ALL NPPS Members

[Brett Viren <bv AT bnl.gov>]

Torre Wenaus <wenaus AT gmail.com> writes:

> Is that what you would call comanage with ollama behind? Or...?

I hadn't heard of COmanage, but reading about it now, it's seems to be a
full-featured "auth backend" from InCommon.  My understanding is that
Keycloak is the approximate equivalent that is in popular use at BNL.

So, no, what I meant by "frontend" was the user-touching web app that
intermediates between human and "LLM backend" resources for chat type
interaction.  This UI frontend could (probably should) use COmanage or
Keycloak as an "auth backend".

I think using Open-WebUI as that UI frontend is a reasonable thing to
consider if the security and auth issues can be sorted.  I do wonder how
Open-WebUI copes when more users than LLM resources hit it.

> Today has not been very positive to Open-WebUI!

Perhaps I need to disclose some caveats of my experience with
Open-WebUI.  My usages was almost least-effort:

  $ uv run open-webui serve

I did go a bit further to try to make it preserve its configuration
after a restart, including the unique admin password I would set (and
reset...).  I was only partly successful.  Sometimes it held and
sometimes it disappeared.  I gave up on that problem and lived with the
race between a restart and first login.  Since it was exposed only to
localhost, it was a safe race to run.  I'd shutdown the Open-WebUI
server when I finished each chat session.

Presumably, paying more attention can overcome these problems.  Yet more
would be needed to use an auth backend.

The other caveat is that I've stopped using Open-WebUI for the past few
months.  It is possible that today's version is better behaved.

The combination of free Gemini API and Emacs+gptel have fully spoiled me
away from Open-WebUI entirely and also reduced my use of Ollama.  But,
clearly that's not a solution for Ask PanDA! :)

-Brett.

Attachment: signature.asc
Description: PGP signature