AI Fabrix implements a secure authentication system that provides Azure OIDC-level security with complete enterprise control over the authentication and deployment process. The system ensures that GitHub stores only public identifiers (GUIDs), never secrets or passwords, while providing seamless developer experience through the AI Fabrix TypeScript SDK.
Each application has its own security context with three key identifiers:
mori-12345678-1234-1234-1234-123456789012)customer-87654321-4321-4321-4321-210987654321)dev-aifabrix-11111111-2222-3333-4444-555555555555)miso-87654321-4321-4321-4321-210987654321customer-11111111-2222-3333-4444-555555555555| Registry Mode | Image Source | Authentication Required | Reason |
|---|---|---|---|
acr |
Customer’s Azure Container Registry | ✅ Yes | Private registry access |
external |
AI Fabrix images in customer tenant | ✅ Yes | Private AI Fabrix images |
public |
Public Docker Hub, GitHub Container Registry | ❌ No | Public access |
sequenceDiagram
participant GH as GitHub Actions
participant SDK as AI Fabrix SDK
participant OIDC as Custom OIDC Provider
participant Portal as Deployment Portal
participant ACR as Azure Container Registry
GH->>SDK: npx aifabrix-miso-sdk auth
SDK->>OIDC: Request token with public identifiers
OIDC->>SDK: Return short-lived access token
SDK->>Portal: Deploy with token
Portal->>ACR: Authenticate with token
ACR->>Portal: Return image access
Portal->>SDK: Deployment complete
The AI Fabrix TypeScript SDK provides three main commands:
auth: Authenticate with AI Fabrix using public identifiersvalidate: Validate application schema before deploymentdeploy: Deploy application with validated configurationname: Deploy Application
on:
push:
branches: [main]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '18'
- name: Install AI Fabrix SDK
run: npm install aifabrix-miso-sdk
- name: Authenticate with AI Fabrix
run: |
npx aifabrix-miso-sdk auth \
--client-id $ \
--tenant-id $ \
--environment-id $
- name: Validate Application Schema
run: |
npx aifabrix-miso-sdk validate \
--schema app-schema.json
- name: Deploy Application
run: |
npx aifabrix-miso-sdk deploy \
--schema app-schema.json \
--config app-deployment.json
Only Public Identifiers (No Secrets!):
# Application repository secrets
APP_CLIENT_ID: "app-12345678-1234-1234-1234-123456789012"
APP_TENANT_ID: "customer-11111111-2222-3333-4444-555555555555"
APP_ENVIRONMENT_ID: "dev-aifabrix-22222222-3333-4444-5555-666666666666"
GitHub Actions calls OIDC provider:
POST https://your-oidc-provider.com/oauth2/token
Content-Type: application/json
{
"client_id": "app-12345678-1234-1234-1234-123456789012",
"tenant_id": "customer-11111111-2222-3333-4444-555555555555",
"environment_id": "dev-aifabrix-22222222-3333-4444-5555-666666666666",
"grant_type": "client_credentials"
}
Response:
{
"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIs...",
"token_type": "Bearer",
"expires_in": 3600
}
GitHub Actions calls deployment API:
POST https://your-deployment-api.com/api/applications/app-key/deploy
Authorization: Bearer {access_token_from_oidc}
Content-Type: application/json
{
"environment": "dev-aifabrix",
"image": "aifabrix/app:v1.2.3",
"registryMode": "external",
"environmentVariables": [...],
"secrets": [...]
}
Application uses AI Fabrix images in customer tenant:
name: Deploy Application
on:
push:
branches: [main]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Authenticate with AI Fabrix
run: |
npx aifabrix-miso-sdk auth \
--client-id $ \
--tenant-id $ \
--environment-id $
- name: Deploy Application
run: |
npx aifabrix-miso-sdk deploy \
--schema app-schema.json \
--config app-deployment.json
Application uses customer’s own Azure Container Registry:
name: Deploy Application
on:
push:
branches: [main]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Authenticate with AI Fabrix
run: |
npx aifabrix-miso-sdk auth \
--client-id $ \
--tenant-id $ \
--environment-id $
- name: Deploy Application
run: |
npx aifabrix-miso-sdk deploy \
--schema app-schema.json \
--config app-deployment.json
Note: ACR registry mode requires Azure Container Registry infrastructure to be deployed first.
Application uses public images (no authentication needed):
name: Deploy Application
on:
push:
branches: [main]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Deploy Application
run: |
npx aifabrix-miso-sdk deploy \
--schema app-schema.json \
--config app-deployment.json
stateDiagram-v2
[*] --> TokenRequest: GitHub Actions requests token
TokenRequest --> TokenValidation: OIDC provider validates IDs
TokenValidation --> TokenIssuance: Short-lived token issued
TokenIssuance --> TokenUsage: Token used for deployment
TokenUsage --> TokenExpiration: Token expires (1 hour max)
TokenExpiration --> [*]
This authentication system works seamlessly with existing configuration schemas:
registryMode determines authentication requirementNo changes needed to existing schemas - this authentication system operates at the deployment layer, providing secure access to private registries while maintaining the existing configuration structure.
The authentication system works seamlessly with the database reference approach:
databases[0].urlKeyVaultName to reference database URLsdatabases[0].passwordKeyVaultName to reference database passwordsContact us and we’ll get back to you as soon as possible.
Submit a Request