Description
The Airflow BaseAuthManager interface provides a number of optional methods for doing batch authorization of user requests, e.g. when accessing the /dags UI the default implementation requests user authorization for every dag.
Use case/motivation
Implement the following batch authorization methods in the KeycloakAuthManager to reduce the required number of HTTP calls to keycloak:
-
batch_is_authorized_connection: Batch version of is_authorized_connection. If not overridden, it calls is_authorized_connection for every single item.
-
batch_is_authorized_dag: Batch version of is_authorized_dag. If not overridden, it calls is_authorized_dag for every single item.
-
batch_is_authorized_pool: Batch version of is_authorized_pool. If not overridden, it calls is_authorized_pool for every single item.
-
batch_is_authorized_variable: Batch version of is_authorized_variable. If not overridden, it calls is_authorized_variable for every single item.
-
filter_authorized_connections: Given a list of connection IDs (conn_id), return the list of connection IDs the user has access to. If not overridden, it calls is_authorized_connection for every single connection passed as parameter.
-
filter_authorized_dag_ids: Given a list of Dag IDs, return the list of Dag IDs the user has access to. If not overridden, it calls is_authorized_dag for every single Dag passes as parameter. (Already implemented)
-
filter_authorized_pools: Given a list of pool names, return the list of pool names the user has access to. If not overridden, it calls is_authorized_pool for every single pool passed as parameter.
-
filter_authorized_variables: Given a list of variable keys, return the list of variable keys the user has access to. If not overridden, it calls is_authorized_variable for every single variable passed as parameter.
Related issues
#69041
Are you willing to submit a PR?
Code of Conduct
Description
The Airflow
BaseAuthManagerinterface provides a number of optional methods for doing batch authorization of user requests, e.g. when accessing the/dagsUI the default implementation requests user authorization for every dag.Use case/motivation
Implement the following batch authorization methods in the
KeycloakAuthManagerto reduce the required number of HTTP calls to keycloak:batch_is_authorized_connection: Batch version of is_authorized_connection. If not overridden, it calls is_authorized_connection for every single item.batch_is_authorized_dag: Batch version of is_authorized_dag. If not overridden, it calls is_authorized_dag for every single item.batch_is_authorized_pool: Batch version of is_authorized_pool. If not overridden, it calls is_authorized_pool for every single item.batch_is_authorized_variable: Batch version of is_authorized_variable. If not overridden, it calls is_authorized_variable for every single item.filter_authorized_connections: Given a list of connection IDs (conn_id), return the list of connection IDs the user has access to. If not overridden, it calls is_authorized_connection for every single connection passed as parameter.filter_authorized_dag_ids: Given a list of Dag IDs, return the list of Dag IDs the user has access to. If not overridden, it calls is_authorized_dag for every single Dag passes as parameter. (Already implemented)filter_authorized_pools: Given a list of pool names, return the list of pool names the user has access to. If not overridden, it calls is_authorized_pool for every single pool passed as parameter.filter_authorized_variables: Given a list of variable keys, return the list of variable keys the user has access to. If not overridden, it calls is_authorized_variable for every single variable passed as parameter.Related issues
#69041
Are you willing to submit a PR?
Code of Conduct