Fashionable AI platforms are now not a single software behind one login display screen. A person might begin in a central portal, open a ruled dataset, launch a pocket book the place that knowledge resides, and invoke an assistant that calls companies in one other cluster. The workflow feels unified, however identification crosses control-plane and data-plane boundaries at each step. That’s the place typical single sign-on (SSO) stops being sufficient.
SSO proves the person on the entrance door. Platform groups who handle a federated knowledge or AI platform throughout a number of clusters nonetheless want a dependable solution to carry that person context into distributed execution environments with out handing uncooked tokens to each software, weakening revocation, or forcing every cluster to reimplement identity-provider logic.
This problem is particularly necessary for AI and knowledge platforms, the place knowledge and compute typically keep near the place they’re produced, saved, or ruled. Workloads might run in regional clusters, separate cloud accounts, on-premises environments, or specialised execution planes. Customers nonetheless anticipate one platform expertise throughout notebooks, catalogs, question instruments, dashboards, and AI assistants.
This submit describes a central identification gateway sample for propagating person identification throughout these federated knowledge planes. A central gateway owns the platform session. Information-plane gateways validate that session by a shared API and convert it into trusted native identification context for downstream functions. The sample makes use of customary OpenID Join (OIDC), a shared session retailer, stateless data-plane gateways, and a small identity-validation API that companies can belief.
At NVIDIA, this method decreased repeated login occasions by 55% throughout inside developer platforms spanning Kubernetes clusters in AWS and OCI. Extra importantly, it created a reusable basis for unified platform shells, constant logout, decrease upstream identity-provider load, and AI assistants that may act with delegated person identification throughout knowledge planes.
The place SSO ends and data-plane identification begins
The implementation particulars will fluctuate by group, however the core design is broadly relevant to platform groups operating federated Kubernetes environments, multi-cloud knowledge platforms, machine studying workbenches, inside developer portals, or AI software stacks with a number of authenticated instruments. SSO provides customers one entry level.
Federated knowledge platforms nonetheless want a solution to carry identification into the planes the place work executes. A pocket book in a single cluster, a catalog API in one other, and an assistant calling a question engine in a 3rd all want the identical reply: Who’s the person, and what are they allowed to do right here?
And not using a shared identification propagation mannequin, a number of issues seem:
Management-plane authentication doesn’t mechanically develop into trusted data-plane identification
Uncooked token forwarding expands credential publicity and makes it more durable to motive about who can use which token the place
Every data-plane gateway might combine with the identification supplier otherwise, creating inconsistent claims, refresh conduct, and audit information
Logout and revocation might not propagate rapidly throughout each cluster or execution airplane
New functions inherit identification plumbing as a substitute of consuming a normal platform contract
For customers, the symptom might appear like repeated login prompts. For platform engineers, the deeper challenge is distributed token propagation: identification created on the management airplane should be remodeled into trusted, scoped, auditable context at every knowledge airplane.
That mannequin works for a small variety of functions, however it creates structural issues because the platform expands:
Classes are scoped to the place they have been created. A token issued by one gateway is unknown to a different, so customers authenticate per service as a substitute of per platform
Logout is native. Signing out of 1 software can go away lively periods elsewhere, creating each person confusion and safety threat
Token refresh is uncoordinated. Each gateway independently negotiates refresh cycles with the upstream identification supplier, growing load and creating divergent session states
Identification context is inconsistent. Downstream companies typically parse tokens otherwise or duplicate authentication logic
New companies inherit outdated complexity. Including one other software normally means rebuilding the identical auth integration once more
For platform customers, the signs are repeated login prompts and inconsistent conduct. For platform engineers, the deeper challenge is that session possession is distributed throughout parts that ought to solely be imposing entry, not proudly owning identification state.
Evaluating two identification patterns
There are two frequent methods to construction identification in a federated platform.
The primary sample is distributed session possession. Every service gateway owns its personal login movement, session retailer, token refresh logic, and logout conduct. This retains every cluster unbiased, however it additionally means the identification state doesn’t transfer cleanly throughout the platform.
The second sample is centralized session possession. A devoted identification gateway owns login, session state, refresh, and logout. Regional gateways stay in place, however they delegate session validation to the central identification gateway and deal with request enforcement.
Desk 1. Comparability of distributed and centralized session possession throughout login, logout, token refresh, identification propagation, and operational scaling.
Centralized session possession will not be required for each software. It turns into priceless when customers transfer throughout a number of instruments, clusters, or areas as a part of one workflow and anticipate these instruments to behave like a single platform.
The central identification gateway sample
The central identification gateway owns three duties:
Session creation: dealing with the OIDC authorization code movement and making a platform-wide session
Per-request identification validation: answering “who is that this person?” for any gateway or trusted service
Session lifecycle administration: coordinating token refresh and logout throughout the platform
Regional authentication gateways stay in place. They nonetheless implement per-cluster coverage, defend native companies, and inject identification into requests. What adjustments is the place periods stay.
As an alternative of storing periods inside every regional gateway, the central identification gateway writes each authenticated session to a shared retailer similar to Redis. The session is keyed by an opaque session ID and related to a safe, HTTP-only browser cookie scoped to the platform area.
On every request, a regional gateway calls an identity-validation endpoint similar to /gateway/userinfo. The central identification gateway checks the session retailer and returns trusted identification claims. The regional gateway then injects a standardized set of identification headers earlier than forwarding the request to the appliance.
Purposes now not must parse tokens, refresh credentials, or combine immediately with the identification supplier. They devour identification from a constant interface.
Request movement
The sample has three main flows: login, validation, and logout.
Login
When a person arrives and not using a legitimate platform session, the regional gateway redirects the browser to the central identification gateway. The central gateway runs the OIDC authorization code movement towards the group’s identification supplier, exchanges the authorization code server-side, shops the ensuing session in Redis with an outlined time-to-live, and units an HTTP-only session cookie.
That session cookie turns into the person’s platform credential for the remainder of the session.
Per-request validation
On subsequent requests, the regional gateway sends the session cookie to /gateway/userinfo. The central identification gateway performs a session lookup and returns identification claims similar to person ID, e mail, teams, roles, and session metadata.
The regional gateway makes use of these claims to inject trusted identification headers. Downstream companies learn the headers and apply native authorization logic the place wanted.
This retains the request path light-weight. A traditional request doesn’t require an OIDC alternate or a direct name to the identification supplier. It requires a session lookup and a trusted gateway-to-gateway validation name.
Token refresh and logout
When an entry token nears expiry, the central identification gateway refreshes it utilizing the saved refresh token and updates the session report. As a result of the refreshed state is written to the shared retailer, each regional gateway observes the identical session state.
For logout, the central identification gateway deletes the session report. On the following request, each regional gateway sees an invalid session and denies entry or redirects the person to login. Logout turns into rapid and platform-wide.
What builders can reuse
The precise infrastructure behind the NVIDIA implementation is inside, however the structure sample is transportable. Exterior platform groups can reuse the next items:
A single session proprietor for the platform
A minimal validation endpoint, similar to /gateway/userinfo
Stateless regional gateways that delegate validation
A shared session retailer with specific TTLs
Standardized identification claims or headers for downstream companies
A single logout path that invalidates the shared session
A migration mannequin that strikes one gateway or service at a time
The sample doesn’t require proprietary middleware. It may be applied with customary OIDC libraries, Redis or one other low-latency session retailer, and gateway integrations out there in frequent Kubernetes ingress or service-mesh environments.
Safety and reliability guardrails
Centralizing session possession simplifies the platform, however it additionally makes the identification gateway a important service. Groups adopting this sample ought to design for failure, belief boundaries, and auditability from the start.
Use safe service-to-service authentication between regional gateways and the central identification gateway. Mutual TLS, workload identification, or signed inside tokens can stop untrusted callers from utilizing the validation endpoint.
Strip inbound identification headers earlier than injecting trusted ones. Purposes ought to solely belief headers added by the gateway layer, not headers offered by a consumer request.
Retailer solely what the platform wants within the session report. Apply brief access-token lifetimes, specific session TTLs, refresh-token safety, encryption in transit, and applicable entry controls across the session retailer.
Outline failure conduct intentionally. Some platforms ought to fail closed, denying all requests if the identification gateway or session retailer is unavailable. Others may have short-lived cached validation for resilience. That call must be specific and aligned with the platform’s threat mannequin.
Log validation, refresh, and logout occasions. Centralization makes it simpler to supply a dependable audit path displaying who accessed which companies and when their session modified.
Decreasing load on upstream identification programs
One much less apparent good thing about centralized session possession is decreased load on upstream identification infrastructure.
In a distributed mannequin, every regional gateway can name the identification supplier, token secret retailer, and authorization coverage engine independently. When a person strikes throughout three instruments, the platform might carry out three separate token exchanges, three unbiased refresh paths, and three coverage evaluations.
With a central identification gateway, the identification supplier known as as soon as per login. Regional gateways validate towards the shared session as a substitute of repeating the OIDC movement. Token refresh is coordinated by one service, and cached authorization context could be reused till it expires.
Because the variety of clusters and instruments grows, upstream identification load scales nearer to the variety of lively customers somewhat than the variety of user-tool-cluster mixtures. This distinction turns into necessary in platforms that embed many instruments into one workflow.
Enabling unified AI and knowledge workflows
Centralized identification additionally allows higher-level platform capabilities.
A unified platform shell can embed a number of instruments, and assistants behind one login. Every embedded software nonetheless validates requests by the gateway layer, however the person experiences a single authenticated platform.
AI assistants profit from the identical mannequin. A platform assistant typically wants to question knowledge, retrieve metadata, name instruments, and summarize outcomes on behalf of the person. With centralized session validation, the assistant can resolve the person’s identification by the platform session and cross trusted identification context to backend instruments.
Which means the assistant doesn’t want broad service credentials or separate per-tool login flows. Its actions can inherit the person’s RBAC scope, making the system simpler to motive about and simpler to audit.
Making use of the sample
To use this structure in your personal platform, begin by inventorying the place periods are created right this moment. Determine which gateways run OIDC flows, which companies parse tokens immediately, which headers downstream functions belief, and the way logout presently works.
Then outline the central contract:
Which service owns session creation?
What claims will /gateway/userinfo return?
Which gateway layer is allowed to inject identification headers?
How lengthy ought to platform periods stay?
How will refresh and logout be audited?
What occurs if the session retailer is unavailable?
After the contract is obvious, migrate incrementally. Begin with one regional gateway or one group of associated companies. Substitute native session validation with a name to the central identification gateway. Preserve the application-facing identification interface secure so downstream companies don’t want giant rewrites.
As soon as the primary migration is working, add extra gateways and instruments. The aim is to not take away each regional enforcement level. The aim is to make each enforcement level learn from the identical supply of session fact.
One query
Distributed session state is an architectural debt that accumulates quietly. It typically seems first as repeated login prompts, however the bigger value is duplicated auth logic, inconsistent logout, pointless identity-provider load, and fragmented person context.
A central identification gateway addresses the basis trigger by separating session possession from request enforcement. One service owns login, refresh, validation, and logout. Regional gateways implement entry domestically whereas studying from a shared session report.
At NVIDIA, this sample decreased repeated login occasions by 55% and created a basis for unified developer portals and AI assistants with delegated person identification. The identical method can assist different platform groups constructing federated Kubernetes, knowledge, and AI environments.
To judge whether or not this sample suits your platform, begin with one query: The place does session state stay right this moment, and what number of companies are making identification choices they need to not must make? If the reply reveals extra distributed session state than you’d like, the migration path is simple: choose one gateway, substitute native session validation with a central validation name, and hold the remainder of the platform secure when you develop from there.
Getting began
Able to implement the same identity-aware gateway structure? Start with the OAuth2 Proxy native setting to discover OIDC login, cookie dealing with, and Redis-backed periods. Subsequent, comply with the Istio exterior authorization pattern to outline the Auth Gateway interface, and add Rego coverage analysis with the OPA Envoy Istio instance. For an built-in reference masking JWT and API-key validation, metadata enrichment, coverage choices, and trusted upstream headers, discover Authorino.
Collectively, these initiatives present sensible beginning factors for implementing the identification, gateway, and coverage layers described on this submit.
