Configure Basic Authentication for MLflow

You can use the steps below to configure NGINX as a reverse proxy that protects access to MLflow running on a node with basic authentication (username and password).

Access http://<your-server> and enter the username and password to reach the MLflow UI running on a node.

Steps to install

  1. Install Nginx (if not already installed)

On Ubuntu/Debian:

sudo apt update sudo apt install nginx -y

On RHEL/CentOS:

sudo yum install nginx -y sudo systemctl enable nginx

  1. Install apache2-utils to create .htpasswd.

sudo apt install apache2-utils # Debian/Ubuntu # OR sudo yum install httpd-tools # RHEL/CentOS

  1. Create the password file (.htpasswd).

sudo htpasswd -c /etc/nginx/.htpasswd mlflowuser

You’ll be prompted to enter a password. Replace mlflowuser with your preferred username.

  1. Configure Nginx reverse proxy with basic authentication.

Edit or create the file:

sudo nano /etc/nginx/conf.d/mlflow.conf

Paste this configuration:

server { listen 80; server_name 10.100.11.72; location / { proxy_pass http://10.100.11.72:5000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; auth_basic "Restricted Access"; auth_basic_user_file /etc/nginx/.htpasswd; } }

Optional: Replace mlflow.local with your domain or server IP, or use _ to match all incoming requests.

  1. Test and reload Nginx

sudo nginx -t sudo systemctl reload nginx

  1. (Optional) Add a hosts entry for mlflow.local.

If you're using a custom domain name like mlflow.local, add an entry on your local machine to map it to the MLflow server.

Open the hosts file:

sudo nano /etc/hosts

Add the following line (replace with your server IP if different):

<IP address> mlflow.local

Save and close the file.

This is only needed if you're using a fake domain instead of the IP.

  1. Generate a self-signed SSL certificate

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ -keyout /etc/ssl/private/mlflow.key \ -out /etc/ssl/certs/mlflow.crt

  1. Update your NGINX config to use SSL.

server { listen 443 ssl; server_name mlflow.local; ssl_certificate /etc/ssl/certs/mlflow.crt; ssl_certificate_key /etc/ssl/private/mlflow.key; location / { proxy_pass http://10.100.11.72:5000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; auth_basic "Restricted Access"; auth_basic_user_file /etc/nginx/.htpasswd; } }

  1. Open port 443 in the firewall.

sudo ufw allow 'Nginx Full' # Ubuntu sudo firewall-cmd --add-service=https --permanent # RHEL/CentOS sudo firewall-cmd --reload

Optional: Test Access Using curl

Run the following command to test basic authentication with your MLflow server.

curl -u mlflowuser <IP Address>

Username - mlflowuser

Password - admin


This verifies that the NGINX reverse proxy and basic authentication are working as expected.


  Last updated on Aug 5, 2025
Next to read:
Integrate HBase-Spark
null
On This Page
Configure Basic Authentication for MLflowSteps to installSecure MLflow with SSL (Optional but Recommended)Optional: Test Access Using curl