You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "anmolxlight (via GitHub)" <gi...@apache.org> on 2026/09/03 21:04:21 UTC
[PR] Add machine-readable RBAC reference to BaseAuthManager [airflow]
anmolxlight opened a new pull request, #72495:
URL: https://github.com/apache/airflow/pull/72495
## Summary
Closes #72465.
Provider auth managers like the Keycloak auth manager need to model the Airflow RBAC permissions in an external system, which today means hand-maintaining a copy of the RBAC surface. This adds `BaseAuthManager.get_rbac_reference()`, a machine-readable reference introspected from the `is_authorized_*` methods, so it stays in sync automatically whenever resources are added or changed.
Each entry is keyed by resource name (e.g. `"dag"`) and holds the authorizing method, allowed actions, scoping enum with values (e.g. `DagAccessEntity`, `AccessView`), details dataclass fields (e.g. `DagDetails`), and a short description. The reference is JSON-serializable so external systems can consume it directly.
Also adds an "RBAC reference" docs page under Auth manager concepts, unit tests, and a newsfragment.
Skipped: a dedicated Sphinx extension or prek codegen hook. The runtime-introspected method cannot drift by construction; add codegen only if a static artifact is ever required.
## Test Plan
- [x] New `TestGetRbacReference` tests pass (64 passed in `test_base_auth_manager.py`)
- [x] `ruff check` and `ruff format --check` pass on changed files
- [x] `mypy-airflow-core` prek hook passes
- [x] `prek run --from-ref apache/main --stage pre-commit` passes (includes newsfragment validation)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add machine-readable RBAC reference to BaseAuthManager [airflow]
Posted by "anmolxlight (via GitHub)" <gi...@apache.org>.
anmolxlight commented on PR #72495:
URL: https://github.com/apache/airflow/pull/72495#issuecomment-5595582617
@stephen-bracken Good question. No, deliberately not.
`get_rbac_reference()` covers the resource surface only: resource name, authorizing `is_authorized_*` method, allowed actions, scoping enum (`DagAccessEntity`, `AccessView`, ...), and details dataclass fields (`DagDetails`, ...).
Role to permission mapping is not part of it because roles are a `SimpleAuthManager` concept (`ADMIN`/`OP`/`USER`/`VIEWER`/`PUBLIC` with hierarchical ordering). `BaseAuthManager` itself is role-agnostic, and provider managers like Keycloak bring their own role model, so the reference gives them the resource surface their own roles must map onto rather than baking in one manager's role hierarchy.
Happy to add a `SimpleAuthManager.get_role_reference()` on top if you think that mapping is worth exposing too. Just say the word.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add machine-readable RBAC reference to BaseAuthManager [airflow]
Posted by "stephen-bracken (via GitHub)" <gi...@apache.org>.
stephen-bracken commented on PR #72495:
URL: https://github.com/apache/airflow/pull/72495#issuecomment-5584985169
@anmolxlight thanks for working on this. Does the reference include role permission references as well?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add machine-readable RBAC reference to BaseAuthManager [airflow]
Posted by "stephen-bracken (via GitHub)" <gi...@apache.org>.
stephen-bracken commented on PR #72495:
URL: https://github.com/apache/airflow/pull/72495#issuecomment-5615699678
@anmolxlight these role mappings should be common, as they are implemented in other Auth managers like the FabAuthManager as well. I think it's worth adding something here because otherwise we would need to recreate the Auth model for each Auth manager.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add machine-readable RBAC reference to BaseAuthManager [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #72495:
URL: https://github.com/apache/airflow/pull/72495#issuecomment-6457209049
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add machine-readable RBAC reference to BaseAuthManager [airflow]
Posted by "github-actions[bot] (via GitHub) via commits" <co...@airflow.apache.org>.
github-actions[bot] closed pull request #72495: Add machine-readable RBAC reference to BaseAuthManager
URL: https://github.com/apache/airflow/pull/72495
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org