Provide login endpoint for the REST API with JWT authentication method by ephraimbuddy · Pull Request #14219 · apache/airflow

ephraimbuddy · 2021-02-13T00:30:14Z

Currently, the REST API uses a separate authentication method to the webserver authentication. The current authentication method through the auth_backend won't allow us to build a modern UI based on the REST API. This is because it's too flexible. Users can customise it and if we use it for a new UI, it posses the problem that misconfiguration can make the new UI to fail.

This PR seeks to add /login endpoint with jwt authentication backend. This will help us to build a new UI using the REST API.
The JWT authentication works alongside other auth_backends.

The idea is to create a separate authentication for accessing the REST API without failure. When the /login endpoint is requested with email and password. If the email and password are correct, a jwt token is generated for the request and sent back together with the user data. This token can then be used in subsequent requests to other endpoints and are verified/authenticated.

The token is signed with an expiration time which I took from the session_lifetime_minutes configuration.

User data to be returned after a successful login is also being worked on in this PR.

As I want to return the full user data, I'm also working on the permission and role data

Note: auth_backend still works as this new auth backend is just an addition and strictly for v1 stable API

^ Add meaningful description above

Read the Pull Request Guidelines for more information.
In case of fundamental code change, Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in UPDATING.md.

github-actions · 2021-02-13T00:33:34Z

The Workflow run is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Backport packages$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*.

github-actions · 2021-02-13T00:38:54Z

The Workflow run is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Backport packages$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*.

mik-laj · 2021-02-13T10:02:05Z

Can you add a little more docs?

ephraimbuddy · 2021-02-14T11:09:35Z

Can you add a little more docs?

Hi @mik-laj , I have provided more info. Let me know what you think. Thanks

github-actions · 2021-02-14T11:53:11Z

The Workflow run is cancelling this PR. Building images for the PR has failed. Follow the the workflow link to check the reason.

github-actions · 2021-02-14T12:27:07Z

The Workflow run is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Backport packages$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*.

ashb

We need to think more about how this plays with the configurable/pluggable auth backends.

As it's written now it only works for U:P which is far from ideal

github-actions · 2021-02-15T14:20:55Z

The Workflow run is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Backport packages$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*.

github-actions · 2021-02-15T14:21:25Z

The Workflow run is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Backport packages$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*.

github-actions · 2021-02-16T02:08:52Z

The Workflow run is cancelling this PR. Building images for the PR has failed. Follow the the workflow link to check the reason.

github-actions · 2021-02-16T15:27:38Z

The Workflow run is cancelling this PR. Building images for the PR has failed. Follow the the workflow link to check the reason.

github-actions · 2021-02-18T14:47:13Z

The Workflow run is cancelling this PR. Building images for the PR has failed. Follow the the workflow link to check the reason.

github-actions · 2021-02-18T16:15:33Z

The Workflow run is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Backport packages$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*.

github-actions · 2021-02-18T21:22:31Z

The Workflow run is cancelling this PR. Building images for the PR has failed. Follow the the workflow link to check the reason.

ephraimbuddy · 2021-02-19T11:04:24Z

Currently, I believe this can handle any type of authentication. The /login endpoint just looks for current user in security manager, and if there is, it generates a token.

If the endpoint is called with basic authentication header, it verifies and logs the user in and then generates the auth token. If not called with any authentication header, it checks for current_user which might have logged in through Oauth and then generate a token. If no user is logged in, it raises 404.

I have a unittest where I used remote user and it works fine.

Any thoughts on this implementation?

ashb · 2021-02-19T11:21:10Z

Taking a look

… review

…mote_user

…cookies

…h suggestions from code review

…is time

ashb · 2021-03-23T10:37:22Z

      default: "airflow.api.auth.backend.deny_all"
+    - name: jwt_access_token_expires
+      description: How long an access token should live before it expires(in minutes).
+      version_added: 2.0.2


2.1 for new features.

ashb

The general approach of the login/logout endpoints are fine, and the way of handling JWT is okay, but the auth_current_user approach needs re-thinking.

We have essentially built a parallel auth backend system here, but one that is not pluggable (can only disable).

Instead we should use the existing auth_backend mechanism, and accept that if the user has set the mechanism to DenyAll then they won't be able to log in via the new UI.

In future we will also then extend the API to add an endpoint for the UI to introspect the server about the auth mechanisms (i.e. "Should I show a username-password form? Or should I show some 'Log In with X' buttons?)

ashb · 2021-03-23T10:57:48Z

+      description: Logout user by unsetting cookies
+      x-openapi-router-controller: airflow.api_connexion.endpoints.auth_endpoint
+      operationId: logout
+      tags: [WebserverAuth]


Suggested change

tags: [WebserverAuth]

tags: [Authentication]

ashb · 2021-03-23T10:58:02Z

+        Verify user and set jwt token in cookies
+      x-openapi-router-controller: airflow.api_connexion.endpoints.auth_endpoint
+      operationId: login
+      tags: [WebserverAuth]


Suggested change

tags: [WebserverAuth]

tags: [Authentication]

ashb · 2021-03-23T11:07:32Z

+log = logging.getLogger(__name__)
+
+
+def auth_current_user():


This isn't strictly only tied to webserver use of the API, so lets have this function live in security.py

ashb · 2021-03-23T11:08:19Z

-        raise Unauthenticated(headers=response.headers)
+    if response.status_code == 200:
+        return
+    if auth_current_user():


By having this here, it means that any/all requests would accept and process Authorization headers, which is probably not what we want?

ephraimbuddy · 2021-03-26T21:24:03Z

closing this for #15042

boring-cyborg Bot added the area:API Airflow's REST/HTTP API label Feb 13, 2021

ephraimbuddy mentioned this pull request Feb 13, 2021

Authentication astronomer/airflow-ui#13

Open

turbaszek reviewed Feb 13, 2021

View reviewed changes

Comment thread airflow/api_connexion/endpoints/user_endpoint.py Outdated

mik-laj self-requested a review February 13, 2021 10:01

ashb requested changes Feb 15, 2021

View reviewed changes

ephraimbuddy force-pushed the add-login-endpoint-and-jwtauth branch from e1815ca to 12cee4a Compare February 16, 2021 01:40

ephraimbuddy marked this pull request as ready for review February 17, 2021 06:52

ephraimbuddy requested a review from kaxil as a code owner February 17, 2021 06:52

ephraimbuddy force-pushed the add-login-endpoint-and-jwtauth branch from a680ffc to 64e02d9 Compare February 18, 2021 14:16

ephraimbuddy force-pushed the add-login-endpoint-and-jwtauth branch from 64e02d9 to 5b9bb91 Compare February 18, 2021 15:23

ephraimbuddy force-pushed the add-login-endpoint-and-jwtauth branch 2 times, most recently from 7d7f585 to c1a69c6 Compare February 18, 2021 20:48

jhtimmins reviewed Feb 19, 2021

View reviewed changes

Comment thread airflow/api_connexion/openapi/v1.yaml Outdated

ephraimbuddy force-pushed the add-login-endpoint-and-jwtauth branch 2 times, most recently from 56c5929 to 41ce948 Compare February 25, 2021 21:10

ephraimbuddy added 22 commits March 22, 2021 09:40

add tests for schema and endpoint

a1eac3a

fix api spec and apply more review suggestions

bd11dcc

remove username and password schema in api spec and use headers as in…

19284fc

… review

add more tests and improve code

e37316d

Don't handle auth in login endpoint and make login endpoint handle re…

71d31d0

…mote_user

Update permission names and make login auth more robust

a28dacf

Use remote user auth backend in test

89f0056

Use flask_jwt_extended, minimize PR and store JWT in httpOnly cookies

fd0d320

fixup! Use flask_jwt_extended, minimize PR and store JWT in httpOnly …

a0af676

…cookies

Use auto refreshing of tokens and add models back in openapi spec wit…

7ffaa5e

…h suggestions from code review

improve code and test

4e1a9f2

Add configuration to disable DB login for REST API

e6a68b3

fixup! Add configuration to disable DB login for REST API

586b5d6

log exception and fix pylint

c011305

apply suggestion from code review

d50811f

Remove role and Permission models as they are not needed at this time

d3f7225

fixup! Remove role and Permission models as they are not needed at th…

0894744

…is time

Clear db pools during test setup

b25f2aa

Resolve conflict

4ae0322

Move auth code to security manager and fix tests

17fdee5

add back mistakenly deleted test_user_endpoint

ef4fdb2

Do not move role/permissions in openapi in this PR

b3dc520

ephraimbuddy force-pushed the add-login-endpoint-and-jwtauth branch from 8e32352 to b3dc520 Compare March 22, 2021 08:40

ephraimbuddy added the AIP-38 Modern Web Application label Mar 22, 2021

ashb reviewed Mar 23, 2021

View reviewed changes

ashb requested changes Mar 23, 2021

View reviewed changes

bbovenzi mentioned this pull request Mar 24, 2021

Add basic authentication to new UI #14988

Merged

ephraimbuddy closed this Mar 26, 2021

ephraimbuddy deleted the add-login-endpoint-and-jwtauth branch March 26, 2021 21:24

Uh oh!

Conversation

ephraimbuddy commented Feb 13, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Feb 13, 2021

Uh oh!

github-actions Bot commented Feb 13, 2021

Uh oh!

Uh oh!

mik-laj commented Feb 13, 2021

Uh oh!

ephraimbuddy commented Feb 14, 2021

Uh oh!

github-actions Bot commented Feb 14, 2021

Uh oh!

github-actions Bot commented Feb 14, 2021

Uh oh!

ashb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Feb 15, 2021

Uh oh!

github-actions Bot commented Feb 15, 2021

Uh oh!

github-actions Bot commented Feb 16, 2021

Uh oh!

github-actions Bot commented Feb 16, 2021

Uh oh!

github-actions Bot commented Feb 18, 2021

Uh oh!

github-actions Bot commented Feb 18, 2021

Uh oh!

github-actions Bot commented Feb 18, 2021

Uh oh!

ephraimbuddy commented Feb 19, 2021

Uh oh!

ashb commented Feb 19, 2021

Uh oh!

Uh oh!

ashb Mar 23, 2021

Choose a reason for hiding this comment

Uh oh!

ashb left a comment

Choose a reason for hiding this comment

Uh oh!

ashb Mar 23, 2021

Choose a reason for hiding this comment

Uh oh!

ashb Mar 23, 2021

Choose a reason for hiding this comment

Uh oh!

ashb Mar 23, 2021

Choose a reason for hiding this comment

Uh oh!

ashb Mar 23, 2021

Choose a reason for hiding this comment

Uh oh!

ephraimbuddy commented Mar 26, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ephraimbuddy commented Feb 13, 2021 •

edited

Loading