Repository navigation
Account page: use MIP from your own computer with a Keycloak token - #53
Open
KFilippopolitis wants to merge 2 commits into
Open
KFilippopolitis wants to merge 2 commits into
KFilippopolitis wants to merge 2 commits into
Conversation
This was referenced Oct 23, 2026
The "Use MIP from your own computer" guide now shows only when /services/auth-config names the federation's public Keycloak client, and no longer sends users to the JupyterHub token page. "Create access token" runs an authorization-code sign-in with PKCE as that client (offline_access, in cli-token.ts), takes the one-time code out of the address bar, and shows the token once for `mip login --token` or MIP_API_TOKEN; nothing stores it. The setup snippet only installs the client and sets MIP_URL; the two ways to sign in (access token, `mip login`) sit side by side in cards, and the guide says a sign-in lasts at most 6 months, ends after 30 days without use, and links to the Keycloak account page where it can be ended everywhere.
KFilippopolitis
force-pushed
the
feat/remote-api-token
branch
from
October 23, 2026 14:31
548c106 to
cecae02
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The account page gets a "Use MIP from your own computer" section for the
mipPython client:GET /services/auth-configanswers, i.e. when the federation's backend names a public Keycloak client (KEYCLOAK_CLI_CLIENT_ID). Otherwise the section stays hidden.S256,scope=openid offline_access, redirect back to/account). The page exchanges the one-time code, removes it from the address bar, and shows the resulting long-lived token once. Nothing stores it. Users paste it intomip login --tokenor setMIP_API_TOKEN. This works for servers and scripts without a browser.mip login, the device flow, for computers with a browser.Code:
src/app/pages/account-page/(cli-token.tsfor the PKCE sign-in, plus the component), anddocs/llm-wiki/08-auth-and-terms-flow.md.Why
Users and scripts outside the hosted notebook need MIP access for 30+ days without depending on JupyterHub. Keycloak stays the only identity provider, and the mip client renews short-lived access tokens itself.
Related
/auth-config, and Bearer tokens accepted only from the federation's own clients)mip login,--token,MIP_API_TOKEN, docs)keycloak.cliClientIdin themipchart (PR to follow)Tests
npx ng test --watch=false: 67 files, 909 tests pass.notebook.component.spec.tsis untouched by this branch and occasionally fails when its iframe navigates to the hub login.npx ng build: succeeds; the two existing warnings (algorithm-panel CSS budget, jszip) are unrelated.federation-handsonwith the clientmip-cli-handson: token created on the account page, then used throughMIP_API_TOKENto read data models; revoked afterwards.Config
No new UI variables. The feature appears once the backend sets
KEYCLOAK_CLI_CLIENT_ID; the Keycloak client needs redirect URIhttps://<portal>/accountand web originhttps://<portal>.