[AIRFLOW-85] Convert Airflow Webserver UI to FAB for RBAC support #3015

jgao54 · 2018-02-08T10:12:11Z

Make sure you have checked all steps below.

JIRA

My PR addresses the following Airflow JIRA issues and references them in the PR title. For example, "[AIRFLOW-XXX] My Airflow PR"
- https://issues.apache.org/jira/browse/AIRFLOW-85

Description

Here are some details about my PR, including screenshots of any UI changes:
New UI with RBAC support.

Tests

My PR adds the following unit tests OR does not need testing for this extremely good reason:
See tests/www_rbac/

Commits

My commits all reference JIRA issues in their subject lines, and I have squashed multiple commits if they address the same issue. In addition, my commits follow the guidelines from "How to write a good git commit message":
1. Subject is separated from body by a blank line
2. Subject is limited to 50 characters
3. Subject does not end with a period
4. Subject uses the imperative mood ("add", not "adding")
5. Body wraps at 72 characters
6. Body explains "what" and "why", not "how"
Passes git diff upstream/master -u -- "*.py" | flake8 --diff

To test this PR:

Check out this PR locally
Rerun python setup.py install or python setup.py develop so Flask-AppBuilder at master can be installed.
In your airflow.cfg file, under [webserver], set rbac = True.
Run airflow initdb to generate new tables for RBAC support.
Run airflow create_admin to create an admin user.
Run airflow webserver as usual.

Note that the default auth type is DB. You can change AUTH_TYPE in the newly generated webserver_config.py file in AIRFLOW_HOME. See this link for instructions.

Given the size of this PR, it will likely require a few iterations to get the rough edges sorted out. Love any help I can get with code-review and testing.

ashb

Awesome to see this as a PR!

Some comments, some questions from reading the code. I haven't had a chance to run it yet though, but I'll try and find time to do that next week.

ashb · 2018-02-09T10:12:49Z

UPDATING.md

+
+FAB has built-in authentication support for DB, OAuth, OpenID, LDAP, and REMOTE_USER. The default auth type is `AUTH_DB`.
+
+For any other authentication type (OAuth, OpenID, LDAP, REMOTE_USER), see [this link](http://flask-appbuilder.readthedocs.io/en/latest/security.html#authentication-methods) for how to configure variables in webserver_config.py file.


Try to avoid having link targets saying "this link" or "click here", as it doesn't provide clues for screen readers and other assistive technologies. (I guess it doesn't matter much in this specific case, but it is a good habit to get in to.)

Something like:

see the [Authentication section of FAB docs](http://flask-appbuilder.readthedocs.io/en/latest/security.html#authentication-methods)

ashb · 2018-02-09T10:13:49Z

UPDATING.md

+
+For any other authentication type (OAuth, OpenID, LDAP, REMOTE_USER), see [this link](http://flask-appbuilder.readthedocs.io/en/latest/security.html#authentication-methods) for how to configure variables in webserver_config.py file.
+
+Once you modify your config file, run `airflow initdb` to generate new tables for RBAC support (these tables will have the prefix `ab_`).


I'm guessing any users created in the old style won't be migrated automatically and will need to be re-created. A note about this would be good.

ashb · 2018-02-09T10:15:54Z

airflow/bin/cli.py

@@ -1116,6 +1129,34 @@ def kerberos(args):  # noqa
        airflow.security.kerberos.run()


+def create_admin(args):


Does this work if something if FAB is configured to use other auth backends than AUTH_DB?

@ashb The create_admin is for auth_db only. The OAuth flow (which I tested) will also create an entry in the ab_user table, with a username assembled by FAB (provider name plus an id it parsed from the auth response). So if you know the username and enter with provider prefix, you could create an account via this command, but it's not very obvious.

I spent a bit of time on sorting out the OAuth flow today. The registration is best done via the UI and is a bit more involved. It requires the following config change

Modify webserver_config.py

AUTH_TYPE = AUTH_OAUTH OAUTH_PROVIDERS = [ { 'name':'google', 'whitelist': ['@COMPANY.COM'], 'token_key':'access_token', 'icon':'fa-google', 'remote_app': { 'base_url':'https://www.googleapis.com/oauth2/v2/', 'request_token_params':{ 'scope': 'email profile' }, 'access_token_url':'https://accounts.google.com/o/oauth2/token', 'authorize_url':'https://accounts.google.com/o/oauth2/auth', 'request_token_url': None, 'consumer_key': CONSUMER_KEY, 'consumer_secret': SECRET_KEY, } } ] AUTH_USER_REGISTRATION = True AUTH_USER_REGISTRATION_ROLE = "Admin"

This will allow the admin to self register an account with full access
2. Once the admin(s) is registered, modify webserver_config.py again:

AUTH_USER_REGISTRATION_ROLE = "Public"

This will allow all other users to freely register with the Public role via OAuth.

Will add a note about this in the doc. I haven't had much time to test out the other auth flows.

Just found out that FAB provides a nice way to override/customize the oauth registration stored in the db, which will make this create_admin cli tool more usable (for example, username can be set to email address). See explanation here.

It sounds like we can configure FAB logins so this works for all backends, but if not is it worth guarding this function so that it says "can't be used with this auth backend" or a similar error (rather than silently creating a user record that won't do anything)

It also might be worth generalizing this to a create_user command instead, and adding the role/group name(s) as a parameter -- this would let people create users via the CLI too which sounds like a plus for scripting.

correct, we can configure it such that this works for all backends. And great idea, will do.

Are we going to do this or not?

@ashb oops, yes! this slipped my mind hehe. working on this

ashb · 2018-02-09T10:18:25Z

airflow/configuration.py

+        else:
+            WEBSERVER_CONFIG = AIRFLOW_HOME + '/webserver_config.py'
+    else:
+        WEBSERVER_CONFIG = expand_env_var(os.environ['WEBSERVER_CONFIG'])


Could this entire block not be removed if this was a normal setting in airflow.cfg, and then the default env of AIRFLOW__WEBSERVER__CONFIG could be used.

ashb · 2018-02-09T10:19:43Z

airflow/configuration.py

+            f.write(DEFAULT_WEBSERVER_CONFIG)
+
+    if 'WEBSERVER_CONFIG' not in os.environ:
+        if os.path.isfile(expand_env_var('~/webserver_config.py')):


This seems like an odd file location to open -- having a webserver_config.py in a home directory is somewhat confusing. GIven the ways of overloading the file to read can we remove this and not look for this file automatically?

ashb · 2018-02-09T10:27:30Z

airflow/www_rbac/static/bootstrap-toggle.min.css

@@ -0,0 +1,28 @@
+/*! ========================================================================


Would it be possible to point to the static assets from www/ instead of having to duplicate them in this tree?

At the start I wasn't familiar with the amount of modification required, so it was easier to copy/paste the entire folder and not worry about breaking old UI (this will also make deprecating the older webserver easier). In the end, maybe 1-2 static files were slightly modified, most untouched. so I don't feel too strong about going either way.

ashb · 2018-02-09T10:29:27Z

airflow/www_rbac/templates/airflow/chart.html

@@ -0,0 +1,57 @@
+{#


Same with templates -- are these the same between www and www_rbac? If so can we use the www/templates/ instead of copying?

The templates are not quite the same between www and www_rbac:

they extends from different master templates (/appbuilder rather than /admin) and imports different html/jinja macros

some hard-coded urls in the html files had to be adjusted for FAB's endpoints

There are some files that no longer apply for FAB, like query.html/chart.html. I'll take some time and remove the old css/js/html files

ashb · 2018-02-09T10:35:47Z

airflow/www_rbac/views.py

+        return json.dumps(task_instances)
+
+    @expose('/variables/<form>', methods=["GET", "POST"])
+    @has_access


I'm not too familiar with FAB yet, but is this action protected/restricted to a different ACL to other more generic views?

ACLs are explicitly managed (see security.py on the default role-permission mappings), the only thing @has_access does is making this a secured method.
Generic views (which i assume you mean the model views) under the hood uses the same mechanism -- they have @has_access annotations on each of the CRUD methods.

I guess by generic I actually meant "less dangerous"/read only. i.e. is getting or editing variables a different permission you can assign to users/groups from say "viewing the list of dags" or any of the other actions.

Ah yes, I see, in op_vms list in security.py. I ugess I just expected to see the permission defined here. Treat this as unfamiliarity with FAB.

@ashb np, the decoupling of permissions (and roles) from actions is one of my favorite property of FAB's security model :)

ashb · 2018-02-09T10:38:33Z

airflow/www_rbac/views.py

+    @expose('/variables/<form>', methods=["GET", "POST"])
+    @has_access
+    @action_logging
+    def variables(self, form):


Is there a reason this is in the AirflwoView rather than the VariablesView?

This was a direct copy/paste. You are right I don't think it should be here.
Update: this is not used anywhere. will remove completely.

ashb · 2018-02-09T10:40:19Z

setup.py

@@ -206,7 +206,7 @@ def do_setup():
            'configparser>=3.5.0, <3.6.0',
            'croniter>=0.3.17, <0.4',
            'dill>=0.2.2, <0.3',
-            'flask>=0.11, <0.12',
+            'flask>=0.12, <0.13',


Need to add flask-appbuilder in here too somewhere don't we?

yaswanth477 · 2018-02-13T21:40:20Z

Does this also include granting permissions to users at DAG Level ? Will something like this -
access_control={‘DAG_level_role’:{‘groups’:[list_of_group_names],’users’:[list_of_user_names]}} in DAG Definition work as of this commit?

jgao54 · 2018-02-13T22:26:27Z

@yaswanth477 that is not in the scope of this PR. This is only view-level access control. Next step will be dag-level access control.

harikak84 · 2018-02-17T14:47:08Z

Say i was able to create all the tables for dag level control - Only user is honored with dag level control. Is the plan to use FAB to control access to dags - read/execute? I want to contribute more to this to atttain our target state.Any pointers would be helpful.

jgao54 · 2018-02-21T00:46:18Z

@harikak84 yes, FAB is what I have in mind. Here is a super high-level sketch of how dag-level access control could be implemented (not final or only way):

(1) Currently each endpoints is annotated with the @has_access decorator, which essentially tells FAB to create a single permission-view mapping for that endpoint in the db. To make this DAG-level, we'd have to re-implement the decorator so it has more granularity: instead of creating one perm-view mapping per endpoint, we'd need one per endpoint per DAG.

(2) Modify the dag file parser so that it can parse a new 'access_control' config in the dag file. It would then add/delete restricted permission-view-mapping to the db (depending on if the starting point is no access or all access)

(3) For any high-level pages (i.e the homepage, /list/taskinstance, /list/dagrun, etc.), they need to be be filtered.

The implementation won't be trivial, but I do see a path for it as described above. Let me know if you have more questions/concerns.

jgao54 · 2018-02-28T01:43:01Z

ping @ashb @Acehaidrey @bolkedebruin @mistercrunch @Fokko
Hi all, I want to get at least one other (more the merrier) committers + some users on board with this PR as it is a big change. Hopefully can have it merged by end of week unless major concerns are identified. I have bad unit test/pep8 left to fix (almost there), but no code change otherwise.

@mistercrunch do you have release access for FAB ? if not I can ping the owner. Thanks!

Fokko · 2018-02-28T09:27:57Z

When I try to install using pip install -e .[devel], I get the following notification:

root@9c0815204fea:/airflow# airflow webserver
Traceback (most recent call last):
  File "/usr/local/bin/airflow", line 4, in <module>
    __import__('pkg_resources').require('apache-airflow==1.10.0.dev0+incubating')
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3144, in <module>
    @_call_aside
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3128, in _call_aside
    f(*args, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3157, in _initialize_master_working_set
    working_set = WorkingSet._build_master()
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 666, in _build_master
    ws.require(__requires__)
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 984, in require
    needed = self.resolve(parse_requirements(requirements))
  File "/usr/local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 870, in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'flask-appbuilder<2.0.0,>=1.9.6' distribution was not found and is required by apache-airflow

Also a lot of other packages are missing with devel, but that's another PR. Maybe I'll pick that one up so it is easier for people to contribute.

Fokko · 2018-02-28T09:32:14Z

Can we make the title Airflow instead of FAB?

Fokko · 2018-02-28T09:39:38Z

When I try to make all the users just Admin:

# Uncomment to setup Public role name, no authentication needed
AUTH_ROLE_PUBLIC = 'Admin'

I get the following error:

                          ____/ (  (    )   )  \___
                         /( (  (  )   _    ))  )   )\
                       ((     (   )(    )  )   (   )  )
                     ((/  ( _(   )   (   _) ) (  () )  )
                    ( (  ( (_)   ((    (   )  .((_ ) .  )_
                   ( (  )    (      (  )    )   ) . ) (   )
                  (  (   (  (   ) (  _  ( _) ).  ) . ) ) ( )
                  ( (  (   ) (  )   (  ))     ) _)(   )  )  )
                 ( (  ( \ ) (    (_  ( ) ( )  )   ) )  )) ( )
                  (  (   (  (   (_ ( ) ( _    )  ) (  )  )   )
                 ( (  ( (  (  )     (_  )  ) )  _)   ) _( ( )
                  ((  (   )(    (     _    )   _) _(_ (  (_ )
                   (_((__(_(__(( ( ( |  ) ) ) )_))__))_)___)
                   ((__)        \\||lll|l||///          \_))
                            (   /(/ (  )  ) )\   )
                          (    ( ( ( | | ) ) )\   )
                           (   /(| / ( )) ) ) )) )
                         (     ( ((((_(|)_)))))     )
                          (      ||\(|(|)|/||     )
                        (        |(||(||)||||        )
                          (     //|/l|||)|\\ \     )
                        (/ / //  /|//||||\\  \ \  \ _)
-------------------------------------------------------------------------------
Node: 9c0815204fea
-------------------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/local/lib/python3.6/site-packages/flask/app.py", line 1982, in wsgi_app
    response = self.full_dispatch_request()
  File "/usr/local/lib/python3.6/site-packages/flask/app.py", line 1614, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/usr/local/lib/python3.6/site-packages/flask/app.py", line 1517, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/usr/local/lib/python3.6/site-packages/flask/_compat.py", line 33, in reraise
    raise value
  File "/usr/local/lib/python3.6/site-packages/flask/app.py", line 1612, in full_dispatch_request
    rv = self.dispatch_request()
  File "/usr/local/lib/python3.6/site-packages/flask/app.py", line 1598, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/usr/local/lib/python3.6/site-packages/flask_appbuilder/security/decorators.py", line 26, in wraps
    return f(self, *args, **kwargs)
  File "/airflow/airflow/utils/db.py", line 69, in wrapper
    return func(*args, **kwargs)
  File "/airflow/airflow/www_rbac/views.py", line 208, in index
    view_only=is_view_only(g.user))
  File "/airflow/airflow/www_rbac/security.py", line 170, in is_view_only
    user_roles = user.roles
  File "/usr/local/lib/python3.6/site-packages/werkzeug/local.py", line 347, in __getattr__
    return getattr(self._get_current_object(), name)
AttributeError: 'AnonymousUserMixin' object has no attribute 'roles'

This looks like something on our side

Fokko · 2018-02-28T09:45:08Z

When I go to the {Tree,Dag,..}view of the dag, the UI is full width. Is this an undocumented feature, of intentionally?

Fokko · 2018-02-28T09:50:57Z

@jgao54 can you rebase on master? It looks very good, a very nice improvement on the UI and permission management! Unfortunately, I'm having some troubles with sqlite and the updated timezone stuff:

[2018-02-28 09:48:21,574] {filters.py:92} WARNING - Filter type not supported for column: timestamp
[2018-02-28 09:48:21,575] {filters.py:92} WARNING - Filter type not supported for column: execution_date
[2018-02-28 09:48:21,575] {filters.py:92} WARNING - Filter type not supported for column: execution_date
[2018-02-28 09:48:21,575] {filters.py:92} WARNING - Filter type not supported for column: timestamp
[2018-02-28 09:48:21,576] {forms.py:85} ERROR - Column timestamp Type not supported
[2018-02-28 09:48:21,576] {forms.py:85} ERROR - Column execution_date Type not supported
[2018-02-28 09:48:21,577] {forms.py:85} ERROR - Column execution_date Type not supported
[2018-02-28 09:48:21,577] {forms.py:85} ERROR - Column timestamp Type not supported
[2018-02-28 09:48:21,578] {forms.py:85} ERROR - Column execution_date Type not supported
[2018-02-28 09:48:21,578] {forms.py:85} ERROR - Column timestamp Type not supported
[2018-02-28 09:48:21,579] {base.py:352} INFO - Registering class SlaMissModelView on menu SLA Misses
[2018-02-28 09:48:21,602] {filters.py:92} WARNING - Filter type not supported for column: execution_date
[2018-02-28 09:48:21,602] {filters.py:92} WARNING - Filter type not supported for column: start_date
[2018-02-28 09:48:21,602] {filters.py:92} WARNING - Filter type not supported for column: end_date
[2018-02-28 09:48:21,603] {filters.py:92} WARNING - Filter type not supported for column: execution_date
[2018-02-28 09:48:21,604] {filters.py:92} WARNING - Filter type not supported for column: start_date
[2018-02-28 09:48:21,605] {filters.py:92} WARNING - Filter type not supported for column: end_date
[2018-02-28 09:48:21,605] {filters.py:92} WARNING - Filter type not supported for column: queued_dttm
[2018-02-28 09:48:21,607] {forms.py:85} ERROR - Column execution_date Type not supported
[2018-02-28 09:48:21,608] {forms.py:85} ERROR - Column start_date Type not supported
[2018-02-28 09:48:21,608] {forms.py:85} ERROR - Column end_date Type not supported
[2018-02-28 09:48:21,609] {forms.py:85} ERROR - Column start_date Type not supported
[2018-02-28 09:48:21,609] {forms.py:85} ERROR - Column end_date Type not supported
[2018-02-28 09:48:21,610] {forms.py:85} ERROR - Column queued_dttm Type not supported
[2018-02-28 09:48:21,611] {forms.py:85} ERROR - Column start_date Type not supported
[2018-02-28 09:48:21,611] {forms.py:85} ERROR - Column end_date Type not supported
[2018-02-28 09:48:21,612] {forms.py:85} ERROR - Column queued_dttm Type not supported

@bolkedebruin PTAL

ashb · 2018-02-28T17:47:55Z

I get similar logs using Postgres. Those "registering class" at info (even assuming we fix the errors) are too chatty - we might need to tweak the log levels for FAB to so that we don't create 100s of log lines form the webserver every time we reload the workers.

OR: Do we still need the automatic worker cycling that we do? Do either of you know it that added to work around a specific bug/problem that might not be needed any more?

Fokko · 2018-02-28T20:32:08Z

@ashb I don't really mind the lines at startup. I don't periodically restart the worker at the different airflow instances that I'm running.

jgao54 · 2018-03-01T21:36:37Z

Thank you for reviewing!

@Fokko
"When I try to install using pip install -e .[devel], I get the following notification:"
Hmm I was not able to replicate this. Flask-appbuilder is specified in install_requires, it should be installed with the above pip command. Did you see any error message while running pip install command?

Can we make the title Airflow instead of FAB?
Fixed

When I try to make all the users just Admin...
Fixed, good catch thanks!

When I go to the {Tree,Dag,..}view of the dag, the UI is full width. Is this an undocumented feature, of intentionally?
I think the full-width change is in the non-rbac version of airflow as well, perhaps your browser is caching the old UI?

Unfortunately, I'm having some troubles with sqlite and the updated timezone stuff:
This should be fixed with Flask-Appbuilder 1.9.7, which isn't released yet. If you run the latest master of FAB (or the Flask-AppBuilder.tar.gz that I attached to this PR) , it should disappear.

@ashb
Let me looking into the logging level a bit. I'm not familiar with why we have the worker cycling.

jgao54 · 2018-03-02T03:00:01Z

Modified the flask_appbuilder logging level in DEFAULT_LOGGING_CONFIG so it defaults to 'WARN'.

jgao54 · 2018-03-02T06:30:03Z

The failed tests are resulting from tz issue, so I'm waiting on fab release. Otherwise I believe all the issues raised above are addressed.

jgao54 · 2018-03-21T22:47:17Z

@bolkedebruin Added more UI tests. I missed all the UI tests from core.py. Thanks for catching that.

mistercrunch · 2018-03-21T23:06:50Z

I missed all the UI tests from core.py.

we should really refactor www tests out of core.py ...

jgao54 · 2018-03-22T15:55:01Z

+1
They are added to www_rbac/test_views.py in this PR. I will create a separate PR to refactor the www/ tests.

Fokko · 2018-03-23T08:12:14Z

+1 LGTM, looking forward to this

bolkedebruin · 2018-03-23T08:15:02Z

Merging!

bolkedebruin · 2018-03-23T08:17:24Z

galak75 · 2018-03-28T17:03:40Z

Awesome work! Can't wait having this in a release! it looks like it will be included in 1.10.0 (fix version in AIRFLOW-85 Jira ticket). Any idea about the planned release date?

The Jira releases view could be the right place to provide such information. But it seems outdated for now.

gauthiermartin · 2018-03-28T19:26:32Z

Great work ! @jgao54 or anyone aware of any DAG access control request ungoing project ?

jgao54 · 2018-04-13T17:51:01Z

@gauthiermartin
@feng-tao has picked this up, and has a PR out #3197

gauthiermartin · 2018-04-19T14:49:59Z

@jgao54 Thank you

rsubra13 · 2018-04-23T20:50:19Z

@jgao54 Anyidea when this is going to be released?

criccomini · 2018-04-24T17:10:17Z

@rsubra13 it's in the 1.10 release, which is currently in beta

rsubra13 · 2018-04-24T23:53:20Z

Thanks @criccomini ! Looking forward to it.

rushtokunal · 2018-05-10T02:48:37Z

@jgao54 I have been waiting for RBAC for such a long time, thanks for this functionality 👍
I'm facing one issue though, i need to communicate with my ldap server on secure port 636 and also specify the cert, is there any way i can do it? appreciate any help

AUTH_TYPE = AUTH_LDAP
AUTH_LDAP_SERVER = "ldaps://myldapserver.com:636"
AUTH_LDAP_USE_TLS = True

mistercrunch · 2018-05-10T03:48:00Z

Related, and a better place to ask: dpgaspar/Flask-AppBuilder#740

rushtokunal · 2018-05-10T04:56:56Z

I was also checking the authentication using OPENID, even though i successfully sign in with Okta, the Airflow application says access denied with and present me the login screen and the Okta logo too doesnt appear

in webserver_config.py
OPENID_PROVIDERS = [
{ 'name': 'OKTA', 'url': 'https://dev-947022.oktapreview.com' }]

developer Okta configuration

Final result after successful Okta login:

rushtokunal · 2018-05-14T03:39:04Z

@jgao54 Thanks I was able to resolve this issue, by the way i am facing an issue with MySQL with this feature, I have raised Jira Issue https://issues.apache.org/jira/browse/AIRFLOW-2459?filter=-2

jensenity · 2018-06-27T03:03:15Z

Hi @jgao54

So I tried running airflow create_admin but

airflow: error: argument subcommand: invalid choice: 'create_admin' (choose from 'backfill', 'list_dag_runs', 'list_tasks', 'clear', 'pause', 'unpause', 'trigger_dag', 'delete_dag', 'pool', 'variables', 'kerberos', 'render', 'run', 'initdb', 'list_dags', 'dag_state', 'task_failed_deps', 'task_state', 'serve_logs', 'test', 'webserver', 'resetdb', 'upgradedb', 'scheduler', 'worker', 'flower', 'version', 'connections', 'create_user')

I checked the cli.py and it doesn't have a create_admin function. Am I doing it right?

feng-tao · 2018-06-27T03:32:35Z

hey @jensenity , the command would be airflow create_user and specify with --role admin

jensenity · 2018-07-06T06:38:06Z

Thanks @feng-tao ! This feature is really amazing! Thank you for this!

feng-tao · 2018-07-06T06:39:51Z

hey @jensenity , @jgao54 is the one who implemented RBAC feature....

Closes apache#3015 from jgao54/rbac

vora001 · 2020-03-09T18:32:44Z

@jgao54 Thanks I was able to resolve this issue, by the way i am facing an issue with MySQL with this feature, I have raised Jira Issue https://issues.apache.org/jira/browse/AIRFLOW-2459?filter=-2

Hi @rushtokunal How did you fix the okta login issue

Abhishekchechani · 2020-04-10T18:50:00Z

I have enabled Airflow with LDAP credentials with FAB. But the problem is that all the users have the Admin role after self registration, because we have given the below value in webserver_config.py file AUTH_USER_REGISTRATION_ROLE = “Admin”.

How can we dynamically assign the AUTH_USER_REGISTRATION_ROLE based on the users LDAP role? We have different users like tester, developer and operation user but with the above webserver config file all users are automatically assigned the Admin role via Flask_appbuilder.security under manager.py file.

Is there any way to create the customize manager file and while login refer this customize file instead of Flask_appbuilder.security.manager.py file.

Because I can not change directly in flask_appbuilder.security manager.py file and add the our customize role and assign in AUTH_USER_REGISTRATION_ROLE based on the users LDAP role

thesuperzapper · 2020-05-20T12:37:44Z

@Abhishekchechani I have just created a PR in Flask-AppBuilder which implements this feature, see here.

jgao54 mentioned this pull request Feb 8, 2018

[AIRFLOW-1433] Implement FAB-backed webserver (WIP, Illustration-Only) #2536

Closed

1 task

jgao54 force-pushed the rbac branch from 52b135b to 58a5d3f Compare February 8, 2018 19:35

jgao54 changed the title ~~[WIP] [AIRFLOW-1433] Convert Airflow Webserver UI to FAB for RBAC support~~ [WIP] [AIRFLOW-85] Convert Airflow Webserver UI to FAB for RBAC support Feb 8, 2018

ashb reviewed Feb 9, 2018

View reviewed changes

jgao54 force-pushed the rbac branch 2 times, most recently from 650be24 to 045a309 Compare February 23, 2018 21:09

jgao54 force-pushed the rbac branch 4 times, most recently from cc9137a to d01e46b Compare March 2, 2018 02:59

jgao54 force-pushed the rbac branch 5 times, most recently from 3c7b27d to 37f3ce3 Compare March 13, 2018 18:54

asfgit closed this in 05e1861 Mar 23, 2018

jensenity mentioned this pull request Jun 26, 2018

www_rbac puckel/docker-airflow#202

Open

aliceabe pushed a commit to aliceabe/incubator-airflow that referenced this pull request Jan 3, 2019

[AIRFLOW-1433][AIRFLOW-85] New Airflow Webserver UI with RBAC support

cfccb05

Closes apache#3015 from jgao54/rbac

sk2991 mentioned this pull request May 28, 2020

[stable/airflow] Enable RBAC on airflow helm/charts#22560

Closed

sk2991 mentioned this pull request Jul 5, 2020

Attach roles to AD groups - Azure OAuth #9583

Closed


		FAB has built-in authentication support for DB, OAuth, OpenID, LDAP, and REMOTE_USER. The default auth type is `AUTH_DB`.

		For any other authentication type (OAuth, OpenID, LDAP, REMOTE_USER), see [this link](http://flask-appbuilder.readthedocs.io/en/latest/security.html#authentication-methods) for how to configure variables in webserver_config.py file.


		For any other authentication type (OAuth, OpenID, LDAP, REMOTE_USER), see [this link](http://flask-appbuilder.readthedocs.io/en/latest/security.html#authentication-methods) for how to configure variables in webserver_config.py file.

		Once you modify your config file, run `airflow initdb` to generate new tables for RBAC support (these tables will have the prefix `ab_`).

		@@ -1116,6 +1129,34 @@ def kerberos(args): # noqa
		airflow.security.kerberos.run()


		def create_admin(args):

		@@ -0,0 +1,28 @@
		/*! ========================================================================

[AIRFLOW-85] Convert Airflow Webserver UI to FAB for RBAC support #3015

[AIRFLOW-85] Convert Airflow Webserver UI to FAB for RBAC support #3015

Conversation

jgao54 commented Feb 8, 2018 • edited Loading

JIRA

Description

Tests

Commits

ashb left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jgao54 Feb 14, 2018 • edited Loading

Choose a reason for hiding this comment

jgao54 Feb 14, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jgao54 Feb 12, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jgao54 Feb 12, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yaswanth477 commented Feb 13, 2018

jgao54 commented Feb 13, 2018

harikak84 commented Feb 17, 2018

jgao54 commented Feb 21, 2018

jgao54 commented Feb 28, 2018 • edited Loading

Fokko commented Feb 28, 2018

Fokko commented Feb 28, 2018

Fokko commented Feb 28, 2018

Fokko commented Feb 28, 2018

Fokko commented Feb 28, 2018

ashb commented Feb 28, 2018

Fokko commented Feb 28, 2018

jgao54 commented Mar 1, 2018 • edited Loading

jgao54 commented Mar 2, 2018

jgao54 commented Mar 2, 2018

jgao54 commented Mar 21, 2018

mistercrunch commented Mar 21, 2018 • edited Loading

jgao54 commented Mar 22, 2018 • edited Loading

Fokko commented Mar 23, 2018

bolkedebruin commented Mar 23, 2018

bolkedebruin commented Mar 23, 2018 • edited Loading

galak75 commented Mar 28, 2018

gauthiermartin commented Mar 28, 2018

jgao54 commented Apr 13, 2018

gauthiermartin commented Apr 19, 2018

rsubra13 commented Apr 23, 2018

criccomini commented Apr 24, 2018

rsubra13 commented Apr 24, 2018

rushtokunal commented May 10, 2018

mistercrunch commented May 10, 2018

rushtokunal commented May 10, 2018

rushtokunal commented May 14, 2018

jensenity commented Jun 27, 2018 • edited Loading

feng-tao commented Jun 27, 2018

jensenity commented Jul 6, 2018

feng-tao commented Jul 6, 2018

vora001 commented Mar 9, 2020

Abhishekchechani commented Apr 10, 2020

thesuperzapper commented May 20, 2020

jgao54 commented Feb 8, 2018 •

edited

Loading

jgao54 Feb 14, 2018 •

edited

Loading

jgao54 Feb 14, 2018 •

edited

Loading

jgao54 Feb 12, 2018 •

edited

Loading

jgao54 Feb 12, 2018 •

edited

Loading

jgao54 commented Feb 28, 2018 •

edited

Loading

jgao54 commented Mar 1, 2018 •

edited

Loading

mistercrunch commented Mar 21, 2018 •

edited

Loading

jgao54 commented Mar 22, 2018 •

edited

Loading

bolkedebruin commented Mar 23, 2018 •

edited

Loading

jensenity commented Jun 27, 2018 •

edited

Loading