You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "svncsvr (via GitHub)" <gi...@apache.org> on 2023/10/25 14:17:39 UTC
[I] Wild char support when setting a new role for a set of DAGs [airflow]
svncsvr opened a new issue, #35178:
URL: https://github.com/apache/airflow/issues/35178
### Description
Airflows Access Control system is quite advanced and it is already helping us a lot in organizing user and team accesses.
i.e example using the following notation we are able to specify roles on DAG level
`can read on DAG:my_dag_id
`
However we are constantly adding new DAGs and don't want to keep editing the role for the newly added DAGs. Instead, since we already adapted a DAG naming conventions it would have been so much easier if we could i.e use wildcard chars or regex when specifying the DAG name. ie
`can read on DAG:quality_*
`
We think this feature would be a great addition to already powerful access control implementation.
### Use case/motivation
We are trying to access finer granularity when working with Access Control on individual DAG level
### Related issues
_No response_
### Are you willing to submit a PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Wild char support when setting a new role for a set of DAGs [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #35178:
URL: https://github.com/apache/airflow/issues/35178#issuecomment-1779945535
This is unlikely to happen as we are moving away from the current mode in favour of more flexible system https://cwiki.apache.org/confluence/display/AIRFLOW/AIP-56+Extensible+user+management - where you will be able to write your own Auth Manager and manage your access rules in whatever way you want.
The way how FAB authentication is implemented, using wildcards would bear extremely huge performance hit and we decided against extending that model in favour of completely changing the approach and moving not only authentication but also authorization outside of Airflow and putting that in hands of the deployment managers to implement schemes that will match their organisation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Wild char support when setting a new role for a set of DAGs [airflow]
Posted by "nathadfield (via GitHub)" <gi...@apache.org>.
nathadfield closed issue #35178: Wild char support when setting a new role for a set of DAGs
URL: https://github.com/apache/airflow/issues/35178
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Wild char support when setting a new role for a set of DAGs [airflow]
Posted by "nathadfield (via GitHub)" <gi...@apache.org>.
nathadfield commented on issue #35178:
URL: https://github.com/apache/airflow/issues/35178#issuecomment-1792319171
Closing based on @potiuk's commnents.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Wild char support when setting a new role for a set of DAGs [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #35178:
URL: https://github.com/apache/airflow/issues/35178#issuecomment-1779945928
cc: @vincbeck
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org