You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "vincbeck (via GitHub)" <gi...@apache.org> on 2025/06/30 17:34:25 UTC
[PR] Update auth manager documentation to reflect Airflow 3 changes [airflow]
vincbeck opened a new pull request, #52586:
URL: https://github.com/apache/airflow/pull/52586
Related #51971.
Auth manager doc has not been updated to reflect Airflow 3 status.
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
<!-- Please keep an empty line above the dashes. -->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update auth manager documentation to reflect Airflow 3 changes [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #52586:
URL: https://github.com/apache/airflow/pull/52586#discussion_r2180171722
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -122,17 +135,20 @@ These authorization methods are:
Also, ``is_authorized_dag`` is called for any entity related to dags (e.g. task instances, dag runs, ...). This information is passed in ``access_entity``.
Example: ``auth_manager.is_authorized_dag(method="GET", access_entity=DagAccessEntity.Run, details=DagDetails(id="dag-1"))`` asks
whether the user has permission to read the Dag runs of the dag "dag-1".
-* ``is_authorized_dataset``: Return whether the user is authorized to access Airflow datasets. Some details about the dataset can be provided (e.g. the dataset uri).
+* ``is_authorized_backfill``: Return whether the user is authorized to access Airflow backfills. Some details about the backfill can be provided (e.g. the backfill ID).
+* ``is_authorized_asset``: Return whether the user is authorized to access Airflow assets. Some details about the asset can be provided (e.g. the asset ID).
+* ``is_authorized_asset_alias``: Return whether the user is authorized to access Airflow asset aliases. Some details about the asset alias can be provided (e.g. the asset alias ID).
* ``is_authorized_pool``: Return whether the user is authorized to access Airflow pools. Some details about the pool can be provided (e.g. the pool name).
* ``is_authorized_variable``: Return whether the user is authorized to access Airflow variables. Some details about the variable can be provided (e.g. the variable key).
* ``is_authorized_view``: Return whether the user is authorized to access a specific view in Airflow. The view is specified through ``access_view`` (e.g. ``AccessView.CLUSTER_ACTIVITY``).
* ``is_authorized_custom_view``: Return whether the user is authorized to access a specific view not defined in Airflow. This view can be provided by the auth manager itself or a plugin defined by the user.
+* ``filter_authorized_menu_items``: Given the list of menu items in the UI, return the list of menu items the user has access to.
JWT token management by auth managers
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The auth manager is responsible for creating the JWT token needed to interact with Airflow public API.
-To achieve this, the auth manager **must** provide an endpoint to create this JWT token. This endpoint must be
-available at ``POST /auth/token``
+To achieve this, the auth manager **must** provide an endpoint to create this JWT token. This endpoint is usually
Review Comment:
It is the latter. I added a sentence to double check auth manager documentation in order to find the accurate token generation endpoint
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update auth manager documentation to reflect Airflow 3 changes [airflow]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #52586:
URL: https://github.com/apache/airflow/pull/52586#discussion_r2175981300
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -91,14 +91,27 @@ Some reasons you may want to write a custom auth manager include:
* You'd like to use an auth manager that leverages an identity provider from your preferred cloud provider.
* You have a private user management tool that is only available to you or your organization.
-Authentication related BaseAuthManager methods
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+User representation
+^^^^^^^^^^^^^^^^^^^
+
+:class:`~airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager` defines an authentication manager,
+parameterized by a user class T representing the authenticated user type.
+Auth manager implementations (subclasses of :class:`~airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager`)
+should specify the associated concrete user type. Each auth manager has its own user type definition.
+
+Authentication related methods
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-* ``get_user``: Return the signed-in user.
* ``get_url_login``: Return the URL the user is redirected to for signing in.
+* ``get_url_logout``: Return the URL the user is redirected to when logging out. This is an optional method,
+ this redirection is usually needed to invalidate resources when logging out, such as a session.
+* ``serialize_user``: Serialize a user instance to a dict. This dict is the actual content of the JWT token.
+ It should contain all the information needed to identity the user and make authorization request.
Review Comment:
Consider replacing 'identity' with 'identify' to improve grammatical accuracy in the documentation.
```suggestion
It should contain all the information needed to identify the user and make authorization request.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update auth manager documentation to reflect Airflow 3 changes [airflow]
Posted by "zach-overflow (via GitHub)" <gi...@apache.org>.
zach-overflow commented on code in PR #52586:
URL: https://github.com/apache/airflow/pull/52586#discussion_r2176187398
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -122,17 +135,20 @@ These authorization methods are:
Also, ``is_authorized_dag`` is called for any entity related to dags (e.g. task instances, dag runs, ...). This information is passed in ``access_entity``.
Example: ``auth_manager.is_authorized_dag(method="GET", access_entity=DagAccessEntity.Run, details=DagDetails(id="dag-1"))`` asks
whether the user has permission to read the Dag runs of the dag "dag-1".
-* ``is_authorized_dataset``: Return whether the user is authorized to access Airflow datasets. Some details about the dataset can be provided (e.g. the dataset uri).
+* ``is_authorized_backfill``: Return whether the user is authorized to access Airflow backfills. Some details about the backfill can be provided (e.g. the backfill ID).
+* ``is_authorized_asset``: Return whether the user is authorized to access Airflow assets. Some details about the asset can be provided (e.g. the asset ID).
+* ``is_authorized_asset_alias``: Return whether the user is authorized to access Airflow asset aliases. Some details about the asset alias can be provided (e.g. the asset alias ID).
* ``is_authorized_pool``: Return whether the user is authorized to access Airflow pools. Some details about the pool can be provided (e.g. the pool name).
* ``is_authorized_variable``: Return whether the user is authorized to access Airflow variables. Some details about the variable can be provided (e.g. the variable key).
* ``is_authorized_view``: Return whether the user is authorized to access a specific view in Airflow. The view is specified through ``access_view`` (e.g. ``AccessView.CLUSTER_ACTIVITY``).
* ``is_authorized_custom_view``: Return whether the user is authorized to access a specific view not defined in Airflow. This view can be provided by the auth manager itself or a plugin defined by the user.
+* ``filter_authorized_menu_items``: Given the list of menu items in the UI, return the list of menu items the user has access to.
JWT token management by auth managers
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The auth manager is responsible for creating the JWT token needed to interact with Airflow public API.
-To achieve this, the auth manager **must** provide an endpoint to create this JWT token. This endpoint must be
-available at ``POST /auth/token``
+To achieve this, the auth manager **must** provide an endpoint to create this JWT token. This endpoint is usually
Review Comment:
If the token generation endpoint path doesn't strictly have to be at `/auth/token`, it might be worth clarifying if what dictates how Airflow determines which custom auth manager endpoint to use for token generation.
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -91,14 +91,27 @@ Some reasons you may want to write a custom auth manager include:
* You'd like to use an auth manager that leverages an identity provider from your preferred cloud provider.
* You have a private user management tool that is only available to you or your organization.
-Authentication related BaseAuthManager methods
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+User representation
+^^^^^^^^^^^^^^^^^^^
+
+:class:`~airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager` defines an authentication manager,
+parameterized by a user class T representing the authenticated user type.
+Auth manager implementations (subclasses of :class:`~airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager`)
+should specify the associated concrete user type. Each auth manager has its own user type definition.
Review Comment:
maybe worth noting that the concrete user type should be a subclass of `airflow.api_fastapi.auth.managers.models.base_user.BaseUser`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update auth manager documentation to reflect Airflow 3 changes [airflow]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #52586:
URL: https://github.com/apache/airflow/pull/52586#discussion_r2180180413
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -91,14 +91,28 @@ Some reasons you may want to write a custom auth manager include:
* You'd like to use an auth manager that leverages an identity provider from your preferred cloud provider.
* You have a private user management tool that is only available to you or your organization.
-Authentication related BaseAuthManager methods
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+User representation
+^^^^^^^^^^^^^^^^^^^
+
+:class:`~airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager` defines an authentication manager,
+parameterized by a user class T representing the authenticated user type.
+Auth manager implementations (subclasses of :class:`~airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager`)
+should specify the associated concrete user type. Each auth manager has its own user type definition.
+Concrete user types should be subclass of :class:`~airflow.api_fastapi.auth.managers.models.base_user.BaseUser`.
+
+Authentication related methods
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-* ``get_user``: Return the signed-in user.
* ``get_url_login``: Return the URL the user is redirected to for signing in.
+* ``get_url_logout``: Return the URL the user is redirected to when logging out. This is an optional method,
+ this redirection is usually needed to invalidate resources when logging out, such as a session.
+* ``serialize_user``: Serialize a user instance to a dict. This dict is the actual content of the JWT token.
+ It should contain all the information needed to identity the user and make authorization request.
Review Comment:
There's a typo and missing article: use 'identify' instead of 'identity' and include 'an': 'needed to identify the user and make an authorization request.'
```suggestion
It should contain all the information needed to identify the user and make an authorization request.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update auth manager documentation to reflect Airflow 3 changes [airflow]
Posted by "zach-overflow (via GitHub)" <gi...@apache.org>.
zach-overflow commented on code in PR #52586:
URL: https://github.com/apache/airflow/pull/52586#discussion_r2176187398
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -122,17 +135,20 @@ These authorization methods are:
Also, ``is_authorized_dag`` is called for any entity related to dags (e.g. task instances, dag runs, ...). This information is passed in ``access_entity``.
Example: ``auth_manager.is_authorized_dag(method="GET", access_entity=DagAccessEntity.Run, details=DagDetails(id="dag-1"))`` asks
whether the user has permission to read the Dag runs of the dag "dag-1".
-* ``is_authorized_dataset``: Return whether the user is authorized to access Airflow datasets. Some details about the dataset can be provided (e.g. the dataset uri).
+* ``is_authorized_backfill``: Return whether the user is authorized to access Airflow backfills. Some details about the backfill can be provided (e.g. the backfill ID).
+* ``is_authorized_asset``: Return whether the user is authorized to access Airflow assets. Some details about the asset can be provided (e.g. the asset ID).
+* ``is_authorized_asset_alias``: Return whether the user is authorized to access Airflow asset aliases. Some details about the asset alias can be provided (e.g. the asset alias ID).
* ``is_authorized_pool``: Return whether the user is authorized to access Airflow pools. Some details about the pool can be provided (e.g. the pool name).
* ``is_authorized_variable``: Return whether the user is authorized to access Airflow variables. Some details about the variable can be provided (e.g. the variable key).
* ``is_authorized_view``: Return whether the user is authorized to access a specific view in Airflow. The view is specified through ``access_view`` (e.g. ``AccessView.CLUSTER_ACTIVITY``).
* ``is_authorized_custom_view``: Return whether the user is authorized to access a specific view not defined in Airflow. This view can be provided by the auth manager itself or a plugin defined by the user.
+* ``filter_authorized_menu_items``: Given the list of menu items in the UI, return the list of menu items the user has access to.
JWT token management by auth managers
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The auth manager is responsible for creating the JWT token needed to interact with Airflow public API.
-To achieve this, the auth manager **must** provide an endpoint to create this JWT token. This endpoint must be
-available at ``POST /auth/token``
+To achieve this, the auth manager **must** provide an endpoint to create this JWT token. This endpoint is usually
Review Comment:
If the token generation endpoint path doesn't strictly have to be at `/auth/token`, it might be worth clarifying how Airflow determines which custom auth manager endpoint to use for token generation, or if Airflow doesn't care and users are expected to explicitly call the endpoint for login attempts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update auth manager documentation to reflect Airflow 3 changes [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #52586:
URL: https://github.com/apache/airflow/pull/52586#issuecomment-3036879240
@zach-overflow, any chance you can review?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update auth manager documentation to reflect Airflow 3 changes [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #52586:
URL: https://github.com/apache/airflow/pull/52586
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update auth manager documentation to reflect Airflow 3 changes [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #52586:
URL: https://github.com/apache/airflow/pull/52586#discussion_r2180165724
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -91,14 +91,27 @@ Some reasons you may want to write a custom auth manager include:
* You'd like to use an auth manager that leverages an identity provider from your preferred cloud provider.
* You have a private user management tool that is only available to you or your organization.
-Authentication related BaseAuthManager methods
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+User representation
+^^^^^^^^^^^^^^^^^^^
+
+:class:`~airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager` defines an authentication manager,
+parameterized by a user class T representing the authenticated user type.
+Auth manager implementations (subclasses of :class:`~airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager`)
+should specify the associated concrete user type. Each auth manager has its own user type definition.
Review Comment:
Absolutely!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org