Skip to content

Implement bulk authorization methods in KeycloakAuthManager #70582

Description

@stephen-bracken

Description

The Airflow BaseAuthManager interface provides a number of optional methods for doing batch authorization of user requests, e.g. when accessing the /dags UI the default implementation requests user authorization for every dag.

Use case/motivation

Implement the following batch authorization methods in the KeycloakAuthManager to reduce the required number of HTTP calls to keycloak:

  • batch_is_authorized_connection: Batch version of is_authorized_connection. If not overridden, it calls is_authorized_connection for every single item.

  • batch_is_authorized_dag: Batch version of is_authorized_dag. If not overridden, it calls is_authorized_dag for every single item.

  • batch_is_authorized_pool: Batch version of is_authorized_pool. If not overridden, it calls is_authorized_pool for every single item.

  • batch_is_authorized_variable: Batch version of is_authorized_variable. If not overridden, it calls is_authorized_variable for every single item.

  • filter_authorized_connections: Given a list of connection IDs (conn_id), return the list of connection IDs the user has access to. If not overridden, it calls is_authorized_connection for every single connection passed as parameter.

  • filter_authorized_dag_ids: Given a list of Dag IDs, return the list of Dag IDs the user has access to. If not overridden, it calls is_authorized_dag for every single Dag passes as parameter. (Already implemented)

  • filter_authorized_pools: Given a list of pool names, return the list of pool names the user has access to. If not overridden, it calls is_authorized_pool for every single pool passed as parameter.

  • filter_authorized_variables: Given a list of variable keys, return the list of variable keys the user has access to. If not overridden, it calls is_authorized_variable for every single variable passed as parameter.

Related issues

#69041

Are you willing to submit a PR?

  • Yes I am willing to submit a PR!

Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions