or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

authentication-backends.mddata-models.mdindex.mdrole-permission-management.mdsecurity-management.mduser-management.mdweb-views.md
tile.json

tessl/pypi-apache-airflow-fab-security

Flask-AppBuilder (FAB) security integration component within Apache Airflow core, providing authentication, authorization, and security management features

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/apache-airflow@2.8.x#fab_security

To install, run

npx @tessl/cli install tessl/pypi-apache-airflow-fab-security@2.8.0

index.mddocs/

Apache Airflow FAB Security

Flask-AppBuilder (FAB) security integration component within Apache Airflow core, providing authentication, authorization, and security management features. This component implements comprehensive security infrastructure including user management, role-based access control, permission management, and multiple authentication backends.

Package Information

  • Package Name: apache-airflow (fab_security module)
  • Language: Python
  • Installation: Included as part of Apache Airflow (pip install apache-airflow)
  • Version: 2.8.0

Core Imports

from airflow.www.fab_security.sqla.manager import SecurityManager
from airflow.www.fab_security.sqla.models import User, Role, Permission, Action, Resource

Common view imports:

from airflow.www.fab_security.views import (
    CustomUserDBModelView,
    CustomRoleModelView,
    ActionModelView,
    ResourceModelView
)

Basic Usage

from airflow.www.fab_security.sqla.manager import SecurityManager
from airflow.www.fab_security.sqla.models import User, Role
from flask_appbuilder import AppBuilder

# Initialize security manager
app_builder = AppBuilder(app)
security_manager = SecurityManager(app_builder)

# Create a new user
user = security_manager.add_user(
    username="john_doe",
    first_name="John",
    last_name="Doe",
    email="john@example.com",
    role=security_manager.find_role("User"),
    password="secure_password"
)

# Create a role
admin_role = security_manager.add_role("CustomAdmin")

# Create permissions
permission = security_manager.create_permission("can_read", "Users")
security_manager.add_permission_to_role(admin_role, permission)

# Authenticate user
authenticated_user = security_manager.auth_user_db("john_doe", "secure_password")

Architecture

The FAB security component follows a layered architecture:

  • Security Manager: Central hub for authentication, authorization, and user management
  • Models: SQLAlchemy models representing users, roles, permissions, actions, and resources
  • Views: Flask-AppBuilder views for web interface integration
  • Authentication Backends: Support for DB, LDAP, OAuth, OpenID, and Remote User authentication

This design enables flexible security configuration while maintaining compatibility with Flask-AppBuilder's security model and Airflow's specific requirements.

Capabilities

Security Management

Core security management functionality including user authentication, authorization checks, permission validation, and session management. Provides the foundation for all security operations.

class BaseSecurityManager:
    def auth_user_db(self, username: str, password: str) -> User | None: ...
    def auth_user_ldap(self, username: str, password: str) -> User | None: ...
    def auth_user_oauth(self, userinfo: dict) -> User | None: ...
    def auth_user_oid(self, email: str) -> User | None: ...
    def auth_user_remote_user(self, username: str) -> User | None: ...
    def reset_password(self, userid: int, password: str) -> bool: ...
    def update_user_auth_stat(self, user: User, success: bool = True) -> None: ...

Security Management

User Management

Comprehensive user lifecycle management including creation, updates, deletion, and user queries. Handles user authentication statistics and profile management.

def add_user(self, username: str, first_name: str, last_name: str, email: str, role: Role | list[Role], password: str = "") -> User | None: ...
def update_user(self, user: User) -> bool: ...
def find_user(self, username: str = None, email: str = None) -> User | None: ...
def get_user_by_id(self, pk: int) -> User: ...
def get_all_users(self) -> list[User]: ...
def count_users(self) -> int: ...

User Management

Role and Permission Management

Role-based access control with granular permission management. Supports creating roles, assigning permissions, and managing access control for resources and actions.

def add_role(self, name: str) -> Role | None: ...
def find_role(self, name: str) -> Role | None: ...
def create_permission(self, action_name: str, resource_name: str) -> Permission | None: ...
def add_permission_to_role(self, role: Role, permission: Permission) -> None: ...
def remove_permission_from_role(self, role: Role, permission: Permission) -> None: ...

Role and Permission Management

Data Models

SQLAlchemy models representing the security schema including users, roles, permissions, actions, resources, and their relationships. Provides the data layer for security operations.

class User(Model):
    id: int
    username: str
    email: str
    first_name: str
    last_name: str
    password: str
    active: bool
    last_login: datetime
    login_count: int
    fail_login_count: int
    roles: list[Role]
    created_on: datetime
    changed_on: datetime
    created_by_fk: int
    changed_by_fk: int

Data Models

Web Views

Flask-AppBuilder view classes for web interface integration, providing customized security views that integrate with Airflow's permission model and web interface.

class CustomUserDBModelView(MultiResourceUserMixin, UserDBModelView): ...
class CustomRoleModelView(RoleModelView): ...
class ActionModelView(PermissionModelView): ...
class ResourceModelView(ViewMenuModelView): ...

Web Views

Authentication Backends

Multiple authentication backend support including database, LDAP, OAuth, OpenID, and remote user authentication with configurable options and provider-specific implementations.

def auth_user_db(self, username: str, password: str) -> User | None: ...
def auth_user_ldap(self, username: str, password: str) -> User | None: ...
def auth_user_oauth(self, userinfo: dict) -> User | None: ...
def auth_user_oid(self, email: str) -> User | None: ...
def auth_user_remote_user(self, username: str) -> User | None: ...

Authentication Backends

Authentication Methods

The component supports multiple authentication types:

from flask_appbuilder.const import (
    AUTH_DB,
    AUTH_LDAP,
    AUTH_OAUTH,
    AUTH_OID,
    AUTH_REMOTE_USER
)
  • AUTH_DB: Database-based username/password authentication
  • AUTH_LDAP: LDAP/Active Directory integration
  • AUTH_OAUTH: OAuth 2.0 providers (Google, GitHub, Azure, etc.)
  • AUTH_OID: OpenID authentication
  • AUTH_REMOTE_USER: Remote user authentication (e.g., from web server)

Configuration Properties

Key configuration properties for security behavior:

  • auth_type: Authentication backend type
  • auth_role_admin: Administrator role name
  • auth_role_public: Public/anonymous role name
  • auth_user_registration: Enable user self-registration
  • auth_roles_mapping: Map external roles to internal roles
  • auth_username_ci: Case-insensitive username matching

Error Handling

The component provides comprehensive error handling with logging and graceful degradation for authentication failures, database errors, and configuration issues.