feat(BA-524): Deprecate X-BackendAI-SSO header for pipeline service authentication

changes/3353.feature.md

@@ -0,0 +1 @@
+Deprecate the JWT-based `X-BackendAI-SSO` header to reduce complexity in authentication process for the pipeline service

configs/webserver/halfstack.conf

@@ -35,7 +35,6 @@ max_file_upload_size = 4294967296
 [pipeline]
 endpoint = "http://127.0.0.1:9500"
 frontend-endpoint = "http://127.0.0.1:3000"
-jwt.secret = "7<:~[X,^Z1XM!*,Pe:PHR!bv,H~Q#l177<7gf_XHD6.<*<.t<[o|V5W(=0x:jTh-"
 
 [ui]
 brand = "Lablup Cloud"

configs/webserver/sample.conf

@@ -111,8 +111,6 @@ show_non_installed_images = false
 #endpoint = "http://127.0.0.1:9500"
 # Endpoint to the pipeline service's frontend
 #frontend-endpoint = "http://127.0.0.1:3000"
-# A secret to sign JWTs used to authenticate users from the pipeline service
-#jwt.secret = "7<:~[X,^Z1XM!*,Pe:PHR!bv,H~Q#l177<7gf_XHD6.<*<.t<[o|V5W(=0x:jTh-"
 
 [ui]
 brand = "Lablup Cloud"

src/ai/backend/web/config.py

@@ -96,13 +96,6 @@
         {
             t.Key("endpoint", default=_config_defaults["pipeline"]["endpoint"]): tx.URL,
             t.Key("frontend-endpoint", default=None): t.Null | tx.URL,
-            t.Key("jwt", default=_config_defaults["pipeline"]["jwt"]): t.Dict(
-                {
-                    t.Key(
-                        "secret", default=_config_defaults["pipeline"]["jwt"]["secret"]
-                    ): t.String,
-                },
-            ).allow_extra("*"),
         },
     ).allow_extra("*"),
     t.Key("ui"): t.Dict({

src/ai/backend/web/proxy.py

@@ -5,11 +5,9 @@
 import json
 import logging
 import random
-from datetime import datetime, timedelta
 from typing import Optional, Tuple, Union, cast
 
 import aiohttp
-import jwt
 from aiohttp import web
 from Crypto.Cipher import AES
 from Crypto.Util.Padding import unpad
@@ -164,7 +162,10 @@ async def web_handler(request: web.Request, *, is_anonymous=False) -> web.Stream
             raise RuntimeError("'pipeline' config must be set to handle pipeline requests.")
         endpoint = pipeline_config["endpoint"]
         log.info(f"WEB_HANDLER: {request.path} -> {endpoint}/{real_path}")
-        api_session = await asyncio.shield(get_api_session(request, endpoint))
+        if real_path.rstrip("/") == "login":
+            api_session = await asyncio.shield(get_api_session(request, endpoint))
+        else:
+            api_session = await asyncio.shield(get_anonymous_session(request, endpoint))
     elif is_anonymous:
         api_session = await asyncio.shield(get_anonymous_session(request))
     else:
@@ -207,23 +208,10 @@ async def web_handler(request: web.Request, *, is_anonymous=False) -> web.Stream
             for hdr in HTTP_HEADERS_TO_FORWARD:
                 if request.headers.get(hdr) is not None:
                     api_rqst.headers[hdr] = request.headers[hdr]
-            if proxy_path == "pipeline":
-                session_id = request.headers.get("X-BackendAI-SessionID", "")
-                if not (sso_token := request.headers.get("X-BackendAI-SSO")):
-                    jwt_secret = config["pipeline"]["jwt"]["secret"]
-                    now = datetime.now().astimezone()
-                    payload = {
-                        # Registered claims
-                        "exp": now + timedelta(seconds=config["session"]["max_age"]),
-                        "iss": "Backend.AI Webserver",
-                        "iat": now,
-                        # Private claims
-                        "aiohttp_session": session_id,
-                        "access_key": api_session.config.access_key,  # since 23.03.10
-                    }
-                    sso_token = jwt.encode(payload, key=jwt_secret, algorithm="HS256")
-                api_rqst.headers["X-BackendAI-SSO"] = sso_token
-                api_rqst.headers["X-BackendAI-SessionID"] = session_id
+            if proxy_path == "pipeline" and real_path.rstrip("/") == "login":
+                api_rqst.headers["X-BackendAI-SessionID"] = request.headers.get(
+                    "X-BackendAI-SessionID", ""
+                )
             # Uploading request body happens at the entering of the block,
             # and downloading response body happens in the read loop inside.
             async with api_rqst.fetch() as up_resp: