From f74561dfa81f5a57bfcca07bf68b232d7f883315 Mon Sep 17 00:00:00 2001 From: vincbeck Date: Wed, 4 Sep 2024 11:51:19 -0400 Subject: [PATCH 1/6] Implement `SimpleAuthManager` --- airflow/auth/managers/simple/__init__.py | 17 ++ .../managers/simple/simple_auth_manager.py | 166 +++++++++++++ airflow/auth/managers/simple/user.py | 41 ++++ .../auth/managers/simple/views/__init__.py | 17 ++ airflow/auth/managers/simple/views/auth.py | 84 +++++++ .../default_webserver_config.py | 7 + airflow/www/static/js/login/Form.tsx | 44 ++++ airflow/www/static/js/login/index.test.tsx | 42 ++++ airflow/www/static/js/login/index.tsx | 73 ++++++ airflow/www/templates/airflow/login.html | 45 ++++ airflow/www/templates/appbuilder/navbar.html | 2 + airflow/www/webpack.config.js | 1 + tests/auth/managers/simple/__init__.py | 16 ++ .../simple/test_simple_auth_manager.py | 228 ++++++++++++++++++ tests/auth/managers/simple/test_user.py | 37 +++ tests/auth/managers/simple/views/__init__.py | 16 ++ tests/auth/managers/simple/views/test_auth.py | 78 ++++++ 17 files changed, 914 insertions(+) create mode 100644 airflow/auth/managers/simple/__init__.py create mode 100644 airflow/auth/managers/simple/simple_auth_manager.py create mode 100644 airflow/auth/managers/simple/user.py create mode 100644 airflow/auth/managers/simple/views/__init__.py create mode 100644 airflow/auth/managers/simple/views/auth.py create mode 100644 airflow/www/static/js/login/Form.tsx create mode 100644 airflow/www/static/js/login/index.test.tsx create mode 100644 airflow/www/static/js/login/index.tsx create mode 100644 airflow/www/templates/airflow/login.html create mode 100644 tests/auth/managers/simple/__init__.py create mode 100644 tests/auth/managers/simple/test_simple_auth_manager.py create mode 100644 tests/auth/managers/simple/test_user.py create mode 100644 tests/auth/managers/simple/views/__init__.py create mode 100644 tests/auth/managers/simple/views/test_auth.py diff --git a/airflow/auth/managers/simple/__init__.py b/airflow/auth/managers/simple/__init__.py new file mode 100644 index 0000000000000..217e5db960782 --- /dev/null +++ b/airflow/auth/managers/simple/__init__.py @@ -0,0 +1,17 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. diff --git a/airflow/auth/managers/simple/simple_auth_manager.py b/airflow/auth/managers/simple/simple_auth_manager.py new file mode 100644 index 0000000000000..9840ef7712a52 --- /dev/null +++ b/airflow/auth/managers/simple/simple_auth_manager.py @@ -0,0 +1,166 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from __future__ import annotations + +from enum import Enum +from typing import TYPE_CHECKING + +from flask import session, url_for + +from airflow.auth.managers.base_auth_manager import BaseAuthManager, ResourceMethod +from airflow.auth.managers.simple.views.auth import SimpleAuthManagerAuthenticationViews + +if TYPE_CHECKING: + from airflow.auth.managers.models.base_user import BaseUser + from airflow.auth.managers.models.resource_details import ( + AccessView, + ConfigurationDetails, + ConnectionDetails, + DagAccessEntity, + DagDetails, + DatasetDetails, + PoolDetails, + VariableDetails, + ) + from airflow.auth.managers.simple.user import SimpleAuthManagerUser + + +class SimpleAuthManagerRole(Enum): + """List of pre-defined roles in simple auth manager.""" + + # Admin role gives all permissions + ADMIN = "admin" + + # Viewer role gives all read-only permissions + VIEWER = "viewer" + + # User role gives viewer role permissions + access to DAGs + USER = "user" + + # OP role gives user role permissions + access to connections, config, pools, variables + OP = "op" + + +class SimpleAuthManager(BaseAuthManager): + """ + Simple auth manager. + + Default auth manager used in Airflow. This auth manager should not be used in production. + This auth manager is very basic and only intended for development and testing purposes. + + :param appbuilder: the flask app builder + """ + + def is_logged_in(self) -> bool: + return "user" in session + + def get_url_login(self, **kwargs) -> str: + return url_for("SimpleAuthManagerAuthenticationViews.login") + + def get_url_logout(self) -> str: + return url_for("SimpleAuthManagerAuthenticationViews.logout") + + def get_user(self) -> SimpleAuthManagerUser | None: + return session["user"] if self.is_logged_in() else None + + def is_authorized_configuration( + self, + *, + method: ResourceMethod, + details: ConfigurationDetails | None = None, + user: BaseUser | None = None, + ) -> bool: + return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + + def is_authorized_connection( + self, + *, + method: ResourceMethod, + details: ConnectionDetails | None = None, + user: BaseUser | None = None, + ) -> bool: + return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + + def is_authorized_dag( + self, + *, + method: ResourceMethod, + access_entity: DagAccessEntity | None = None, + details: DagDetails | None = None, + user: BaseUser | None = None, + ) -> bool: + return self._is_authorized( + method=method, + roles_to_allow=[SimpleAuthManagerRole.USER.value, SimpleAuthManagerRole.OP.value], + ) + + def is_authorized_dataset( + self, *, method: ResourceMethod, details: DatasetDetails | None = None, user: BaseUser | None = None + ) -> bool: + return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + + def is_authorized_pool( + self, *, method: ResourceMethod, details: PoolDetails | None = None, user: BaseUser | None = None + ) -> bool: + return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + + def is_authorized_variable( + self, *, method: ResourceMethod, details: VariableDetails | None = None, user: BaseUser | None = None + ) -> bool: + return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + + def is_authorized_view(self, *, access_view: AccessView, user: BaseUser | None = None) -> bool: + return self._is_authorized(method="GET") + + def is_authorized_custom_view( + self, *, method: ResourceMethod | str, resource_name: str, user: BaseUser | None = None + ): + return self.is_logged_in() + + def register_views(self) -> None: + self.appbuilder.add_view_no_menu( + SimpleAuthManagerAuthenticationViews( + users=self.appbuilder.get_app.config.get("SIMPLE_AUTH_MANAGER_USERS", []) + ) + ) + + def _is_authorized( + self, + *, + method: ResourceMethod, + roles_to_allow: list[str] | None = None, + ): + """ + Return whether the user is authorized to access a given resource. + + :param method: the method to perform + :param roles_to_allow: list of roles giving access to the resource, if the user's role is one of these roles, they have access + """ + user = self.get_user() + if not user: + return False + role = user.get_role() + if role == SimpleAuthManagerRole.ADMIN.value: + return True + if method == "GET": + return True + + if not roles_to_allow: + roles_to_allow = [] + + return role in roles_to_allow diff --git a/airflow/auth/managers/simple/user.py b/airflow/auth/managers/simple/user.py new file mode 100644 index 0000000000000..fa032f596ee44 --- /dev/null +++ b/airflow/auth/managers/simple/user.py @@ -0,0 +1,41 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from __future__ import annotations + +from airflow.auth.managers.models.base_user import BaseUser + + +class SimpleAuthManagerUser(BaseUser): + """ + User model for users managed by the simple auth manager. + + :param username: The username + :param role: The role associated to the user + """ + + def __init__(self, *, username: str, role: str) -> None: + self.username = username + self.role = role + + def get_id(self) -> str: + return self.username + + def get_name(self) -> str: + return self.username + + def get_role(self): + return self.role diff --git a/airflow/auth/managers/simple/views/__init__.py b/airflow/auth/managers/simple/views/__init__.py new file mode 100644 index 0000000000000..217e5db960782 --- /dev/null +++ b/airflow/auth/managers/simple/views/__init__.py @@ -0,0 +1,17 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. diff --git a/airflow/auth/managers/simple/views/auth.py b/airflow/auth/managers/simple/views/auth.py new file mode 100644 index 0000000000000..ca4e4f4ceb2c9 --- /dev/null +++ b/airflow/auth/managers/simple/views/auth.py @@ -0,0 +1,84 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from __future__ import annotations + +import logging + +from flask import redirect, request, session, url_for +from flask_appbuilder import expose + +from airflow.auth.managers.simple.user import SimpleAuthManagerUser +from airflow.configuration import conf +from airflow.utils.state import State +from airflow.www.app import csrf +from airflow.www.views import AirflowBaseView + +logger = logging.getLogger(__name__) + + +class SimpleAuthManagerAuthenticationViews(AirflowBaseView): + """ + Views to authenticate using the simple auth manager. + + :param users: the list of users defined in the config + """ + + def __init__(self, users: list): + super().__init__() + self.users = users + + @expose("/login") + def login(self): + """Start login process.""" + state_color_mapping = State.state_color.copy() + state_color_mapping["no_status"] = state_color_mapping.pop(None) + standalone_dag_processor = conf.getboolean("scheduler", "standalone_dag_processor") + return self.render_template( + "airflow/login.html", + disable_nav_bar=True, + login_submit_url=url_for("SimpleAuthManagerAuthenticationViews.login_submit"), + auto_refresh_interval=conf.getint("webserver", "auto_refresh_interval"), + state_color_mapping=state_color_mapping, + standalone_dag_processor=standalone_dag_processor, + ) + + @expose("/logout", methods=["GET", "POST"]) + def logout(self): + """Start logout process.""" + session.clear() + return redirect(url_for("SimpleAuthManagerAuthenticationViews.login")) + + @csrf.exempt + @expose("/login_submit", methods=("GET", "POST")) + def login_submit(self): + """Redirect the user to this callback after login attempt.""" + username = request.form.get("username") + password = request.form.get("password") + + found_users = [ + user for user in self.users if user["username"] == username and user["password"] == password + ] + + if not username or not password or len(found_users) == 0: + return redirect(url_for("SimpleAuthManagerAuthenticationViews.login", error=["1"])) + + session["user"] = SimpleAuthManagerUser( + username=username, + role=found_users[0]["role"], + ) + + return redirect(url_for("Airflow.index")) diff --git a/airflow/config_templates/default_webserver_config.py b/airflow/config_templates/default_webserver_config.py index 3048bb21f4d59..1c9296b22bdbd 100644 --- a/airflow/config_templates/default_webserver_config.py +++ b/airflow/config_templates/default_webserver_config.py @@ -130,3 +130,10 @@ # APP_THEME = "superhero.css" # APP_THEME = "united.css" # APP_THEME = "yeti.css" + +# ---------------------------------------------------- +# Simple auth manager config +# ---------------------------------------------------- +# This list contains the list of users and their associated role in simple auth manager +# If the simple auth manager is used in your environment, this list controls who can access the environment +SIMPLE_AUTH_MANAGER_USERS = [] diff --git a/airflow/www/static/js/login/Form.tsx b/airflow/www/static/js/login/Form.tsx new file mode 100644 index 0000000000000..e8ca124f5a8b5 --- /dev/null +++ b/airflow/www/static/js/login/Form.tsx @@ -0,0 +1,44 @@ +/*! + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import React from "react"; +import { FormControl, FormLabel, Input, Stack, Button } from "@chakra-ui/react"; +import { getMetaValue } from "src/utils"; + +const LoginForm = () => ( +
+ + + Username + + + + + Password + + + + + +
+); + +export default LoginForm; diff --git a/airflow/www/static/js/login/index.test.tsx b/airflow/www/static/js/login/index.test.tsx new file mode 100644 index 0000000000000..9d8b0988db78b --- /dev/null +++ b/airflow/www/static/js/login/index.test.tsx @@ -0,0 +1,42 @@ +/*! + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +/* global describe */ + +import React from "react"; + +import { render } from "@testing-library/react"; + +import { Wrapper } from "src/utils/testUtils"; +import Login from "."; + +describe("Login page", () => { + test("Components renders properly", () => { + const { getAllByText } = render(, { + wrapper: Wrapper, + }); + + expect(getAllByText("Sign in")).toHaveLength(2); + expect(getAllByText("Enter your login and password below:")).toHaveLength( + 1 + ); + expect(getAllByText("Username")).toHaveLength(1); + expect(getAllByText("Password")).toHaveLength(1); + }); +}); diff --git a/airflow/www/static/js/login/index.tsx b/airflow/www/static/js/login/index.tsx new file mode 100644 index 0000000000000..2153eef354920 --- /dev/null +++ b/airflow/www/static/js/login/index.tsx @@ -0,0 +1,73 @@ +/*! + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +/* global document */ + +import React from "react"; +import { createRoot } from "react-dom/client"; +import createCache from "@emotion/cache"; +import { Alert, AlertIcon, Container, Heading, Text } from "@chakra-ui/react"; + +import App from "src/App"; +import LoginForm from "src/login/Form"; +import { useSearchParams } from "react-router-dom"; + +// create shadowRoot +const root = document.querySelector("#root"); +const shadowRoot = root?.attachShadow({ mode: "open" }); +const cache = createCache({ + container: shadowRoot, + key: "c", +}); +const mainElement = document.getElementById("react-container"); + +const Login = () => { + const [searchParams] = useSearchParams(); + const error = searchParams.get("error"); + + return ( + + + Sign in + + + {error && ( + + + Invalid credentials, please try again. + + )} + + Enter your login and password below: + + + ); +}; + +export default Login; + +if (mainElement) { + shadowRoot?.appendChild(mainElement); + const reactRoot = createRoot(mainElement); + reactRoot.render( + + + + ); +} diff --git a/airflow/www/templates/airflow/login.html b/airflow/www/templates/airflow/login.html new file mode 100644 index 0000000000000..5a25fb3b5f205 --- /dev/null +++ b/airflow/www/templates/airflow/login.html @@ -0,0 +1,45 @@ +{# + Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. + #} + +{% extends base_template %} + +{% block head_meta %} + {{ super() }} + +{% endblock %} + +{% block messages %} +{% endblock %} + +{% block content %} + {{ super() }} +
+
+
+{% endblock %} + +{% block tail_js %} + {{ super()}} + + +{% endblock %} diff --git a/airflow/www/templates/appbuilder/navbar.html b/airflow/www/templates/appbuilder/navbar.html index 141d778d2335f..149a517df24bc 100644 --- a/airflow/www/templates/appbuilder/navbar.html +++ b/airflow/www/templates/appbuilder/navbar.html @@ -47,7 +47,9 @@
    + {%- if not disable_nav_bar -%} {% include 'appbuilder/navbar_menu.html' %} + {%- endif -%}
  • diff --git a/airflow/www/webpack.config.js b/airflow/www/webpack.config.js index df4e11042cac5..45d3f90a4d4e3 100644 --- a/airflow/www/webpack.config.js +++ b/airflow/www/webpack.config.js @@ -66,6 +66,7 @@ const config = { flash: `${CSS_DIR}/flash.css`, graph: `${CSS_DIR}/graph.css`, loadingDots: `${CSS_DIR}/loading-dots.css`, + login: `${JS_DIR}/login/index.tsx`, main: [`${CSS_DIR}/main.css`, `${JS_DIR}/main.js`], materialIcons: `${CSS_DIR}/material-icons.css`, moment: "moment-timezone", diff --git a/tests/auth/managers/simple/__init__.py b/tests/auth/managers/simple/__init__.py new file mode 100644 index 0000000000000..13a83393a9124 --- /dev/null +++ b/tests/auth/managers/simple/__init__.py @@ -0,0 +1,16 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. diff --git a/tests/auth/managers/simple/test_simple_auth_manager.py b/tests/auth/managers/simple/test_simple_auth_manager.py new file mode 100644 index 0000000000000..c900750ee3a89 --- /dev/null +++ b/tests/auth/managers/simple/test_simple_auth_manager.py @@ -0,0 +1,228 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from __future__ import annotations + +from unittest.mock import Mock, patch + +import pytest +from flask import Flask, session + +from airflow.auth.managers.models.resource_details import AccessView +from airflow.auth.managers.simple.simple_auth_manager import SimpleAuthManager +from airflow.auth.managers.simple.user import SimpleAuthManagerUser +from airflow.auth.managers.simple.views.auth import SimpleAuthManagerAuthenticationViews +from airflow.www.extensions.init_appbuilder import init_appbuilder + + +@pytest.fixture +def auth_manager(): + return SimpleAuthManager(None) + + +@pytest.fixture +def auth_manager_with_appbuilder(): + flask_app = Flask(__name__) + appbuilder = init_appbuilder(flask_app) + return SimpleAuthManager(appbuilder) + + +@pytest.fixture +def test_user(): + return SimpleAuthManagerUser(username="test", role="test") + + +class TestSimpleAuthManager: + @pytest.mark.db_test + def test_is_logged_in(self, auth_manager, app, test_user): + with app.test_request_context(): + session["user"] = test_user + result = auth_manager.is_logged_in() + assert result + + @pytest.mark.db_test + def test_is_logged_in_return_false_when_no_user_in_session(self, auth_manager, app, test_user): + with app.test_request_context(): + result = auth_manager.is_logged_in() + + assert result is False + + @patch("airflow.auth.managers.simple.simple_auth_manager.url_for") + def test_get_url_login(self, mock_url_for, auth_manager): + auth_manager.get_url_login() + mock_url_for.assert_called_once_with("SimpleAuthManagerAuthenticationViews.login") + + @patch("airflow.auth.managers.simple.simple_auth_manager.url_for") + def test_get_url_logout(self, mock_url_for, auth_manager): + auth_manager.get_url_logout() + mock_url_for.assert_called_once_with("SimpleAuthManagerAuthenticationViews.logout") + + @pytest.mark.db_test + @patch.object(SimpleAuthManager, "is_logged_in") + def test_get_user(self, mock_is_logged_in, auth_manager, app, test_user): + mock_is_logged_in.return_value = True + + with app.test_request_context(): + session["user"] = test_user + result = auth_manager.get_user() + + assert result == test_user + + @patch.object(SimpleAuthManager, "is_logged_in") + def test_get_user_return_none_when_not_logged_in(self, mock_is_logged_in, auth_manager): + mock_is_logged_in.return_value = False + result = auth_manager.get_user() + + assert result is None + + @pytest.mark.db_test + @patch.object(SimpleAuthManager, "is_logged_in") + @pytest.mark.parametrize( + "api", + [ + "is_authorized_configuration", + "is_authorized_connection", + "is_authorized_dag", + "is_authorized_dataset", + "is_authorized_pool", + "is_authorized_variable", + ], + ) + @pytest.mark.parametrize( + "is_logged_in, role, method, result", + [ + (True, "admin", "GET", True), + (True, "admin", "DELETE", True), + (True, "viewer", "GET", True), + (True, "viewer", "POST", False), + (True, "viewer", "PUT", False), + (True, "user", "GET", True), + (True, "op", "GET", True), + (True, "viewer", "DELETE", False), + (False, "admin", "GET", False), + ], + ) + def test_is_authorized_methods( + self, mock_is_logged_in, auth_manager, app, api, is_logged_in, role, method, result + ): + mock_is_logged_in.return_value = is_logged_in + + with app.test_request_context(): + session["user"] = SimpleAuthManagerUser(username="test", role=role) + assert getattr(auth_manager, api)(method=method) is result + + @pytest.mark.db_test + @patch.object(SimpleAuthManager, "is_logged_in") + @pytest.mark.parametrize( + "api, kwargs", + [ + ("is_authorized_view", {"access_view": AccessView.CLUSTER_ACTIVITY}), + ( + "is_authorized_custom_view", + { + "method": "GET", + "resource_name": "test", + }, + ), + ], + ) + @pytest.mark.parametrize( + "is_logged_in, role, result", + [ + (True, "admin", True), + (True, "viewer", True), + (True, "user", True), + (True, "op", True), + (False, "admin", False), + ], + ) + def test_is_authorized_view_methods( + self, mock_is_logged_in, auth_manager, app, api, kwargs, is_logged_in, role, result + ): + mock_is_logged_in.return_value = is_logged_in + + with app.test_request_context(): + session["user"] = SimpleAuthManagerUser(username="test", role=role) + assert getattr(auth_manager, api)(**kwargs) is result + + @pytest.mark.db_test + @patch.object(SimpleAuthManager, "is_logged_in") + @pytest.mark.parametrize( + "api", + [ + "is_authorized_configuration", + "is_authorized_connection", + "is_authorized_dataset", + "is_authorized_pool", + "is_authorized_variable", + ], + ) + @pytest.mark.parametrize( + "role, method, result", + [ + ("admin", "GET", True), + ("op", "DELETE", True), + ("user", "GET", True), + ("user", "DELETE", False), + ("viewer", "PUT", False), + ], + ) + def test_is_authorized_methods_op_role_required( + self, mock_is_logged_in, auth_manager, app, api, role, method, result + ): + mock_is_logged_in.return_value = True + + with app.test_request_context(): + session["user"] = SimpleAuthManagerUser(username="test", role=role) + assert getattr(auth_manager, api)(method=method) is result + + @pytest.mark.db_test + @patch.object(SimpleAuthManager, "is_logged_in") + @pytest.mark.parametrize( + "api", + ["is_authorized_dag"], + ) + @pytest.mark.parametrize( + "role, method, result", + [ + ("admin", "GET", True), + ("op", "DELETE", True), + ("user", "GET", True), + ("user", "DELETE", True), + ("viewer", "PUT", False), + ], + ) + def test_is_authorized_methods_user_role_required( + self, mock_is_logged_in, auth_manager, app, api, role, method, result + ): + mock_is_logged_in.return_value = True + + with app.test_request_context(): + session["user"] = SimpleAuthManagerUser(username="test", role=role) + assert getattr(auth_manager, api)(method=method) is result + + @pytest.mark.db_test + @patch( + "airflow.providers.amazon.aws.auth_manager.views.auth.conf.get_mandatory_value", return_value="test" + ) + def test_register_views(self, _, auth_manager_with_appbuilder): + auth_manager_with_appbuilder.appbuilder.add_view_no_menu = Mock() + auth_manager_with_appbuilder.register_views() + auth_manager_with_appbuilder.appbuilder.add_view_no_menu.assert_called_once() + assert isinstance( + auth_manager_with_appbuilder.appbuilder.add_view_no_menu.call_args.args[0], + SimpleAuthManagerAuthenticationViews, + ) diff --git a/tests/auth/managers/simple/test_user.py b/tests/auth/managers/simple/test_user.py new file mode 100644 index 0000000000000..bdc649811bf70 --- /dev/null +++ b/tests/auth/managers/simple/test_user.py @@ -0,0 +1,37 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from __future__ import annotations + +import pytest + +from airflow.auth.managers.simple.user import SimpleAuthManagerUser + + +@pytest.fixture +def user(): + return SimpleAuthManagerUser(username="test", role="admin") + + +class TestSimpleAuthManagerUser: + def test_get_id(self, user): + assert user.get_id() == "test" + + def test_get_name(self, user): + assert user.get_name() == "test" + + def test_get_role(self, user): + assert user.get_role() == "admin" diff --git a/tests/auth/managers/simple/views/__init__.py b/tests/auth/managers/simple/views/__init__.py new file mode 100644 index 0000000000000..13a83393a9124 --- /dev/null +++ b/tests/auth/managers/simple/views/__init__.py @@ -0,0 +1,16 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. diff --git a/tests/auth/managers/simple/views/test_auth.py b/tests/auth/managers/simple/views/test_auth.py new file mode 100644 index 0000000000000..846b0ed80c106 --- /dev/null +++ b/tests/auth/managers/simple/views/test_auth.py @@ -0,0 +1,78 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from __future__ import annotations + +import pytest +from flask import session, url_for + +from airflow.www import app as application +from tests.test_utils.config import conf_vars + + +@pytest.fixture +def simple_app(): + with conf_vars( + { + ( + "core", + "auth_manager", + ): "airflow.auth.managers.simple.simple_auth_manager.SimpleAuthManager", + } + ): + return application.create_app( + testing=True, + config={ + "SIMPLE_AUTH_MANAGER_USERS": [ + { + "username": "test", + "password": "test", + "role": "admin", + } + ] + }, + ) + + +@pytest.mark.db_test +class TestSimpleAuthManagerAuthenticationViews: + def test_logout_redirects_to_login_and_clear_user(self, simple_app): + with simple_app.test_client() as client: + response = client.get("/logout") + assert response.status_code == 302 + assert response.location == "/login" + assert session.get("user") is None + + @pytest.mark.parametrize( + "username, password, is_successful", + [("test", "test", True), ("test", "test2", False), ("", "", False)], + ) + def test_login_submit(self, simple_app, username, password, is_successful): + simple_app.config["SIMPLE_AUTH_MANAGER_USERS"] = [ + { + "username": "test", + "password": "test", + "role": "admin", + } + ] + + with simple_app.test_client() as client: + response = client.post("/login_submit", data={"username": username, "password": password}) + assert response.status_code == 302 + if is_successful: + assert response.location == url_for("Airflow.index") + else: + assert response.location == url_for("SimpleAuthManagerAuthenticationViews.login", error=["1"]) From befab1a91bd4c21bd7d8d8e3ef7dac724554352c Mon Sep 17 00:00:00 2001 From: vincbeck Date: Wed, 4 Sep 2024 12:16:03 -0400 Subject: [PATCH 2/6] Add example of user definition --- airflow/config_templates/default_webserver_config.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/airflow/config_templates/default_webserver_config.py b/airflow/config_templates/default_webserver_config.py index 1c9296b22bdbd..4a336e0fd6092 100644 --- a/airflow/config_templates/default_webserver_config.py +++ b/airflow/config_templates/default_webserver_config.py @@ -134,6 +134,12 @@ # ---------------------------------------------------- # Simple auth manager config # ---------------------------------------------------- -# This list contains the list of users and their associated role in simple auth manager -# If the simple auth manager is used in your environment, this list controls who can access the environment +# This list contains the list of users and their associated role in simple auth manager. +# If the simple auth manager is used in your environment, this list controls who can access the environment. +# Example: +# [{ +# "username": "admin", +# "password": "admin", +# "role": "admin", +# }] SIMPLE_AUTH_MANAGER_USERS = [] From 0a910a98b7d606398752e1199eb63113bdf81f94 Mon Sep 17 00:00:00 2001 From: vincbeck Date: Wed, 4 Sep 2024 15:43:37 -0400 Subject: [PATCH 3/6] Fix tests --- airflow/www/templates/appbuilder/navbar.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/airflow/www/templates/appbuilder/navbar.html b/airflow/www/templates/appbuilder/navbar.html index 149a517df24bc..6f22d65343fa1 100644 --- a/airflow/www/templates/appbuilder/navbar.html +++ b/airflow/www/templates/appbuilder/navbar.html @@ -47,7 +47,7 @@
    - {%- if not disable_nav_bar -%} + {%- if disable_nav_bar is not defined or not disable_nav_bar -%} {% include 'appbuilder/navbar_menu.html' %} {%- endif -%}
From e519693c0cf1cb38057cc19b4056c7ad3e36f4a6 Mon Sep 17 00:00:00 2001 From: vincbeck Date: Thu, 5 Sep 2024 14:45:07 -0400 Subject: [PATCH 4/6] Update security model to match the current one --- .../managers/simple/simple_auth_manager.py | 73 ++++++++++++------- .../simple/test_simple_auth_manager.py | 69 ++++++++++++------ 2 files changed, 92 insertions(+), 50 deletions(-) diff --git a/airflow/auth/managers/simple/simple_auth_manager.py b/airflow/auth/managers/simple/simple_auth_manager.py index 9840ef7712a52..a66cc604b6f02 100644 --- a/airflow/auth/managers/simple/simple_auth_manager.py +++ b/airflow/auth/managers/simple/simple_auth_manager.py @@ -17,6 +17,7 @@ # under the License. from __future__ import annotations +from collections import namedtuple from enum import Enum from typing import TYPE_CHECKING @@ -40,20 +41,26 @@ from airflow.auth.managers.simple.user import SimpleAuthManagerUser -class SimpleAuthManagerRole(Enum): - """List of pre-defined roles in simple auth manager.""" +class SimpleAuthManagerRole(namedtuple("SimpleAuthManagerRole", "name order"), Enum): + """ + List of pre-defined roles in simple auth manager. - # Admin role gives all permissions - ADMIN = "admin" + The first attribute defines the name that references this role in the config. + The second attribute defines the order between roles. The role with order X means it grants access to + resources under its umbrella and all resources under the umbrella of roles of lower order + """ - # Viewer role gives all read-only permissions - VIEWER = "viewer" + # VIEWER role gives all read-only permissions + VIEWER = "VIEWER", 0 - # User role gives viewer role permissions + access to DAGs - USER = "user" + # USER role gives viewer role permissions + access to DAGs + USER = "USER", 1 # OP role gives user role permissions + access to connections, config, pools, variables - OP = "op" + OP = "OP", 2 + + # ADMIN role gives all permissions + ADMIN = "ADMIN", 3 class SimpleAuthManager(BaseAuthManager): @@ -85,7 +92,7 @@ def is_authorized_configuration( details: ConfigurationDetails | None = None, user: BaseUser | None = None, ) -> bool: - return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + return self._is_authorized(method=method, allow_role=SimpleAuthManagerRole.OP) def is_authorized_connection( self, @@ -94,7 +101,7 @@ def is_authorized_connection( details: ConnectionDetails | None = None, user: BaseUser | None = None, ) -> bool: - return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + return self._is_authorized(method=method, allow_role=SimpleAuthManagerRole.OP) def is_authorized_dag( self, @@ -106,31 +113,40 @@ def is_authorized_dag( ) -> bool: return self._is_authorized( method=method, - roles_to_allow=[SimpleAuthManagerRole.USER.value, SimpleAuthManagerRole.OP.value], + allow_get_role=SimpleAuthManagerRole.VIEWER, + allow_role=SimpleAuthManagerRole.USER, ) def is_authorized_dataset( self, *, method: ResourceMethod, details: DatasetDetails | None = None, user: BaseUser | None = None ) -> bool: - return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + return self._is_authorized( + method=method, + allow_get_role=SimpleAuthManagerRole.VIEWER, + allow_role=SimpleAuthManagerRole.OP, + ) def is_authorized_pool( self, *, method: ResourceMethod, details: PoolDetails | None = None, user: BaseUser | None = None ) -> bool: - return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + return self._is_authorized( + method=method, + allow_get_role=SimpleAuthManagerRole.VIEWER, + allow_role=SimpleAuthManagerRole.OP, + ) def is_authorized_variable( self, *, method: ResourceMethod, details: VariableDetails | None = None, user: BaseUser | None = None ) -> bool: - return self._is_authorized(method=method, roles_to_allow=[SimpleAuthManagerRole.OP.value]) + return self._is_authorized(method=method, allow_role=SimpleAuthManagerRole.OP) def is_authorized_view(self, *, access_view: AccessView, user: BaseUser | None = None) -> bool: - return self._is_authorized(method="GET") + return self._is_authorized(method="GET", allow_role=SimpleAuthManagerRole.VIEWER) def is_authorized_custom_view( self, *, method: ResourceMethod | str, resource_name: str, user: BaseUser | None = None ): - return self.is_logged_in() + return self._is_authorized(method="GET", allow_role=SimpleAuthManagerRole.VIEWER) def register_views(self) -> None: self.appbuilder.add_view_no_menu( @@ -143,24 +159,29 @@ def _is_authorized( self, *, method: ResourceMethod, - roles_to_allow: list[str] | None = None, + allow_role: SimpleAuthManagerRole, + allow_get_role: SimpleAuthManagerRole | None = None, ): """ Return whether the user is authorized to access a given resource. :param method: the method to perform - :param roles_to_allow: list of roles giving access to the resource, if the user's role is one of these roles, they have access + :param allow_role: minimal role giving access to the resource, if the user's role is greater or + equal than this role, they have access + :param allow_get_role: minimal role giving access to the resource, if the user's role is greater or + equal than this role, they have access. If not provided, ``allow_role`` is used """ user = self.get_user() if not user: return False - role = user.get_role() - if role == SimpleAuthManagerRole.ADMIN.value: - return True - if method == "GET": + role_str = user.get_role() + role = SimpleAuthManagerRole[role_str] + if role == SimpleAuthManagerRole.ADMIN: return True - if not roles_to_allow: - roles_to_allow = [] + if not allow_get_role: + allow_get_role = allow_role - return role in roles_to_allow + if method == "GET": + return role.order >= allow_get_role.order + return role.order >= allow_role.order diff --git a/tests/auth/managers/simple/test_simple_auth_manager.py b/tests/auth/managers/simple/test_simple_auth_manager.py index c900750ee3a89..e5ca49fc26390 100644 --- a/tests/auth/managers/simple/test_simple_auth_manager.py +++ b/tests/auth/managers/simple/test_simple_auth_manager.py @@ -104,15 +104,12 @@ def test_get_user_return_none_when_not_logged_in(self, mock_is_logged_in, auth_m @pytest.mark.parametrize( "is_logged_in, role, method, result", [ - (True, "admin", "GET", True), - (True, "admin", "DELETE", True), - (True, "viewer", "GET", True), - (True, "viewer", "POST", False), - (True, "viewer", "PUT", False), - (True, "user", "GET", True), - (True, "op", "GET", True), - (True, "viewer", "DELETE", False), - (False, "admin", "GET", False), + (True, "ADMIN", "GET", True), + (True, "ADMIN", "DELETE", True), + (True, "VIEWER", "POST", False), + (True, "VIEWER", "PUT", False), + (True, "VIEWER", "DELETE", False), + (False, "ADMIN", "GET", False), ], ) def test_is_authorized_methods( @@ -142,11 +139,11 @@ def test_is_authorized_methods( @pytest.mark.parametrize( "is_logged_in, role, result", [ - (True, "admin", True), - (True, "viewer", True), - (True, "user", True), - (True, "op", True), - (False, "admin", False), + (True, "ADMIN", True), + (True, "VIEWER", True), + (True, "USER", True), + (True, "OP", True), + (False, "ADMIN", False), ], ) def test_is_authorized_view_methods( @@ -173,11 +170,10 @@ def test_is_authorized_view_methods( @pytest.mark.parametrize( "role, method, result", [ - ("admin", "GET", True), - ("op", "DELETE", True), - ("user", "GET", True), - ("user", "DELETE", False), - ("viewer", "PUT", False), + ("ADMIN", "GET", True), + ("OP", "DELETE", True), + ("USER", "DELETE", False), + ("VIEWER", "PUT", False), ], ) def test_is_authorized_methods_op_role_required( @@ -198,11 +194,11 @@ def test_is_authorized_methods_op_role_required( @pytest.mark.parametrize( "role, method, result", [ - ("admin", "GET", True), - ("op", "DELETE", True), - ("user", "GET", True), - ("user", "DELETE", True), - ("viewer", "PUT", False), + ("ADMIN", "GET", True), + ("OP", "DELETE", True), + ("USER", "GET", True), + ("USER", "DELETE", True), + ("VIEWER", "PUT", False), ], ) def test_is_authorized_methods_user_role_required( @@ -214,6 +210,31 @@ def test_is_authorized_methods_user_role_required( session["user"] = SimpleAuthManagerUser(username="test", role=role) assert getattr(auth_manager, api)(method=method) is result + @pytest.mark.db_test + @patch.object(SimpleAuthManager, "is_logged_in") + @pytest.mark.parametrize( + "api", + ["is_authorized_dag", "is_authorized_dataset", "is_authorized_pool"], + ) + @pytest.mark.parametrize( + "role, method, result", + [ + ("ADMIN", "GET", True), + ("VIEWER", "GET", True), + ("OP", "GET", True), + ("USER", "GET", True), + ("VIEWER", "POST", False), + ], + ) + def test_is_authorized_methods_viewer_role_required_for_get( + self, mock_is_logged_in, auth_manager, app, api, role, method, result + ): + mock_is_logged_in.return_value = True + + with app.test_request_context(): + session["user"] = SimpleAuthManagerUser(username="test", role=role) + assert getattr(auth_manager, api)(method=method) is result + @pytest.mark.db_test @patch( "airflow.providers.amazon.aws.auth_manager.views.auth.conf.get_mandatory_value", return_value="test" From 52544f5f44a54799708d7171940183fd6112048f Mon Sep 17 00:00:00 2001 From: vincbeck Date: Mon, 16 Sep 2024 18:00:26 -0400 Subject: [PATCH 5/6] Generate the password and save it in a file (standalone like) --- .../managers/simple/simple_auth_manager.py | 55 ++++++++++++++++++- airflow/auth/managers/simple/views/auth.py | 11 +++- .../default_webserver_config.py | 8 ++- airflow/www/app.py | 4 -- airflow/www/extensions/init_auth_manager.py | 1 + 5 files changed, 69 insertions(+), 10 deletions(-) diff --git a/airflow/auth/managers/simple/simple_auth_manager.py b/airflow/auth/managers/simple/simple_auth_manager.py index a66cc604b6f02..1d73341719010 100644 --- a/airflow/auth/managers/simple/simple_auth_manager.py +++ b/airflow/auth/managers/simple/simple_auth_manager.py @@ -17,14 +17,19 @@ # under the License. from __future__ import annotations +import json +import os +import random from collections import namedtuple from enum import Enum from typing import TYPE_CHECKING from flask import session, url_for +from termcolor import colored from airflow.auth.managers.base_auth_manager import BaseAuthManager, ResourceMethod from airflow.auth.managers.simple.views.auth import SimpleAuthManagerAuthenticationViews +from hatch_build import AIRFLOW_ROOT_PATH if TYPE_CHECKING: from airflow.auth.managers.models.base_user import BaseUser @@ -73,6 +78,40 @@ class SimpleAuthManager(BaseAuthManager): :param appbuilder: the flask app builder """ + # File that contains the generated passwords + GENERATED_PASSWORDS_FILE = ( + AIRFLOW_ROOT_PATH / "generated" / "simple_auth_manager_passwords.json.generated" + ) + + # Cache containing the password associated to a username + passwords: dict[str, str] = {} + + def init(self) -> None: + user_passwords_from_file = {} + + # Read passwords from file + if os.path.isfile(self.GENERATED_PASSWORDS_FILE): + with open(self.GENERATED_PASSWORDS_FILE) as file: + passwords_str = file.read().strip() + user_passwords_from_file = json.loads(passwords_str) + + users = self.appbuilder.get_app.config.get("SIMPLE_AUTH_MANAGER_USERS", []) + usernames = {user["username"] for user in users} + self.passwords = { + username: password + for username, password in user_passwords_from_file.items() + if username in usernames + } + for user in users: + if user["username"] not in self.passwords: + # User dot not exist in the file, adding it + self.passwords[user["username"]] = self._generate_password() + + self._print_output(f"Password for user '{user['username']}': {self.passwords[user['username']]}") + + with open(self.GENERATED_PASSWORDS_FILE, "w") as file: + file.write(json.dumps(self.passwords)) + def is_logged_in(self) -> bool: return "user" in session @@ -151,7 +190,8 @@ def is_authorized_custom_view( def register_views(self) -> None: self.appbuilder.add_view_no_menu( SimpleAuthManagerAuthenticationViews( - users=self.appbuilder.get_app.config.get("SIMPLE_AUTH_MANAGER_USERS", []) + users=self.appbuilder.get_app.config.get("SIMPLE_AUTH_MANAGER_USERS", []), + passwords=self.passwords, ) ) @@ -174,7 +214,7 @@ def _is_authorized( user = self.get_user() if not user: return False - role_str = user.get_role() + role_str = user.get_role().upper() role = SimpleAuthManagerRole[role_str] if role == SimpleAuthManagerRole.ADMIN: return True @@ -185,3 +225,14 @@ def _is_authorized( if method == "GET": return role.order >= allow_get_role.order return role.order >= allow_role.order + + @staticmethod + def _generate_password() -> str: + return "".join(random.choices("abcdefghkmnpqrstuvwxyzABCDEFGHKMNPQRSTUVWXYZ23456789", k=16)) + + @staticmethod + def _print_output(output: str): + name = "Simple auth manager" + colorized_name = colored(f"{name:10}", "white") + for line in output.splitlines(): + print(f"{colorized_name} | {line.strip()}") diff --git a/airflow/auth/managers/simple/views/auth.py b/airflow/auth/managers/simple/views/auth.py index ca4e4f4ceb2c9..e8424f33013e0 100644 --- a/airflow/auth/managers/simple/views/auth.py +++ b/airflow/auth/managers/simple/views/auth.py @@ -35,11 +35,13 @@ class SimpleAuthManagerAuthenticationViews(AirflowBaseView): Views to authenticate using the simple auth manager. :param users: the list of users defined in the config + :param passwords: dict associating a username to its password """ - def __init__(self, users: list): + def __init__(self, users: list, passwords: dict[str, str]): super().__init__() self.users = users + self.passwords = passwords @expose("/login") def login(self): @@ -69,8 +71,13 @@ def login_submit(self): username = request.form.get("username") password = request.form.get("password") + print("TESTTTTTTTT") + print(self.passwords) + found_users = [ - user for user in self.users if user["username"] == username and user["password"] == password + user + for user in self.users + if user["username"] == username and self.passwords[user["username"]] == password ] if not username or not password or len(found_users) == 0: diff --git a/airflow/config_templates/default_webserver_config.py b/airflow/config_templates/default_webserver_config.py index 4a336e0fd6092..71bdf9e99d089 100644 --- a/airflow/config_templates/default_webserver_config.py +++ b/airflow/config_templates/default_webserver_config.py @@ -139,7 +139,11 @@ # Example: # [{ # "username": "admin", -# "password": "admin", # "role": "admin", # }] -SIMPLE_AUTH_MANAGER_USERS = [] +SIMPLE_AUTH_MANAGER_USERS = [ + { + "username": "admin", + "role": "admin", + } +] diff --git a/airflow/www/app.py b/airflow/www/app.py index 270ffe57196a9..f5e1191fb43fb 100644 --- a/airflow/www/app.py +++ b/airflow/www/app.py @@ -36,7 +36,6 @@ from airflow.utils.json import AirflowJsonProvider from airflow.www.extensions.init_appbuilder import init_appbuilder from airflow.www.extensions.init_appbuilder_links import init_appbuilder_links -from airflow.www.extensions.init_auth_manager import get_auth_manager from airflow.www.extensions.init_cache import init_cache from airflow.www.extensions.init_dagbag import init_dagbag from airflow.www.extensions.init_jinja_globals import init_jinja_globals @@ -168,9 +167,6 @@ def create_app(config=None, testing=False): init_api_internal(flask_app) init_api_auth_provider(flask_app) init_api_error_handlers(flask_app) # needs to be after all api inits to let them add their path first - - get_auth_manager().init() - init_jinja_globals(flask_app) init_xframe_protection(flask_app) init_cache_control(flask_app) diff --git a/airflow/www/extensions/init_auth_manager.py b/airflow/www/extensions/init_auth_manager.py index f69734ce8a2f4..6e6f1f8af1b75 100644 --- a/airflow/www/extensions/init_auth_manager.py +++ b/airflow/www/extensions/init_auth_manager.py @@ -54,6 +54,7 @@ def init_auth_manager(appbuilder: AirflowAppBuilder) -> BaseAuthManager: global auth_manager auth_manager_cls = get_auth_manager_cls() auth_manager = auth_manager_cls(appbuilder) + auth_manager.init() return auth_manager From 4c376a76a77a40082ef3b33c38eabe58ccda85a6 Mon Sep 17 00:00:00 2001 From: vincbeck Date: Tue, 17 Sep 2024 11:38:20 -0400 Subject: [PATCH 6/6] Fix tests --- airflow/auth/managers/simple/views/auth.py | 3 --- .../simple/test_simple_auth_manager.py | 25 +++++++++++++++++++ tests/auth/managers/simple/views/test_auth.py | 16 ++++++------ 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/airflow/auth/managers/simple/views/auth.py b/airflow/auth/managers/simple/views/auth.py index e8424f33013e0..8ab02d0a01567 100644 --- a/airflow/auth/managers/simple/views/auth.py +++ b/airflow/auth/managers/simple/views/auth.py @@ -71,9 +71,6 @@ def login_submit(self): username = request.form.get("username") password = request.form.get("password") - print("TESTTTTTTTT") - print(self.passwords) - found_users = [ user for user in self.users diff --git a/tests/auth/managers/simple/test_simple_auth_manager.py b/tests/auth/managers/simple/test_simple_auth_manager.py index e5ca49fc26390..3191069860c6b 100644 --- a/tests/auth/managers/simple/test_simple_auth_manager.py +++ b/tests/auth/managers/simple/test_simple_auth_manager.py @@ -16,6 +16,7 @@ # under the License. from __future__ import annotations +import json from unittest.mock import Mock, patch import pytest @@ -46,6 +47,30 @@ def test_user(): class TestSimpleAuthManager: + @pytest.mark.db_test + def test_init_with_no_user(self, auth_manager_with_appbuilder): + auth_manager_with_appbuilder.init() + with open(SimpleAuthManager.GENERATED_PASSWORDS_FILE) as file: + passwords_str = file.read().strip() + user_passwords_from_file = json.loads(passwords_str) + + assert user_passwords_from_file == {} + + @pytest.mark.db_test + def test_init_with_users(self, auth_manager_with_appbuilder): + auth_manager_with_appbuilder.appbuilder.app.config["SIMPLE_AUTH_MANAGER_USERS"] = [ + { + "username": "test", + "role": "admin", + } + ] + auth_manager_with_appbuilder.init() + with open(SimpleAuthManager.GENERATED_PASSWORDS_FILE) as file: + passwords_str = file.read().strip() + user_passwords_from_file = json.loads(passwords_str) + + assert len(user_passwords_from_file) == 1 + @pytest.mark.db_test def test_is_logged_in(self, auth_manager, app, test_user): with app.test_request_context(): diff --git a/tests/auth/managers/simple/views/test_auth.py b/tests/auth/managers/simple/views/test_auth.py index 846b0ed80c106..197ed0e615cae 100644 --- a/tests/auth/managers/simple/views/test_auth.py +++ b/tests/auth/managers/simple/views/test_auth.py @@ -16,9 +16,12 @@ # under the License. from __future__ import annotations +import json + import pytest from flask import session, url_for +from airflow.auth.managers.simple.simple_auth_manager import SimpleAuthManager from airflow.www import app as application from tests.test_utils.config import conf_vars @@ -33,13 +36,16 @@ def simple_app(): ): "airflow.auth.managers.simple.simple_auth_manager.SimpleAuthManager", } ): + with open(SimpleAuthManager.GENERATED_PASSWORDS_FILE, "w") as file: + user = {"test": "test"} + file.write(json.dumps(user)) + return application.create_app( testing=True, config={ "SIMPLE_AUTH_MANAGER_USERS": [ { "username": "test", - "password": "test", "role": "admin", } ] @@ -61,14 +67,6 @@ def test_logout_redirects_to_login_and_clear_user(self, simple_app): [("test", "test", True), ("test", "test2", False), ("", "", False)], ) def test_login_submit(self, simple_app, username, password, is_successful): - simple_app.config["SIMPLE_AUTH_MANAGER_USERS"] = [ - { - "username": "test", - "password": "test", - "role": "admin", - } - ] - with simple_app.test_client() as client: response = client.post("/login_submit", data={"username": username, "password": password}) assert response.status_code == 302