"
   7
       config:
   8
         auth:
   9
           okta:
   10
             enabled: true
   11
             clientId: ffhsdf78f734h2fsd
   12
             discoveryUrl: "https://<your-idp-url>.okta.com/oauth2/default/.well-known/openid-configuration"
   13
             authUrlParams:
   14
               audience: "GYHWEYHTHR443fFEW"
   1. Push your configuration changes to your platform as described in Apply a config change.

Step 2: Configure your identity provider

To finalize your configuration, configure the following key values in your identity provider’s settings:

• Grant Code: Set to “Code” or “Auth Code” depending on your identity provider.
• Sign-in Redirect URI: Set to https://houston.<BASE_DOMAIN>/v1/oauth/callback/. Be sure to include the trailing /.

Step 3: Confirm your installation

When you complete this setup, you should be able to see the differences in login flow when logging in at <BASE_DOMAIN>.astronomer.io.

If you configured a fully custom OAuth flow, you should see a new Log in with Custom Oauth button on the Astronomer login screen:

You can see the name you configured in AUTH__OPENID_CONNECT__CUSTOM__DISPLAY_NAME when authenticating using the Astro CLI.

Manage users and Teams with SCIM

Astronomer Software supports integration with the open standard System for Cross-Domain Identity Management (SCIM). Using the SCIM protocol with Astronomer Software allows you to automatically provision and deprovision users and Teams based on templates that define permission and accesses. It also centralizes user management so that you can configure Astronomer user permissions directly from your identity provider (IdP).