You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by bo...@apache.org on 2016/09/04 13:13:42 UTC
incubator-airflow git commit: [AIRFLOW-477][AIRFLOW-478] Restructure
security section for clarity
Repository: incubator-airflow
Updated Branches:
refs/heads/master c6cc01f4e -> 86fe23f11
[AIRFLOW-477][AIRFLOW-478] Restructure security section for clarity
Closes #1775 from alexvanboxel/docs/security
Project: http://git-wip-us.apache.org/repos/asf/incubator-airflow/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-airflow/commit/86fe23f1
Tree: http://git-wip-us.apache.org/repos/asf/incubator-airflow/tree/86fe23f1
Diff: http://git-wip-us.apache.org/repos/asf/incubator-airflow/diff/86fe23f1
Branch: refs/heads/master
Commit: 86fe23f111c8552de2701069783a6b5b522976b4
Parents: c6cc01f
Author: Alex Van Boxel <al...@vanboxel.be>
Authored: Sun Sep 4 15:13:14 2016 +0200
Committer: Bolke de Bruin <bo...@xs4all.nl>
Committed: Sun Sep 4 15:13:18 2016 +0200
----------------------------------------------------------------------
docs/security.rst | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-airflow/blob/86fe23f1/docs/security.rst
----------------------------------------------------------------------
diff --git a/docs/security.rst b/docs/security.rst
index b8f13ca..801dc84 100644
--- a/docs/security.rst
+++ b/docs/security.rst
@@ -1,9 +1,6 @@
Security
========
-Web Authentication
-------------------
-
By default, all gates are opened. An easy way to restrict access
to the web application is to do it at the network level, or by using
SSH tunnels.
@@ -11,6 +8,9 @@ SSH tunnels.
It is however possible to switch on authentication by either using one of the supplied
backends or create your own.
+Web Authentication
+------------------
+
Password
''''''''
@@ -110,6 +110,7 @@ created by itself.
Kerberos
--------
+
Airflow has initial support for Kerberos. This means that airflow can renew kerberos
tickets for itself and store it in the ticket cache. The hooks and dags can make use of ticket
to authenticate against kerberized services.
@@ -214,6 +215,9 @@ and in your DAG, when initializing the HiveOperator, specify
run_as_owner=True
+OAuth Authentication
+--------------------
+
GitHub Enterprise (GHE) Authentication
''''''''''''''''''''''''''''''''''''''
@@ -239,7 +243,7 @@ your GHE installation will be able to login to Airflow.
allowed_teams = example_team_1, example_team_2
Setting up GHE Authentication
-'''''''''''''''''''''''''''''
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
An application must be setup in GHE before you can use the GHE authentication
backend. In order to setup an application:
@@ -253,7 +257,7 @@ backend. In order to setup an application:
7. Copy 'Client ID', 'Client Secret', and your callback route to your airflow.cfg according to the above example
Google Authentication
-''''''''''''''''''''''''''''''''''''''
+'''''''''''''''''''''
The Google authentication backend can be used to authenticate users
against Google using OAuth2. You must specify a domain to restrict login
@@ -272,7 +276,7 @@ to only members of that domain.
domain = example.com
Setting up Google Authentication
-'''''''''''''''''''''''''''''
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
An application must be setup in the Google API Console before you can use the Google authentication
backend. In order to setup an application: