Tensorboard: authentication and authorization support

[anfeng]

Is there any plan to introduce authentication and authorization support into TensorBoard?
Some simple examples of authorization,

• Only users belong to a white list could access this TB server.
• Client must within a particular network sub-domain.

[jart]

Yes indeed. We're planning to build a TensorBoard service with a new scalable storage layer. It will be multi-tenant with ACLs and all that good stuff. See https://github.com/tensorflow/tensorboard/issues/92

[kcgthb]

Mmmh, so now that #92 has been closed because it's "too ambitious", what's the plan to enable authentication?

The lack of any kind of authentication/authorization mechanism makes Tensorboard pretty much unusable outside of a developer laptop. It can't be reasonably used on any shared, multi-tenant environment.

[nfelt]

We don't have any near-term plans to add auth mechanisms directly to TensorBoard, but it's possible today to run TensorBoard behind an authenticating reverse proxy like nginx, or since it's a WSGI app under the hood, run a slightly modified TensorBoard with some WSGI auth middleware.

Putting auth directly in TensorBoard would mean taking on a significant extra responsibility (since it's something that would be crucial to get right) and it would be very challenging to build something that would satisfy all use cases, even for example supporting authentication mechanisms for web (e.g. openID) vs offline/private (e.g. dedicated username/pw stored in TensorBoard or something like LDAP) requires substantially different work. So I suspect that even if we continue with various parts of #92, we would be more likely to support auth via the underlying server platform rather than directly inside TensorBoard.

[jdhayes]

How about just a long hash at the end of the URL for a uniqe address, similar to what jupyter-lab does?
This would at least allow HPC facilities to support this software. Using an nginx would not be practical in a shared environment where compute nodes have several users on them at a time.

[yoshipon]

Hi @jdhayes, I just found that you can manually set a unique address with --path_prefix option.
How about launching TensorBoard with tensorboard --path_prefix /$(openssl rand -hex 24)

I'm not sure this is secure enough.

Edit: I found the above command is insecure because you can find the hash by ps aux.