OAuth providers¶

The OAuth Providers system enables the OAuth2 workflow, allowing DataRobot users to grant the system permissions to access their external resources directly within DataRobot.

The currently supported OAuth providers:

• Github Cloud
• GitLab
• Bitbucket Cloud
• Google
• Box
• Microsoft

Configure OAuth providers¶

To fully leverage the OAuth Providers functionality, you need to set up corresponding OAuth apps in the provider site and integrate the app with DataRobot:

GitHub¶

1. Navigate to Settings → Developer Settings → GitHub Apps.

2. Fill out the register new GitHub App form:

   Field	Value
   GitHub App name	DataRobot x {YOUR_ORG_NAME} (could be anything, but should be unique)
   Description	DataRobot GitHub App to authorize DataRobot to authenticate to the user's Git provider on their behalf. Could be anything, but it's shown to the end users, so make it clear what the app does for them.
   Homepage URL	{DATAROBOT_BASE_URL}
   Callback URL	{DATAROBOT_BASE_URL}/account/oauth-providers/ (with the trailing slash)
   Expire user authorization tokens	Checked
   Request user authorization (OAuth) during installation	Checked
   Webhook > Active	Unchecked
   Permissions > Repository permissions > Contents	Read & Write
   Permissions > Repository permissions > Metadata	Read-only
   Permissions > Repository permissions > Workflows	Read & Write
   Permissions > Organization permissions > Members	Read-only
   Permissions > Account permissions > Email addresses	Read-only
   Permissions > Account permissions > Profile	Read & Write
   Where can this GitHub App be installed?	Any account

3. Create a new GitHub App with this information.

4. Generate a new private key and save it securely. Then, go to the top of the form and generate a Client Secret. The secret should also be saved securely.

5. Copy the following information to configure the DataRobot installation. The Client ID and Client Secret should be set as corresponding values of the oauth-providers-service-oauth-github k8s secret:

data:
  OAUTH_PROVIDERS_GITHUB_CLIENT_ID: <base64 encoded Client Id>
  OAUTH_PROVIDERS_GITHUB_CLIENT_SECRET: <base64 encoded Client Secret>

 Mount the secret in the `oauth-providers-service` deployment:

oauth-providers-service:
  secrets:
    - name: "OAUTH_PROVIDERS_GITHUB_CLIENT_ID"
      valueFrom:
        secretKeyRef:
          name: "oauth-providers-service-oauth-github"
          key: OAUTH_PROVIDERS_GITHUB_CLIENT_ID
    - name: "OAUTH_PROVIDERS_GITHUB_CLIENT_SECRET"
      valueFrom:
        secretKeyRef:
          name: "oauth-providers-service-oauth-github"
          key: OAUTH_PROVIDERS_GITHUB_CLIENT_SECRET

Use the **Public Link** as `OAUTH_PROVIDERS_GITHUB_APP_PUBLIC_URL` config in `values.yaml`:

core:
  config_env_vars:
    OAUTH_PROVIDERS_GITHUB_APP_PUBLIC_URL: <Public Link>

GitLab¶

1. Navigate to User Settings → Applications

2. Fill out the Add new application form:

   Field	Value
   Name	DataRobot x {YOUR_ORG_NAME}
   Redirect URI	{DATAROBOT_BASE_URL}/account/oauth-providers/ (include the trailing slash)
   Confidential	Checked
   Scopes: api	Checked
   Scopes: read_user	Checked
   Scopes: read_repository	Checked
   Scopes: write_repository	Checked

3. Save configurations as a new application.

4. Copy the following information to configure the DataRobot installation. The Application ID and Secret should be set as corresponding values of the oauth-providers-service-oauth-gitlab k8s secret:

data:
  OAUTH_PROVIDERS_GITLAB_CLIENT_ID: <base64 encoded Application ID>
  OAUTH_PROVIDERS_GITLAB_CLIENT_SECRET: <base64 encoded Secret>

Mount the secret in the oauth-providers-service deployment:

oauth-providers-service:
  secrets:
    - name: "OAUTH_PROVIDERS_GITLAB_CLIENT_ID"
      valueFrom:
        secretKeyRef:
          name: "oauth-providers-service-oauth-gitlab"
          key: OAUTH_PROVIDERS_GITLAB_CLIENT_ID
    - name: "OAUTH_PROVIDERS_GITLAB_CLIENT_SECRET"
      valueFrom:
        secretKeyRef:
          name: "oauth-providers-service-oauth-gitlab"
          key: OAUTH_PROVIDERS_GITLAB_CLIENT_SECRET

If you are adding a GitLab Enterprise OAuth Provider you will need to pass your base URL (shown in the example chart update using https://my-example.net):

oauth-providers-service:
  config_env_vars:
    OAUTH_PROVIDERS_GITLAB_BASE_URL: "https://my-example.net"

Be sure to also update notebooks charts where needed - instructions seen here.

Bitbucket¶

1. Navigate to Workspace Settings → OAuth consumers

2. Fill out the Add OAuth consumer form:

   Field	Value
   Name	DataRobot x {YOUR_ORG_NAME} (but could be anything)
   Description	DataRobot OAuth App to authorize DataRobot to authenticate to the user's Git provider on their behalf. Could be anything, but it's shown to the end users, so make it clear what the app does for them.
   Callback URL	{DATAROBOT_BASE_URL}/account/oauth-providers/ (with the trailing slash)
   URL	https://www.datarobot.com/
   Privacy policy URL	https://www.datarobot.com/privacy/ (optional)
   End user license agreement URL	https://www.datarobot.com/legal/ (optional)
   This is a private consumer	Unchecked
   Permissions > Account	Read, Email
   Permissions > Repositories	Read, Write, Admin, Delete

3. Save the configuration as a new Bitbucket OAuth app.

4. Copy the following information to configure the DataRobot installation. Set the Client ID and Client Secret as corresponding values of the oauth-providers-service-oauth-bitbucket k8s secret:

data:
  OAUTH_PROVIDERS_BITBUCKET_CLIENT_ID: <base64 encoded Client ID>
  OAUTH_PROVIDERS_BITBUCKET_CLIENT_SECRET: <base64 encoded Client Secret>

Mount the secret in the oauth-providers-service deployment:

oauth-providers-service:
  secrets:
    - name: "OAUTH_PROVIDERS_BITBUCKET_CLIENT_ID"
      valueFrom:
        secretKeyRef:
          name: "oauth-providers-service-oauth-bitbucket"
          key: OAUTH_PROVIDERS_BITBUCKET_CLIENT_ID
    - name: "OAUTH_PROVIDERS_BITBUCKET_CLIENT_SECRET"
      valueFrom:
        secretKeyRef:
          name: "oauth-providers-service-oauth-bitbucket"
          key: OAUTH_PROVIDERS_BITBUCKET_CLIENT_SECRET

Box¶

Reference article: Managing platform apps

1. Navigate to the Box Developer Console.

2. On the My Platform Apps page, press the Create Platform App button.

3. Select Custom App.

4. Fill out the form with the following data:

   Field	Value
   Name	DataRobot x {YOUR_ORG_NAME} (but could be anything)
   Description	DataRobot OAuth App to authorize DataRobot to access files on behalf of users. This can be anything, but it's displayed to end users, so ensure it clearly explains the app's purpose.
   Purpose	Integration
   Categories	Box Sign
   Which external system are you integrating with?	DataRobot

Press the Next button.

1. Select User Authentication (OAuth 2.0) and press the Create App button.

   !!! note (Optional) If you are setting up a self-managed version of the provider, go to the DataRobot Application OAuth Provider Management → + Add OAuth Provider and fill out the form with data from the OAuth 2.0 Credentials section on the app configuration page in the Box Developer Console.

2. In the app configuration, go to the OAuth 2.0 Redirect URIs section and add {DATAROBOT_BASE_URL}/account/oauth-providers/?providerId=<PROVIDER ID> to the Redirect URI field, then press the Add button. The provider ID can be found on the DataRobot Application OAuth Provider Management page.

3. In the Application Scopes section, select Read all files and folders stored in Box.

4. Save the settings by clicking the Save button.

5. (Only for system-level applications) Copy the following information to configure the DataRobot installation. Set the Client ID and Client Secret as corresponding values of the oauth-providers-service-oauth-box Kubernetes secret:

data:
  OAUTH_PROVIDERS_BOX_CLIENT_ID: <base64 encoded Client ID>
  OAUTH_PROVIDERS_BOX_CLIENT_SECRET: <base64 encoded Client Secret>

Mount the secret into the oauth-providers-service deployment:

secrets:
  - name: "OAUTH_PROVIDERS_BOX_CLIENT_ID"
    valueFrom:
      secretKeyRef:
        name: "oauth-providers-service-oauth-box"
        key: OAUTH_PROVIDERS_BOX_CLIENT_ID
  - name: "OAUTH_PROVIDERS_BOX_CLIENT_SECRET"
    valueFrom:
      secretKeyRef:
        name: "oauth-providers-service-oauth-box"
        key: OAUTH_PROVIDERS_BOX_CLIENT_SECRET

Google¶

Reference article: Using OAuth 2.0 to Access Google APIs

1. Navigate to the Credentials page of your Google Cloud project.
2. Press the Create credentials button and select OAuth client ID.
3. Fill out the creation form: | Field | Value | | --- | --- | | Application Type | Web application | | Name | DataRobot x {YOUR_ORG_NAME} | | Authorized JavaScript Origins | {DATAROBOT_BASE_URL} | | Authorized Redirect URIs | Skip this field for now. Press the Create button. |

4. Save the Client ID and Client Secret from the popup dialog. You are no longer able to view or download the client secret once you close this dialog.

   !!! note (Optional) If you are setting up a self-managed version of the provider, go to the DataRobot Application OAuth Provider Management → + Add OAuth Provider and fill out the form with data from the previous step.

5. Go to the application settings page in the Google Cloud Console. Find the Authorized redirect URIs section and add {DATAROBOT_BASE_URL}/account/oauth-providers/?providerId=<PROVIDER ID> to the list. The provider ID can be found on the DataRobot Application OAuth Provider Management page.

6. (Only for system-level applications) Copy the following information to configure the DataRobot installation. Set the Client ID and Client Secret as corresponding values of the oauth-providers-service-oauth-google Kubernetes secret:

data:
  OAUTH_PROVIDERS_GOOGLE_CLIENT_ID: <base64 encoded Client ID>
  OAUTH_PROVIDERS_GOOGLE_CLIENT_SECRET: <base64 encoded Client Secret>

Mount the secret into the oauth-providers-service deployment:

secrets:
  - name: "OAUTH_PROVIDERS_GOOGLE_CLIENT_ID"
    valueFrom:
      secretKeyRef:
        name: "oauth-providers-service-oauth-google"
        key: OAUTH_PROVIDERS_GOOGLE_CLIENT_ID
  - name: "OAUTH_PROVIDERS_GOOGLE_CLIENT_SECRET"
    valueFrom:
      secretKeyRef:
        name: "oauth-providers-service-oauth-google"
        key: OAUTH_PROVIDERS_GOOGLE_CLIENT_SECRET

Microsoft¶

Reference article: Register an application in Microsoft Entra ID

1. Navigate to the Microsoft Entra ID App Registrations and click New registration.

2. Fill out the registration form: | Field | Value | | --- | --- | | Name | DataRobot x {YOUR_ORG_NAME} | | Supported account types | Accounts in any organizational directory (any Microsoft Entra ID tenant - Multitenant) | | Redirect URI | Leave this field empty for now. |

3. Click Register to create the application.

4. On the new application control screen, copy and save the Application (client) ID value. This is needed later as CLIENT_ID.

5. On the application control screen, go to the Certificates & secrets section, create a new client secret, and copy its value. This is needed later as CLIENT_SECRET.

   !!! note

    (Optional) If you are setting up a self-managed version of the provider, go to the DataRobot Application *OAuth Provider Management* → *+ Add OAuth Provider* and fill out the form with the data from the previous step.
   

6. Go to the application settings page, navigate to the Authentication (Preview) section, and click the Add Redirect URI button.

7. Select "Web" as the platform and add {DATAROBOT_BASE_URL}/account/oauth-providers/?providerId=<PROVIDER ID> to the Redirect URI field. Leave other fields empty and click the Configure button.

8. (Only for system-level applications) Copy the following information to configure the DataRobot installation. Set the Client ID and Client Secret as corresponding values (steps 4 and 5) of the oauth-providers-service-oauth-microsoft Kubernetes secret:

data:
  OAUTH_PROVIDERS_MICROSOFT_CLIENT_ID: <base64 encoded Client ID>
  OAUTH_PROVIDERS_MICROSOFT_CLIENT_SECRET: <base64 encoded Client Secret>

Mount the secret into the oauth-providers-service deployment:

secrets:
  - name: "OAUTH_PROVIDERS_MICROSOFT_CLIENT_ID"
    valueFrom:
      secretKeyRef:
        name: "oauth-providers-service-oauth-microsoft"
        key: OAUTH_PROVIDERS_MICROSOFT_CLIENT_ID
  - name: "OAUTH_PROVIDERS_MICROSOFT_CLIENT_SECRET"
    valueFrom:
      secretKeyRef:
        name: "oauth-providers-service-oauth-microsoft"
        key: OAUTH_PROVIDERS_MICROSOFT_CLIENT_SECRET