Hi All, we are doing PoC for Prefect Core Server in our firm and were looking at putting Prefect Core server behind NGINX so that NGINX can do Authentication and Authorisation which looks all good but I was not sure how can I control the UI feature to stop people who are not authorise to restart task or change the state (may be by disabling the restart button or so based on some config), thanks.

Hi @Vipul - this isn't achievable from the UI as you've described it because as an SPA, the UI doesn't have any concept of authorization/authentication in Server. This is one the implementation details that Prefect Cloud takes care of, allowing you to provision users, machine tokens, and permissions to access certain actions in the UI and elsewhere implicitly.

Thanks @nicholas for quick reply. Is there a way to control this in Apollo if not in UI. I understand this implementation is built in Prefect Cloud but that is going to challenge to get it approved from our firm Cloud Governance

Hi @Vipul - unfortunately not - that would require an explicit implementation of auth, which is something we've made the deliberate choice not to support in the open source. We're of the opinion that any implementation of auth in the open source would inevitably 1) give a false sense of security or 2) serve an extremely narrow and opinionated auth use case. Instead, we've chosen to focus our security resources on a robust solution in Prefect Cloud. That said, you mention that it would be a challenge to get Prefect Cloud approved through your Cloud Governance - is there any reason why? We're always looking for ways we can either shore up security concerns or better communicate places where we already have.

Thanks @nicholas. So far what I have understood is that they don't want anything outside the firm vpn and since Prefect Cloud is completely manage by Prefect team there is strong resistance. Though as we are trying to push this and I will update as soon as if I hear more from them...

Hi @Vipul - we encounter these questions quite often and if it's helpful can have one of our solutions and account folks chat with you and your Cloud Governance team to see if there's a fit that could work

Hey @nicholas the governance team is strongly against anything that is outside the firm vpn but we did like Prefect Server and wanted to explore the possibility of Prefect Cloud hosted on the firm vpn. If there is such possibility than I would like to go back to management with this option

Hi @Vipul - this is definitely an option. To explore that, I can put you in touch with an account manager and they can walk you through the details?

Thanks Nicholas. I will speak with my regional manager and pass on detail as he is the one who is going to discuss that further

Sounds good Vipul - feel free to DM me or reply to this thread when you're ready to chat further 🙂

Sure

Understood 👍

Thanks, I will speak with my manager and come back to you

Sounds good!