apache-airflow-providers-fab 2.2.1rc2__tar.gz → 2.3.0rc1__tar.gz

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: apache-airflow-providers-fab
-Version: 2.2.1rc2
+Version: 2.3.0rc1
 Summary: Provider package apache-airflow-providers-fab for Apache Airflow
 Keywords: airflow-provider,fab,airflow,integration
 Author-email: Apache Software Foundation <dev@airflow.apache.org>
 Maintainer-email: Apache Software Foundation <dev@airflow.apache.org>
-Requires-Python: ~=3.9
+Requires-Python: ~=3.10
 Description-Content-Type: text/x-rst
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
@@ -15,7 +15,6 @@ Classifier: Intended Audience :: System Administrators
 Classifier: Framework :: Apache Airflow
 Classifier: Framework :: Apache Airflow :: Provider
 Classifier: License :: OSI Approved :: Apache Software License
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -36,8 +35,8 @@ Requires-Dist: werkzeug>=2.2,<4
 Requires-Dist: wtforms>=3.0,<4
 Requires-Dist: kerberos>=1.3.0 ; extra == "kerberos"
 Project-URL: Bug Tracker, https://github.com/apache/airflow/issues
-Project-URL: Changelog, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.2.1/changelog.html
-Project-URL: Documentation, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.2.1
+Project-URL: Changelog, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.3.0/changelog.html
+Project-URL: Documentation, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.3.0
 Project-URL: Mastodon, https://fosstodon.org/@airflow
 Project-URL: Slack Chat, https://s.apache.org/airflow-slack
 Project-URL: Source Code, https://github.com/apache/airflow
@@ -69,7 +68,7 @@ Provides-Extra: kerberos
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``2.2.1``
+Release: ``2.3.0``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -82,7 +81,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.2.1/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.3.0/>`_.
 
 Installation
 ------------
@@ -91,7 +90,7 @@ You can install this package on top of an existing Airflow 2 installation (see `
 for the minimum Airflow version supported) via
 ``pip install apache-airflow-providers-fab``
 
-The package supports the following python versions: 3.9,3.10,3.11,3.12
+The package supports the following python versions: 3.10,3.11,3.12
 
 Requirements
 ------------
@@ -133,5 +132,5 @@ Dependent package
 ==================================================================================================================  =================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.2.1/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.3.0/changelog.html>`_.
 

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/README.rst

@@ -23,7 +23,7 @@
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``2.2.1``
+Release: ``2.3.0``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -36,7 +36,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.2.1/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.3.0/>`_.
 
 Installation
 ------------
@@ -45,7 +45,7 @@ You can install this package on top of an existing Airflow 2 installation (see `
 for the minimum Airflow version supported) via
 ``pip install apache-airflow-providers-fab``
 
-The package supports the following python versions: 3.9,3.10,3.11,3.12
+The package supports the following python versions: 3.10,3.11,3.12
 
 Requirements
 ------------
@@ -87,4 +87,4 @@ Dependent package
 ==================================================================================================================  =================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.2.1/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.3.0/changelog.html>`_.

apache_airflow_providers_fab-2.3.0rc1/docs/auth-manager/api-authentication.rst

@@ -0,0 +1,340 @@
+ .. Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+ ..   http://www.apache.org/licenses/LICENSE-2.0
+
+ .. Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+FAB auth manager API authentication
+===================================
+
+.. note::
+    This guide only applies to :doc:`FAB auth manager API </api-ref/fab-public-api-ref>`.
+
+Authentication for the APIs is handled by what is called an authentication backend. The default is to check the user session:
+
+.. code-block:: ini
+
+    [fab]
+    auth_backends = airflow.providers.fab.auth_manager.api.auth.backend.session
+
+If you want to check which authentication backends are currently set, you can use ``airflow config get-value fab auth_backends``
+command as in the example below.
+
+.. code-block:: console
+
+    $ airflow config get-value fab auth_backends
+    airflow.providers.fab.auth_manager.api.auth.backend.basic_auth
+
+.. versionchanged:: 3.0.0
+
+    In Airflow, the default setting is using token based authentication.
+    This approach is independent from which ``auth_backend`` is used.
+    The default setting is using Airflow public API to create a token (JWT) first and use this token in the requests to access the API.
+
+Kerberos authentication
+'''''''''''''''''''''''
+
+Kerberos authentication is currently supported for the API, both experimental and stable.
+
+To enable Kerberos authentication, set the following in the configuration:
+
+.. code-block:: ini
+
+    [fab]
+    auth_backends = airflow.providers.fab.auth_manager.api.auth.backend.kerberos_auth
+
+    [kerberos]
+    keytab = <KEYTAB>
+
+The Airflow Kerberos service is configured as ``airflow/fully.qualified.domainname@REALM``. Make sure this
+principal exists `in both the Kerberos database as well as in the keytab file </docs/apache-airflow/stable/security/kerberos.html#enabling-kerberos>`_.
+
+You have to make sure to name your users with the kerberos full username/realm in order to make it
+work. This means that your user name should be ``user_name@REALM``.
+
+.. code-block:: bash
+
+    kinit user_name@REALM
+    ENDPOINT_URL="http://localhost:8080/"
+    curl -X GET  \
+        --negotiate \  # enables Negotiate (SPNEGO) authentication
+        --service airflow \  # matches the `airflow` service name in the `airflow/fully.qualified.domainname@REALM` principal
+        --user : \
+        "${ENDPOINT_URL}/api/v1/pools"
+
+
+.. note::
+
+    Remember that the APIs are secured by both authentication and `access control <./access-control.html>`_.
+    This means that your user needs to have a Role with necessary associated permissions, otherwise you'll receive
+    a 403 response.
+
+
+Basic authentication
+''''''''''''''''''''
+
+`Basic username password authentication <https://en.wikipedia.org/wiki/Basic_access_authentication>`_ is currently
+supported for the API. This works for users created through LDAP login or
+within Airflow Metadata DB using password.
+
+To enable basic authentication, set the following in the configuration:
+
+.. code-block:: ini
+
+    [fab]
+    auth_backends = airflow.providers.fab.auth_manager.api.auth.backend.basic_auth
+
+Username and password needs to be base64 encoded and send through the
+``Authorization`` HTTP header in the following format:
+
+.. code-block:: text
+
+    Authorization: Basic Base64(username:password)
+
+Here is a sample curl command you can use to validate the setup:
+
+.. code-block:: bash
+
+    ENDPOINT_URL="http://localhost:8080/"
+    curl -X GET  \
+        --user "username:password" \
+        "${ENDPOINT_URL}/api/v1/pools"
+
+Note, you can still enable this setting to allow API access through username
+password credential even though Airflow webserver might be using another
+authentication method. Under this setup, only users created through LDAP or
+``airflow users create`` command will be able to pass the API authentication.
+
+Roll your own API authentication
+''''''''''''''''''''''''''''''''
+
+Each auth backend is defined as a new Python module. It must have 2 defined methods:
+
+* ``init_app(app: Flask)`` - function invoked when creating a flask application, which allows you to add a new view.
+* ``requires_authentication(fn: Callable)`` - a decorator that allows arbitrary code execution before and after or instead of a view function.
+
+and may have one of the following to support API client authorizations used by :ref:`remote mode for CLI <cli-remote>`:
+
+* function ``create_client_session() -> requests.Session``
+* attribute ``CLIENT_AUTH: tuple[str, str] | requests.auth.AuthBase | None``
+
+After writing your backend module, provide the fully qualified module name in the ``auth_backends`` key in the ``[fab]``
+section of ``airflow.cfg``.
+
+Additional options to your auth backend can be configured in ``airflow.cfg``, as a new option.
+
+Example using Keycloak authentication
+'''''''''''''''''''''''''''''''''''''
+
+The following example add also ``PKCE`` authentication flow.
+
+You must configure Keycloak accordingly, create ``clientID`` in Keycloak:
+
+.. code-block:: text
+
+    Client ID:                       <airflow-client-id> # Your choice
+    Root URL:                        https://<your-airflow-url.fr>
+    Home URL:
+    Valid redirect URIs:             https://<your-airflow-url.fr>/auth/oauth-authorized/keycloak # with webserver (airflow <3.0) it was https://<your-airflow-url.fr>/oauth-authorized/keycloak
+
+    Valid post logout redirect URIs: https://<your-airflow-url.fr>
+
+    Web origins: +
+    Admin URL: https://<your-airflow-url.fr>
+
+In Capability config, you must select:
+
+.. code-block:: text
+
+    Client authentication   On
+    Authorization           Off
+    Authentication flow     [x] Standard flow                        [x] Direct access grants
+                            [ ] Implicit flow                        [ ] Service accounts roles
+                            [ ] OAuth 2.0 Device Authorization Grant
+                            [ ] OIDC CIBA Grant
+
+In Roles tab, you must create the following roles:
+
+.. code-block:: text
+
+    airflow_admin
+    airflow_op
+    airflow_public
+    airflow_user
+    airflow_viewer
+
+In Advanced tab, section Advanced settings (needed for PKCE flow):
+
+.. code-block:: text
+
+    Proof Key for Code Exchange Code Challenge Method: S256
+
+You must create the following environment variables in your Airflow deployment:
+
+.. code-block:: bash
+
+    export CLIENT_ID=<airflow-client-id>
+    export CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+    export OIDC_ISSUER=https://<your-keycloak-url.fr>/auth/realms/<REALM>
+    export AIRFLOW__API__BASE_URL=https://<your-airflow-url.fr>
+
+or create a Secret with these values for your Helm chart:
+
+.. code-block:: bash
+
+    kubectl -n airflow create secret generic airflow-api-keycloak \
+      --from-literal=CLIENT_ID=<airflow-client-id> \
+      --from-literal=CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
+      --from-literal=OIDC_ISSUER=https://<your-keycloak-url.fr>/auth/realms/<REALM> \
+      --from-literal=AIRFLOW__API__BASE_URL=https://<your-airflow-url.fr>
+
+and configure your Helm chart to use this Secret:
+
+.. code-block:: yaml
+
+    apiServer:
+      env:
+        - name: CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: airflow-api-keycloak
+              key: CLIENT_ID
+        - name: CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: airflow-api-keycloak
+              key: CLIENT_SECRET
+        - name: OIDC_ISSUER
+          valueFrom:
+            secretKeyRef:
+              name: airflow-api-keycloak
+              key: OIDC_ISSUER
+        - name: AIRFLOW__API__BASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: airflow-api-keycloak
+              key: AIRFLOW__API__BASE_URL
+
+Here is an example of what you might have in your ``webserver_config.py`` or ``apiServerConfig`` value in Helm chart:
+
+.. code-block:: python
+
+    from airflow.providers.fab.auth_manager.security_manager.override import FabAirflowSecurityManagerOverride
+    from base64 import b64decode
+    from cryptography.hazmat.primitives import serialization
+    from flask import redirect, session
+    from flask_appbuilder import expose
+    from flask_appbuilder.security.manager import AUTH_OAUTH
+    from flask_appbuilder.security.views import AuthOAuthView
+    import jwt
+    import logging
+    import os
+    import requests
+
+    log = logging.getLogger(__name__)
+    CSRF_ENABLED = True
+    AUTH_TYPE = AUTH_OAUTH
+    AUTH_USER_REGISTRATION = True
+    AUTH_ROLES_SYNC_AT_LOGIN = True
+    AUTH_USER_REGISTRATION_ROLE = "Public"
+    PERMANENT_SESSION_LIFETIME = 43200
+
+    # Make sure you create these roles on Keycloak
+    AUTH_ROLES_MAPPING = {
+        "airflow_admin": ["Admin"],
+        "airflow_op": ["Op"],
+        "airflow_public": ["Public"],
+        "airflow_user": ["User"],
+        "airflow_viewer": ["Viewer"],
+    }
+    PROVIDER_NAME = "keycloak"
+    CLIENT_ID = os.getenv("CLIENT_ID")
+    CLIENT_SECRET = os.getenv("CLIENT_SECRET")
+    AIRFLOW__API__BASE_URL = os.getenv("AIRFLOW__API__BASE_URL")
+    OIDC_ISSUER = os.getenv("OIDC_ISSUER")
+    OIDC_BASE_URL = f"{OIDC_ISSUER}/protocol/openid-connect"
+    OIDC_TOKEN_URL = f"{OIDC_BASE_URL}/token"
+    OIDC_AUTH_URL = f"{OIDC_BASE_URL}/auth"
+    OIDC_METADATA_URL = f"{OIDC_ISSUER}/.well-known/openid-configuration"
+    OAUTH_PROVIDERS = [
+        {
+            "name": PROVIDER_NAME,
+            "token_key": "access_token",
+            "icon": "fa-key",
+            "remote_app": {
+                "api_base_url": OIDC_BASE_URL,
+                "access_token_url": OIDC_TOKEN_URL,
+                "authorize_url": OIDC_AUTH_URL,
+                "server_metadata_url": OIDC_METADATA_URL,
+                "request_token_url": None,
+                "client_id": CLIENT_ID,
+                "client_secret": CLIENT_SECRET,
+                "client_kwargs": {
+                    "scope": "email profile",
+                    "code_challenge_method": "S256",  # Needed for PKCE flow
+                    "response_type": "code",  # Needed for PKCE flow
+                },
+            },
+        }
+    ]
+
+    # Fetch public key
+    req = requests.get(OIDC_ISSUER)
+    key_der_base64 = req.json()["public_key"]
+    key_der = b64decode(key_der_base64.encode())
+    public_key = serialization.load_der_public_key(key_der)
+
+
+    class CustomOAuthView(AuthOAuthView):
+        @expose("/logout/", methods=["GET", "POST"])
+        def logout(self):
+            session.clear()
+            return redirect(
+                f"{OIDC_ISSUER}/protocol/openid-connect/logout?post_logout_redirect_uri={AIRFLOW__API__BASE_URL}&client_id={CLIENT_ID}"
+            )
+
+
+    class CustomSecurityManager(FabAirflowSecurityManagerOverride):
+        authoauthview = CustomOAuthView
+
+        def get_oauth_user_info(self, provider, response):
+            if provider == "keycloak":
+                token = response["access_token"]
+                me = jwt.decode(token, public_key, algorithms=["HS256", "RS256"], audience=CLIENT_ID)
+
+                # Extract roles from resource access
+                groups = me.get("resource_access", {}).get(CLIENT_ID, {}).get("roles", [])
+
+                log.info(f"groups: {groups}")
+
+                if not groups:
+                    groups = ["Viewer"]
+
+                userinfo = {
+                    "username": me.get("preferred_username"),
+                    "email": me.get("email"),
+                    "first_name": me.get("given_name"),
+                    "last_name": me.get("family_name"),
+                    "role_keys": groups,
+                }
+
+                log.info(f"user info: {userinfo}")
+
+                return userinfo
+            else:
+                return {}
+
+
+    # Make sure to replace this with your own implementation of AirflowSecurityManager class
+    SECURITY_MANAGER_CLASS = CustomSecurityManager

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/docs/auth-manager/token.rst

@@ -40,3 +40,6 @@ Example
         }'
 
 This process will return a token that you can use in the Airflow public API requests.
+
+Only users from database (`AUTH_TYPE = AUTH_DB`) or from LDAP (`AUTH_TYPE = AUTH_LDAP`) can be used to generate a token.
+See :doc:`Airflow public API <webserver-authentication>` for more details.

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/docs/changelog.rst

@@ -20,6 +20,36 @@
 Changelog
 ---------
 
+2.3.0
+.....
+
+Features
+~~~~~~~~
+
+* ``[AIP-68] Support pluginv2 views (#52582)``
+
+Bug Fixes
+~~~~~~~~~
+
+* ``Set prefix to generate correctly the FAB Auth Manager API ref (#52329)``
+* ``Fix airflow pin for fab provider (#52351)``
+* ``Sanitize Username (#52419)``
+
+Misc
+~~~~
+
+* ``Drop support for Python 3.9 (#52072)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 4 updates (#52108)``
+
+Doc-only
+~~~~~~~~
+
+* ``Enable LDAP users to generate an Airflow token with 'FabAuthManager' (#52295)``
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+   * ``remove pytest db_test marker where unnecessary (#52171)``
+
 2.2.1
 .....
 

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/docs/index.rst

@@ -84,7 +84,7 @@ apache-airflow-providers-fab package
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
 
 
-Release: 2.2.1
+Release: 2.3.0
 
 Provider package
 ----------------
@@ -146,5 +146,5 @@ Downloading official packages
 You can download officially released packages and verify their checksums and signatures from the
 `Official Apache Download site <https://downloads.apache.org/airflow/providers/>`_
 
-* `The apache-airflow-providers-fab 2.2.1 sdist package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.2.1.tar.gz>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.2.1.tar.gz.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.2.1.tar.gz.sha512>`__)
-* `The apache-airflow-providers-fab 2.2.1 wheel package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.2.1-py3-none-any.whl>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.2.1-py3-none-any.whl.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.2.1-py3-none-any.whl.sha512>`__)
+* `The apache-airflow-providers-fab 2.3.0 sdist package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.3.0.tar.gz>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.3.0.tar.gz.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.3.0.tar.gz.sha512>`__)
+* `The apache-airflow-providers-fab 2.3.0 wheel package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.3.0-py3-none-any.whl>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.3.0-py3-none-any.whl.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.3.0-py3-none-any.whl.sha512>`__)

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/provider.yaml

@@ -28,13 +28,14 @@ description: |
 # For providers until we think it should be released.
 state: ready
 
-source-date-epoch: 1749896451
+source-date-epoch: 1751473430
 
 # Note that those versions are maintained by release manager - do not update them manually
 # with the exception of case where other provider in sources has >= new provider version.
 # In such case adding >= NEW_VERSION and bumping to NEW_VERSION in a provider have
 # to be done in the same PR
 versions:
+  - 2.3.0
   - 2.2.1
   - 2.2.0
   - 2.1.0

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/pyproject.toml

@@ -25,7 +25,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "apache-airflow-providers-fab"
-version = "2.2.1rc2"
+version = "2.3.0rc1"
 description = "Provider package apache-airflow-providers-fab for Apache Airflow"
 readme = "README.rst"
 authors = [
@@ -44,13 +44,12 @@ classifiers = [
     "Framework :: Apache Airflow",
     "Framework :: Apache Airflow :: Provider",
     "License :: OSI Approved :: Apache Software License",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Topic :: System :: Monitoring",
 ]
-requires-python = "~=3.9"
+requires-python = "~=3.10"
 license-files = ["NOTICE", "*/LICENSE*"]
 # The dependencies should be modified in place in the generated file.
 # Any change in the dependencies is preserved when the file is regenerated
@@ -127,8 +126,8 @@ apache-airflow-providers-common-sql = {workspace = true}
 apache-airflow-providers-standard = {workspace = true}
 
 [project.urls]
-"Documentation" = "https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.2.1"
-"Changelog" = "https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.2.1/changelog.html"
+"Documentation" = "https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.3.0"
+"Changelog" = "https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.3.0/changelog.html"
 "Bug Tracker" = "https://github.com/apache/airflow/issues"
 "Source Code" = "https://github.com/apache/airflow"
 "Slack Chat" = "https://s.apache.org/airflow-slack"

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/src/airflow/providers/fab/__init__.py

@@ -29,7 +29,7 @@ from airflow import __version__ as airflow_version
 
 __all__ = ["__version__"]
 
-__version__ = "2.2.1"
+__version__ = "2.3.0"
 
 if packaging.version.parse(packaging.version.parse(airflow_version).base_version) < packaging.version.parse(
     "3.0.2"

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/src/airflow/providers/fab/auth_manager/api/auth/backend/basic_auth.py

@@ -18,8 +18,9 @@
 
 from __future__ import annotations
 
+from collections.abc import Callable
 from functools import wraps
-from typing import TYPE_CHECKING, Any, Callable, TypeVar, cast
+from typing import TYPE_CHECKING, Any, TypeVar, cast
 
 from flask import Response, current_app, request
 from flask_appbuilder.const import AUTH_LDAP

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/src/airflow/providers/fab/auth_manager/api/auth/backend/kerberos_auth.py

@@ -19,8 +19,9 @@ from __future__ import annotations
 
 import logging
 import os
+from collections.abc import Callable
 from functools import wraps
-from typing import TYPE_CHECKING, Any, Callable, NamedTuple, TypeVar, cast
+from typing import TYPE_CHECKING, Any, NamedTuple, TypeVar, cast
 
 import kerberos
 from flask import Response, current_app, g, make_response, request

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/src/airflow/providers/fab/auth_manager/api/auth/backend/session.py

@@ -18,8 +18,9 @@
 
 from __future__ import annotations
 
+from collections.abc import Callable
 from functools import wraps
-from typing import Any, Callable, TypeVar, cast
+from typing import Any, TypeVar, cast
 
 from flask import Response
 

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/src/airflow/providers/fab/auth_manager/api_fastapi/openapi/v2-fab-auth-manager-generated.yaml

@@ -6,7 +6,7 @@ info:
     endpoints to manage users and permissions managed by the FAB auth manager.
   version: 0.1.0
 paths:
-  /token:
+  /auth/token:
     post:
       tags:
       - FabAuthManager
@@ -44,7 +44,7 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/HTTPValidationError'
-  /token/cli:
+  /auth/token/cli:
     post:
       tags:
       - FabAuthManager

{apache_airflow_providers_fab-2.2.1rc2 → apache_airflow_providers_fab-2.3.0rc1}/src/airflow/providers/fab/auth_manager/api_fastapi/services/login.py

@@ -18,6 +18,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING, cast
 
+from flask_appbuilder.const import AUTH_LDAP
 from starlette import status
 from starlette.exceptions import HTTPException
 
@@ -44,14 +45,22 @@ class FABAuthManagerLogin:
             )
 
         auth_manager = cast("FabAuthManager", get_auth_manager())
-        user: User = auth_manager.security_manager.find_user(username=body.username)
+        user: User | None = None
+
+        if auth_manager.security_manager.auth_type == AUTH_LDAP:
+            user = auth_manager.security_manager.auth_user_ldap(
+                body.username, body.password, rotate_session_id=False
+            )
+        if user is None:
+            user = auth_manager.security_manager.auth_user_db(
+                body.username, body.password, rotate_session_id=False
+            )
+
         if not user:
-            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid username")
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
 
-        if auth_manager.security_manager.check_password(username=body.username, password=body.password):
-            return LoginResponse(
-                access_token=auth_manager.generate_jwt(
-                    user=user, expiration_time_in_seconds=expiration_time_in_seconds
-                )
+        return LoginResponse(
+            access_token=auth_manager.generate_jwt(
+                user=user, expiration_time_in_seconds=expiration_time_in_seconds
             )
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid password")
+        )