Create FAB provider and move FAB auth manager in it

.github/ISSUE_TEMPLATE/airflow_providers_bug_report.yml

@@ -60,6 +60,7 @@ body:
         - docker
         - elasticsearch
         - exasol
+        - fab
         - facebook
         - ftp
         - github

.pre-commit-config.yaml

@@ -510,7 +510,6 @@ repos:
         exclude: >
           (?x)
           ^airflow/api_connexion/openapi/v1.yaml$|
-          ^airflow/auth/managers/fab/security_manager/|
           ^airflow/cli/commands/webserver_command.py$|
           ^airflow/cli/commands/internal_api_command.py$|
           ^airflow/config_templates/|
@@ -525,6 +524,7 @@ repos:
           ^airflow/providers/apache/spark/hooks/|
           ^airflow/providers/apache/spark/operators/|
           ^airflow/providers/exasol/hooks/exasol.py$|
+          ^airflow/providers/fab/auth_manager/security_manager/|
           ^airflow/providers/google/cloud/hooks/bigquery.py$|
           ^airflow/providers/google/cloud/operators/cloud_build.py$|
           ^airflow/providers/google/cloud/operators/dataproc.py$|

CONTRIBUTING.rst

@@ -674,7 +674,7 @@ apache.kylin, apache.livy, apache.pig, apache.pinot, apache.spark, apache.sqoop,
 apprise, arangodb, asana, async, atlas, atlassian.jira, aws, azure, cassandra, celery, cgroups,
 cloudant, cncf.kubernetes, cohere, common.io, common.sql, crypto, dask, daskexecutor, databricks,
 datadog, dbt.cloud, deprecated_api, devel, devel_all, devel_ci, devel_hadoop, dingding, discord,
-doc, doc_gen, docker, druid, elasticsearch, exasol, facebook, ftp, gcp, gcp_api, github,
+doc, doc_gen, docker, druid, elasticsearch, exasol, fab, facebook, ftp, gcp, gcp_api, github,
 github_enterprise, google, google_auth, grpc, hashicorp, hdfs, hive, http, imap, influxdb, jdbc,
 jenkins, kerberos, kubernetes, ldap, leveldb, microsoft.azure, microsoft.mssql, microsoft.psrp,
 microsoft.winrm, mongo, mssql, mysql, neo4j, odbc, openai, openfaas, openlineage, opensearch,

INSTALL

@@ -100,7 +100,7 @@ apache.kylin, apache.livy, apache.pig, apache.pinot, apache.spark, apache.sqoop,
 apprise, arangodb, asana, async, atlas, atlassian.jira, aws, azure, cassandra, celery, cgroups,
 cloudant, cncf.kubernetes, cohere, common.io, common.sql, crypto, dask, daskexecutor, databricks,
 datadog, dbt.cloud, deprecated_api, devel, devel_all, devel_ci, devel_hadoop, dingding, discord,
-doc, doc_gen, docker, druid, elasticsearch, exasol, facebook, ftp, gcp, gcp_api, github,
+doc, doc_gen, docker, druid, elasticsearch, exasol, fab, facebook, ftp, gcp, gcp_api, github,
 github_enterprise, google, google_auth, grpc, hashicorp, hdfs, hive, http, imap, influxdb, jdbc,
 jenkins, kerberos, kubernetes, ldap, leveldb, microsoft.azure, microsoft.mssql, microsoft.psrp,
 microsoft.winrm, mongo, mssql, mysql, neo4j, odbc, openai, openfaas, openlineage, opensearch,

airflow/api/auth/backend/basic_auth.py

@@ -17,23 +17,23 @@
 """
 This module is deprecated.
 
-Please use :mod:`airflow.auth.managers.fab.api.auth.backend.basic_auth` instead.
+Please use :mod:`airflow.providers.fab.auth_manager.api.auth.backend.basic_auth` instead.
 """
 from __future__ import annotations
 
 import warnings
 from typing import TYPE_CHECKING, Any, Callable
 
-import airflow.auth.managers.fab.api.auth.backend.basic_auth as fab_basic_auth
+import airflow.providers.fab.auth_manager.api.auth.backend.basic_auth as fab_basic_auth
 from airflow.exceptions import RemovedInAirflow3Warning
 
 if TYPE_CHECKING:
-    from airflow.auth.managers.fab.models import User
+    from airflow.providers.fab.auth_manager.models import User
 
 CLIENT_AUTH: tuple[str, str] | Any | None = None
 
 warnings.warn(
-    "This module is deprecated. Please use `airflow.auth.managers.fab.api.auth.backend.basic_auth` instead.",
+    "This module is deprecated. Please use `airflow.providers.fab.auth_manager.api.auth.backend.basic_auth` instead.",
     RemovedInAirflow3Warning,
     stacklevel=2,
 )

airflow/api/auth/backend/kerberos_auth.py

@@ -140,7 +140,7 @@ def requires_authentication(function: T, find_user: Callable[[str], BaseUser] |
     if not find_user:
         warnings.warn(
             "This module is deprecated. Please use "
-            "`airflow.auth.managers.fab.api.auth.backend.kerberos_auth` instead.",
+            "`airflow.providers.fab.auth_manager.api.auth.backend.kerberos_auth` instead.",
             RemovedInAirflow3Warning,
             stacklevel=2,
         )

airflow/api_connexion/endpoints/forward_to_fab_endpoint.py

@@ -20,7 +20,7 @@
 from typing import TYPE_CHECKING
 
 from airflow.api_connexion.exceptions import BadRequest
-from airflow.auth.managers.fab.api_endpoints import role_and_permission_endpoint, user_endpoint
+from airflow.providers.fab.auth_manager.api_endpoints import role_and_permission_endpoint, user_endpoint
 from airflow.www.extensions.init_auth_manager import get_auth_manager
 
 if TYPE_CHECKING:
@@ -37,7 +37,7 @@ def _require_fab(func: Callable) -> Callable:
     """
 
     def inner(*args, **kwargs):
-        from airflow.auth.managers.fab.fab_auth_manager import FabAuthManager
+        from airflow.providers.fab.auth_manager.fab_auth_manager import FabAuthManager
 
         auth_mgr = get_auth_manager()
         if not isinstance(auth_mgr, FabAuthManager):

airflow/api_connexion/schemas/role_and_permission_schema.py

@@ -21,7 +21,7 @@
 from marshmallow import Schema, fields
 from marshmallow_sqlalchemy import SQLAlchemySchema, auto_field
 
-from airflow.auth.managers.fab.models import Action, Permission, Resource, Role
+from airflow.providers.fab.auth_manager.models import Action, Permission, Resource, Role
 
 
 class ActionSchema(SQLAlchemySchema):

airflow/api_connexion/schemas/user_schema.py

@@ -23,7 +23,7 @@
 
 from airflow.api_connexion.parameters import validate_istimezone
 from airflow.api_connexion.schemas.role_and_permission_schema import RoleSchema
-from airflow.auth.managers.fab.models import User
+from airflow.providers.fab.auth_manager.models import User
 
 
 class UserCollectionItemSchema(SQLAlchemySchema):

airflow/api_connexion/security.py

@@ -70,7 +70,7 @@ def requires_access(permissions: Sequence[tuple[str, str]] | None = None) -> Cal
         RemovedInAirflow3Warning,
         stacklevel=2,
     )
-    from airflow.auth.managers.fab.decorators.auth import _requires_access_fab
+    from airflow.providers.fab.auth_manager.decorators.auth import _requires_access_fab
 
     return _requires_access_fab(permissions)
 

airflow/auth/managers/fab/api/auth/backend/basic_auth.py

@@ -14,55 +14,38 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-"""Basic authentication backend."""
-from __future__ import annotations
+"""
+This module is deprecated.
 
-from functools import wraps
-from typing import TYPE_CHECKING, Any, Callable, TypeVar, cast
+Please use :mod:`airflow.providers.fab.auth_manager.api.auth.backend.basic_auth` instead.
+"""
+from __future__ import annotations
 
-from flask import Response, request
-from flask_appbuilder.const import AUTH_LDAP
-from flask_login import login_user
+import warnings
+from typing import TYPE_CHECKING, Any, Callable
 
-from airflow.utils.airflow_flask_app import get_airflow_app
+import airflow.providers.fab.auth_manager.api.auth.backend.basic_auth as fab_basic_auth
+from airflow.exceptions import RemovedInAirflow3Warning
 
 if TYPE_CHECKING:
-    from airflow.auth.managers.fab.models import User
+    from airflow.providers.fab.auth_manager.models import User
 
 CLIENT_AUTH: tuple[str, str] | Any | None = None
 
-T = TypeVar("T", bound=Callable)
+warnings.warn(
+    "This module is deprecated. Please use `airflow.providers.fab.auth_manager.api.auth.backend.basic_auth` instead.",
+    RemovedInAirflow3Warning,
+    stacklevel=2,
+)
 
 
 def init_app(_):
-    """Initialize authentication backend."""
+    fab_basic_auth.init_app(_)
 
 
 def auth_current_user() -> User | None:
-    """Authenticate and set current user if Authorization header exists."""
-    auth = request.authorization
-    if auth is None or not auth.username or not auth.password:
-        return None
-
-    ab_security_manager = get_airflow_app().appbuilder.sm
-    user = None
-    if ab_security_manager.auth_type == AUTH_LDAP:
-        user = ab_security_manager.auth_user_ldap(auth.username, auth.password)
-    if user is None:
-        user = ab_security_manager.auth_user_db(auth.username, auth.password)
-    if user is not None:
-        login_user(user, remember=False)
-    return user
-
-
-def requires_authentication(function: T):
-    """Decorate functions that require authentication."""
+    return fab_basic_auth.auth_current_user()
 
-    @wraps(function)
-    def decorated(*args, **kwargs):
-        if auth_current_user() is not None:
-            return function(*args, **kwargs)
-        else:
-            return Response("Unauthorized", 401, {"WWW-Authenticate": "Basic"})
 
-    return cast(T, decorated)
+def requires_authentication(function: Callable):
+    return fab_basic_auth.requires_authentication(function)

airflow/auth/managers/fab/api/auth/backend/kerberos_auth.py

@@ -15,25 +15,28 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
+"""
+This module is deprecated.
+
+Please use :mod:`airflow.providers.fab.auth_manager.api.auth.backend.kerberos_auth` instead.
+"""
 from __future__ import annotations
 
-import logging
-from functools import partial
+import warnings
 from typing import Any
 
 from requests_kerberos import HTTPKerberosAuth
 
-from airflow.api.auth.backend.kerberos_auth import (
-    init_app as base_init_app,
-    requires_authentication as base_requires_authentication,
-)
-from airflow.utils.airflow_flask_app import get_airflow_app
-
-log = logging.getLogger(__name__)
+import airflow.providers.fab.auth_manager.api.auth.backend.kerberos_auth as fab_kerberos_auth
+from airflow.exceptions import RemovedInAirflow3Warning
 
 CLIENT_AUTH: tuple[str, str] | Any | None = HTTPKerberosAuth(service="airflow")
 
-init_app = base_init_app
-requires_authentication = partial(
-    base_requires_authentication, find_user=get_airflow_app().appbuilder.sm.find_user
+warnings.warn(
+    "This module is deprecated. Please use `airflow.providers.fab.auth_manager.api.auth.backend.kerberos_auth` instead.",
+    RemovedInAirflow3Warning,
+    stacklevel=2,
 )
+
+init_app = fab_kerberos_auth.init_app
+requires_authentication = fab_kerberos_auth.requires_authentication