0
# Apache Airflow Providers FAB
1

2
Flask App Builder (FAB) authentication and authorization provider for Apache Airflow. This package provides comprehensive user management, role-based access control, and multiple authentication backends for enterprise Airflow deployments.
3

4
## Package Information
5

6
- **Package Name**: apache-airflow-providers-fab
7
- **Language**: Python
8
- **Installation**: `pip install apache-airflow-providers-fab`
9

10
## Core Imports
11

12
```python
13
from airflow.providers.fab.auth_manager.fab_auth_manager import FabAuthManager
14
```
15

16
For models:
17

18
```python
19
from airflow.providers.fab.auth_manager.models import User, Role, Permission, Action, Resource
20
```
21

22
For authentication backends:
23

24
```python
25
from airflow.providers.fab.auth_manager.api.auth.backend import basic_auth, kerberos_auth, session
26
```
27

28
## Basic Usage
29

30
```python
31
from airflow.providers.fab.auth_manager.fab_auth_manager import FabAuthManager
32
from airflow.providers.fab.auth_manager.models import User, Role
33

34
# The FabAuthManager is typically configured through Airflow's configuration
35
# and used internally by Airflow's authentication system
36
auth_manager = FabAuthManager()
37

38
# Check if user is authorized for a specific action
39
if auth_manager.is_logged_in():
40
    user = auth_manager.get_user()
41
    print(f"Current user: {user.get_full_name()}")
42
```
43

44
## Architecture
45

46
The FAB provider implements Airflow's authentication framework through several key components:
47

48
- **FabAuthManager**: Main auth manager integrating FAB with Airflow's security model
49
- **Models**: SQLAlchemy models for users, roles, permissions, and resources
50
- **Authentication Backends**: Multiple auth methods (basic, Kerberos, session)
51
- **CLI Commands**: Command-line tools for user and role management
52
- **API Endpoints**: REST API for programmatic user and role management
53
- **Security Manager**: Custom security manager bridging FAB and Airflow security
54

55
## Capabilities
56

57
### Auth Manager
58

59
Core authentication manager providing user session management, authorization checks, and integration with Airflow's security framework.
60

61
```python { .api }
62
class FabAuthManager(BaseAuthManager):
63
    def get_user(self) -> User: ...
64
    def is_logged_in(self) -> bool: ...
65
    def is_authorized_dag(self, *, method: ResourceMethod, access_entity: DagAccessEntity | None = None, details: DagDetails | None = None, user: BaseUser | None = None) -> bool: ...
66
    def is_authorized_view(self, *, access_view: AccessView, user: BaseUser | None = None) -> bool: ...
67
    def get_permitted_dag_ids(self, *, methods: Container[ResourceMethod] | None = None, user: BaseUser | None = None, session: Session = NEW_SESSION) -> set[str]: ...
68
```
69

70
[Auth Manager](./auth-manager.md)
71

72
### User and Role Models
73

74
SQLAlchemy models for user management, role assignment, and permission tracking.
75

76
```python { .api }
77
class User(Model, BaseUser):
78
    id: int
79
    username: str
80
    email: str
81
    first_name: str
82
    last_name: str
83
    active: bool
84
    roles: list[Role]
85
    
86
    def get_full_name(self) -> str: ...
87
    def get_id(self) -> int: ...
88

89
class Role(Model):
90
    id: int
91
    name: str
92
    permissions: list[Permission]
93
    
94
class Permission(Model):
95
    id: int
96
    action: Action
97
    resource: Resource
98
```
99

100
[Models](./models.md)
101

102
### CLI Commands
103

104
Command-line interface for user management, role administration, permission synchronization, and database operations.
105

106
```python { .api }
107
def users_create(username: str, email: str, firstname: str, lastname: str, role: str, password: str | None = None, use_random_password: bool = False) -> None: ...
108
def roles_create(roles: list[str]) -> None: ...
109
def sync_perm(include_dags: bool = False) -> None: ...
110
```
111

112
[CLI Commands](./cli-commands.md)
113

114
### Authentication Backends
115

116
Multiple authentication methods supporting basic auth, Kerberos, and session-based authentication.
117

118
```python { .api }
119
# Basic Auth Backend
120
def auth_current_user() -> User | None: ...
121
def requires_authentication(function: T) -> T: ...
122

123
# Kerberos Auth Backend  
124
class KerberosService: ...
125
def find_user(username: str | None = None, email: str | None = None) -> User | None: ...
126

127
# Session Auth Backend
128
def requires_authentication(function: T) -> T: ...
129
```
130

131
[Authentication Backends](./auth-backends.md)
132

133
### API Endpoints
134

135
REST API endpoints for programmatic user and role management through HTTP requests.
136

137
```python { .api }
138
# User endpoint operations
139
def get_users() -> dict: ...
140
def get_user(user_id: int) -> dict: ...
141
def patch_user(user_id: int, data: dict) -> dict: ...
142

143
# Role and permission endpoint operations  
144
def get_roles() -> dict: ...
145
def get_role(role_id: int) -> dict: ...
146
def get_permissions() -> dict: ...
147
```
148

149
[API Endpoints](./api-endpoints.md)
150

151
## Types
152

153
```python { .api }
154
from typing import TypeVar, Callable, Sequence, Container
155
from airflow.auth.managers.models.base_user import BaseUser
156
from airflow.auth.managers.base_auth_manager import ResourceMethod
157
from airflow.auth.managers.models.resource_details import (
158
    DagDetails,
159
    DagAccessEntity,
160
    AccessView,
161
    ConnectionDetails,
162
    VariableDetails,
163
    PoolDetails,
164
    ConfigurationDetails
165
)
166
from sqlalchemy.orm import Session
167
from airflow.utils.session import NEW_SESSION
168

169
T = TypeVar("T", bound=Callable)
170
```