Skip to content

Instantly share code, notes, and snippets.

@zeqk

zeqk/apache_airflow_sso_howto.md

Forked from wallyhall/apache_airflow_sso_howto.md
Created March 5, 2025 17:09
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save zeqk/97c085d003db403fef2c8046dfdf31a6 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save zeqk/97c085d003db403fef2c8046dfdf31a6 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @wallyhall wallyhall revised this gist Nov 7, 2023. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions apache_airflow_sso_howto.md
    View file
    Original file line number Diff line number Diff line change
    @@ -67,7 +67,9 @@ class AzureCustomSecurity(AirflowSecurityManager, LoggingMixin):
    "role_keys": me["roles"]
    }
    # the first of these two appears to work with older Airflow versions, the latter newer.
    FAB_SECURITY_MANAGER_CLASS = 'webserver_config.AzureCustomSecurity'
    SECURITY_MANAGER_CLASS = AzureCustomSecurity
    ```

    The above assumes environment variables are configured for the OAuth client secret, etc - and has been tested thoroughly and confirmed working.
  2. @wallyhall wallyhall renamed this gist May 11, 2023. 1 changed file with 0 additions and 0 deletions.
    0 README.md → apache_airflow_sso_howto.md
    View file
    File renamed without changes.
  3. @wallyhall wallyhall revised this gist May 11, 2023. No changes.
  4. @wallyhall wallyhall created this gist May 11, 2023.
    75 changes: 75 additions & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,75 @@
    The following instructions for enabling Azure SSO for Apache Airflow nearly take you all the way - but fall short a couple of details around the configuration of airflow itself:

    https://objectpartners.com/2021/12/24/enterprise-auth-for-airflow-azure-ad

    All the "Azure" instructions there can be safely followed - the resulting `webserver_config.py` (which can be injected into a dockerised Airflow in `/opt/airflow/webserver_config.py`) can be built from the following:

    ```
    from __future__ import annotations
    import os
    from airflow.www.fab_security.manager import AUTH_OAUTH
    from airflow.www.security import AirflowSecurityManager
    from airflow.utils.log.logging_mixin import LoggingMixin
    basedir = os.path.abspath(os.path.dirname(__file__))
    # Flask-WTF flag for CSRF
    WTF_CSRF_ENABLED = True
    WTF_CSRF_TIME_LIMIT = None
    AUTH_TYPE = AUTH_OAUTH
    OAUTH_PROVIDERS = [{
    'name':'Microsoft Azure AD',
    'token_key':'access_token',
    'icon':'fa-windows',
    'remote_app': {
    'api_base_url': "https://login.microsoftonline.com/{}".format(os.getenv("AAD_TENANT_ID")),
    'request_token_url': None,
    'request_token_params': {
    'scope': 'openid email profile'
    },
    'access_token_url': "https://login.microsoftonline.com/{}/oauth2/v2.0/token".format(os.getenv("AAD_TENANT_ID")),
    "access_token_params": {
    'scope': 'openid email profile'
    },
    'authorize_url': "https://login.microsoftonline.com/{}/oauth2/v2.0/authorize".format(os.getenv("AAD_TENANT_ID")),
    "authorize_params": {
    'scope': 'openid email profile'
    },
    'client_id': os.getenv("AAD_CLIENT_ID"),
    'client_secret': os.getenv("AAD_CLIENT_SECRET"),
    'jwks_uri': 'https://login.microsoftonline.com/common/discovery/v2.0/keys'
    }
    }]
    AUTH_USER_REGISTRATION_ROLE = "Public"
    AUTH_USER_REGISTRATION = True
    AUTH_ROLES_SYNC_AT_LOGIN = True
    AUTH_ROLES_MAPPING = {
    "airflow_prod_admin": ["Admin"],
    "airflow_prod_user": ["Op"],
    "airflow_prod_viewer": ["Viewer"]
    }
    class AzureCustomSecurity(AirflowSecurityManager, LoggingMixin):
    def get_oauth_user_info(self, provider, response=None):
    me = self._azure_jwt_token_parse(response["id_token"])
    return {
    "name": me["name"],
    "email": me["email"],
    "first_name": me["given_name"],
    "last_name": me["family_name"],
    "id": me["oid"],
    "username": me["preferred_username"],
    "role_keys": me["roles"]
    }
    FAB_SECURITY_MANAGER_CLASS = 'webserver_config.AzureCustomSecurity'
    ```

    The above assumes environment variables are configured for the OAuth client secret, etc - and has been tested thoroughly and confirmed working.

    Note the roles need to match what you configured in Azure (the example above is using `airflow_prod_user` etc, in deviation to the linked article above).