Airflow Summit 2026 is coming August 31 - September 2 in Austin, TX. Register now to secure your spot!

airflow.providers.keycloak.auth_manager.keycloak_auth_manager

Attributes

log

RESOURCE_ID_ATTRIBUTE_NAME

TEAM_SCOPED_RESOURCES

Classes

KeycloakAuthManager

Keycloak auth manager.

Module Contents

airflow.providers.keycloak.auth_manager.keycloak_auth_manager.log[source]
airflow.providers.keycloak.auth_manager.keycloak_auth_manager.RESOURCE_ID_ATTRIBUTE_NAME = 'resource_id'[source]
airflow.providers.keycloak.auth_manager.keycloak_auth_manager.TEAM_SCOPED_RESOURCES[source]
class airflow.providers.keycloak.auth_manager.keycloak_auth_manager.KeycloakAuthManager[source]

Bases: airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager[airflow.providers.keycloak.auth_manager.user.KeycloakAuthManagerUser]

Keycloak auth manager.

Leverages Keycloak to perform authentication and authorization in Airflow.

property http_session: requests.Session[source]

Lazy-initialize and return the requests session with connection pooling.

deserialize_user(token)[source]

Create a user object from dict.

serialize_user(user)[source]

Create a subject and extra claims dict from a user object.

async get_user_from_token(token, access_token=None, refresh_token=None)[source]

Get the user from the Airflow and Keycloak Tokens.

Parameters:

  • token (str) – Airflow JWT

  • access_token (str | None) – Keycloak access JWT

  • refresh_token (str | None) – Keycloak refresh JWT

get_url_login(**kwargs)[source]

Return the login page url.

get_url_logout()[source]

Return the logout page url.

The user is redirected to this URL when logging out. If None is returned (by default), no redirection is performed. This redirection is usually needed to invalidate resources when logging out, such as a session.

refresh_user(*, user)[source]

Refresh the user if needed.

By default, does nothing. Some auth managers might need to refresh the user to, for instance, refresh some tokens that are needed to communicate with a service/tool.

This method is called by every single request, it must be lightweight otherwise the overall API server latency will increase.

refresh_tokens(*, user)[source]
is_authorized_configuration(*, method, user, details=None)[source]

Return whether the user is authorized to perform a given action on configuration.

Parameters:

  • method (airflow.api_fastapi.auth.managers.base_auth_manager.ResourceMethod) – the method to perform

  • user (airflow.providers.keycloak.auth_manager.user.KeycloakAuthManagerUser) – the user to performing the action

  • details (airflow.api_fastapi.auth.managers.models.resource_details.ConfigurationDetails | None) – optional details about the configuration

is_authorized_connection(*, method, user, details=None)[source]

Return whether the user is authorized to perform a given action on a connection.

Parameters:

  • method (airflow.api_fastapi.auth.managers.base_auth_manager.ResourceMethod) – the method to perform

  • user (airflow.providers.keycloak.auth_manager.user.KeycloakAuthManagerUser) – the user to performing the action

  • details (airflow.api_fastapi.auth.managers.models.resource_details.ConnectionDetails | None) – optional details about the connection

is_authorized_dag(*, method, user, access_entity=None, details=None)[source]

Return whether the user is authorized to perform a given action on a Dag.

Parameters:

  • method (airflow.api_fastapi.auth.managers.base_auth_manager.ResourceMethod) – the method to perform

  • user (airflow.providers.keycloak.auth_manager.user.KeycloakAuthManagerUser) – the user to performing the action

  • access_entity (airflow.api_fastapi.auth.managers.models.resource_details.DagAccessEntity | None) – the kind of Dag information the authorization request is about. If not provided, the authorization request is about the Dag itself

  • details (airflow.api_fastapi.auth.managers.models.resource_details.DagDetails | None) – optional details about the Dag

is_authorized_backfill(*, method, user, details=None)[source]
is_authorized_asset(*, method, user, details=None)[source]

Return whether the user is authorized to perform a given action on an asset.

Parameters:

  • method (airflow.api_fastapi.auth.managers.base_auth_manager.ResourceMethod) – the method to perform

  • user (airflow.providers.keycloak.auth_manager.user.KeycloakAuthManagerUser) – the user to performing the action

  • details (airflow.api_fastapi.auth.managers.models.resource_details.AssetDetails | None) – optional details about the asset

is_authorized_asset_alias(*, method, user, details=None)[source]

Return whether the user is authorized to perform a given action on an asset alias.

Parameters:

  • method (airflow.api_fastapi.auth.managers.base_auth_manager.ResourceMethod) – the method to perform

  • user (airflow.providers.keycloak.auth_manager.user.KeycloakAuthManagerUser) – the user to perform the action on

  • details (airflow.api_fastapi.auth.managers.models.resource_details.AssetAliasDetails | None) – optional details about the asset alias

is_authorized_variable(*, method, user, details=None)[source]

Return whether the user is authorized to perform a given action on a variable.

Parameters:

  • method (airflow.api_fastapi.auth.managers.base_auth_manager.ResourceMethod) – the method to perform

  • user (airflow.providers.keycloak.auth_manager.user.KeycloakAuthManagerUser) – the user to performing the action

  • details (airflow.api_fastapi.auth.managers.models.resource_details.VariableDetails | None) – optional details about the variable

is_authorized_pool(*, method, user, details=None)[source]

Return whether the user is authorized to perform a given action on a pool.

Parameters:

  • method (airflow.api_fastapi.auth.managers.base_auth_manager.ResourceMethod) – the method to perform

  • user (airflow.providers.keycloak.auth_manager.user.KeycloakAuthManagerUser) – the user to performing the action

  • details (airflow.api_fastapi.auth.managers.models.resource_details.PoolDetails | None) – optional details about the pool

is_authorized_team(*, method, user, details=None)[source]

Return whether the user is authorized to perform a given action on a team.

It is used primarily to check whether a user belongs to a team. This function needs to be overridden by an auth manager compatible with multi-team.

Parameters:
is_authorized_view(*, access_view, user, team_name=None)[source]

Return whether the user is authorized to access a read-only state of the installation.

Parameters:

  • access_view (airflow.api_fastapi.auth.managers.models.resource_details.AccessView) – the specific read-only view/state the authorization request is about.

  • user (airflow.providers.keycloak.auth_manager.user.KeycloakAuthManagerUser) – the user to performing the action

  • team_name (str | None) – team the view is scoped to, if any. Managers without multi-team support may accept and ignore it, which authorizes the view globally.

is_authorized_custom_view(*, method, resource_name, user)[source]

Return whether the user is authorized to perform a given action on a custom view.

A custom view can be a view defined as part of the auth manager. This view is then only available when the auth manager is used as part of the environment. It can also be a view defined as part of a plugin defined by a user.

Parameters:
filter_authorized_menu_items(menu_items, *, user)[source]

Filter menu items based on user permissions.

Parameters:
get_fastapi_app()[source]

Specify a sub FastAPI application specific to the auth manager.

This sub application, if specified, is mounted in the main FastAPI application.

get_fastapi_middlewares()[source]

Return middlewares the auth manager wants registered on the main FastAPI app.

Each entry is a (middleware_class, kwargs) tuple and is registered via app.add_middleware by the API server. Auth managers that need to intercept or augment incoming requests (for example, attaching an anonymous user to unauthenticated requests when public access is configured) should override this method.

static get_cli_commands()[source]

Vends CLI commands to be included in Airflow CLI.

static get_keycloak_client(client_id=None, client_secret=None)[source]

Get a KeycloakOpenID client instance.

Parameters:

  • client_id (str | None) – Optional client ID to override config. If provided, client_secret must also be provided.

  • client_secret (str | None) – Optional client secret to override config. If provided, client_id must also be provided.

filter_authorized_dag_ids(*, dag_ids, user, method='GET', team_name=None)[source]

Filter Dags the user has access to.

By default, check individually if the user has permissions to access the Dag. Can lead to some poor performance. It is recommended to override this method in the auth manager implementation to provide a more efficient implementation.

Parameters:
batch_is_authorized_connection(requests, *, user)[source]

Batch version of is_authorized_connection.

By default, calls individually the is_authorized_connection API on each item in the list of requests. Can lead to some poor performance. It is recommended to override this method in the auth manager implementation to provide a more efficient implementation.

Parameters:
batch_is_authorized_dag(requests, *, user)[source]

Batch version of is_authorized_dag.

By default, calls individually the is_authorized_dag API on each item in the list of requests. Can lead to some poor performance. It is recommended to override this method in the auth manager implementation to provide a more efficient implementation.

Parameters:
batch_is_authorized_pool(requests, *, user)[source]

Batch version of is_authorized_pool.

By default, calls individually the is_authorized_pool API on each item in the list of requests. Can lead to some poor performance. It is recommended to override this method in the auth manager implementation to provide a more efficient implementation.

Parameters:
batch_is_authorized_variable(requests, *, user)[source]

Batch version of is_authorized_variable.

By default, calls individually the is_authorized_variable API on each item in the list of requests. Can lead to some poor performance. It is recommended to override this method in the auth manager implementation to provide a more efficient implementation.

Parameters:
filter_authorized_connections(*, conn_ids, user, method='GET', team_name=None)[source]

Filter connections the user has access to.

By default, check individually if the user has permissions to access the connection. Can lead to some poor performance. It is recommended to override this method in the auth manager implementation to provide a more efficient implementation.

Parameters:
filter_authorized_pools(*, pool_names, user, method='GET', team_name=None)[source]

Filter pools the user has access to.

By default, check individually if the user has permissions to access the pool. Can lead to some poor performance. It is recommended to override this method in the auth manager implementation to provide a more efficient implementation.

Parameters:
filter_authorized_variables(*, variable_keys, user, method='GET', team_name=None)[source]

Filter variables the user has access to.

By default, check individually if the user has permissions to access the variable. Can lead to some poor performance. It is recommended to override this method in the auth manager implementation to provide a more efficient implementation.

Parameters:

Was this entry helpful?