apache-airflow-providers-fab 3.0.1rc1__tar.gz → 3.2.0__tar.gz

apache_airflow_providers_fab-3.2.0/.pre-commit-config.yaml

@@ -0,0 +1,60 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+---
+default_stages: [pre-commit, pre-push]
+minimum_prek_version: '0.2.0'
+default_language_version:
+  python: python3
+  node: 22.19.0
+  golang: 1.24.0
+repos:
+  - repo: local
+    hooks:
+      - id: compile-fab-assets
+        name: Compile FAB provider assets
+        language: node
+        files: ^src/airflow/providers/fab/www/
+        exclude: |
+          (?x)
+          ^src/airflow/providers/fab/www/api_connexion/.*|
+          ^src/airflow/providers/fab/www/extensions/.*|
+          ^src/airflow/providers/fab/www/security/.*
+        entry: ../../scripts/ci/prek/compile_provider_assets.py fab
+        pass_filenames: false
+        additional_dependencies: ['yarn@1.22.21']
+      - id: generate-openapi-spec-fab
+        name: Generate the FastAPI API spec for FAB
+        language: python
+        entry: ../../scripts/ci/prek/generate_openapi_spec_providers.py fab
+        pass_filenames: false
+        files: ^src/airflow/providers/fab/auth_manager/api_fastapi/.*\.py$
+      - id: check-revision-heads-map-fab
+        name: Check that the REVISION_HEADS_MAP is up-to-date
+        language: python
+        entry: ../../scripts/ci/prek/check_revision_heads_map.py
+        pass_filenames: false
+        files: >
+          (?x)
+          ^src/airflow/providers/fab/migrations/versions/.*$|
+          ^src/airflow/providers/fab/migrations/versions|
+          ^src/airflow/providers/fab/auth_manager/models/db\.py$
+      - id: prevent-deprecated-sqlalchemy-usage-fab
+        name: Prevent deprecated sqlalchemy usage
+        entry: ../../scripts/ci/prek/prevent_deprecated_sqlalchemy_usage.py
+        language: python
+        files: ^.*\.py$
+        pass_filenames: true

{apache_airflow_providers_fab-3.0.1rc1 → apache_airflow_providers_fab-3.2.0}/3rd-party-licenses/LICENSES-ui.txt

@@ -1,5 +1,5 @@
 Apache Airflow
-Copyright 2016-2025 The Apache Software Foundation
+Copyright 2016-2026 The Apache Software Foundation
 
 This product includes software developed at The Apache Software
 Foundation (http://www.apache.org/).

{apache_airflow_providers_fab-3.0.1rc1 → apache_airflow_providers_fab-3.2.0}/NOTICE

@@ -1,5 +1,5 @@
 Apache Airflow
-Copyright 2016-2025 The Apache Software Foundation
+Copyright 2016-2026 The Apache Software Foundation
 
 This product includes software developed at The Apache Software
 Foundation (http://www.apache.org/).

{apache_airflow_providers_fab-3.0.1rc1 → apache_airflow_providers_fab-3.2.0}/PKG-INFO

@@ -1,12 +1,13 @@
 Metadata-Version: 2.4
 Name: apache-airflow-providers-fab
-Version: 3.0.1rc1
+Version: 3.2.0
 Summary: Provider package apache-airflow-providers-fab for Apache Airflow
 Keywords: airflow-provider,fab,airflow,integration
 Author-email: Apache Software Foundation <dev@airflow.apache.org>
 Maintainer-email: Apache Software Foundation <dev@airflow.apache.org>
 Requires-Python: >=3.10,!=3.13
 Description-Content-Type: text/x-rst
+License-Expression: Apache-2.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Environment :: Web Environment
@@ -14,33 +15,33 @@ Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: System Administrators
 Classifier: Framework :: Apache Airflow
 Classifier: Framework :: Apache Airflow :: Provider
-Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: System :: Monitoring
 License-File: 3rd-party-licenses/LICENSES-ui.txt
+License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: apache-airflow>=3.0.2rc1
-Requires-Dist: apache-airflow-providers-common-compat>=1.8.0rc1
+Requires-Dist: apache-airflow>=3.0.2
+Requires-Dist: apache-airflow-providers-common-compat>=1.12.0
 Requires-Dist: blinker>=1.6.2; python_version < '3.13'
 Requires-Dist: flask>=2.2.1,<2.3; python_version < '3.13'
-Requires-Dist: flask-appbuilder==5.0.0; python_version < '3.13'
+Requires-Dist: flask-appbuilder==5.0.1; python_version < '3.13'
 Requires-Dist: flask-login>=0.6.2; python_version < '3.13'
 Requires-Dist: flask-session>=0.8.0; python_version < '3.13'
 Requires-Dist: msgpack>=1.0.0; python_version < '3.13'
 Requires-Dist: flask-sqlalchemy>=3.0.5; python_version < '3.13'
-Requires-Dist: sqlalchemy<2; python_version < '3.13'
 Requires-Dist: flask-wtf>=1.1.0; python_version < '3.13'
 Requires-Dist: connexion[flask]>=2.14.2,<3.0; python_version < '3.13'
 Requires-Dist: jmespath>=0.7.0; python_version < '3.13'
 Requires-Dist: werkzeug>=2.2,<4; python_version < '3.13'
 Requires-Dist: wtforms>=3.0,<4; python_version < '3.13'
+Requires-Dist: cachetools>=6.0; python_version < '3.13'
 Requires-Dist: flask_limiter>3,<4,!=3.13
 Requires-Dist: kerberos>=1.3.0 ; extra == "kerberos" and ( python_version < '3.13')
 Project-URL: Bug Tracker, https://github.com/apache/airflow/issues
-Project-URL: Changelog, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/3.0.1/changelog.html
-Project-URL: Documentation, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/3.0.1
+Project-URL: Changelog, https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/changelog.html
+Project-URL: Documentation, https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0
 Project-URL: Mastodon, https://fosstodon.org/@airflow
 Project-URL: Slack Chat, https://s.apache.org/airflow-slack
 Project-URL: Source Code, https://github.com/apache/airflow
@@ -72,7 +73,7 @@ Provides-Extra: kerberos
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``3.0.1``
+Release: ``3.2.0``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -85,7 +86,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.0.1/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/>`_.
 
 Installation
 ------------
@@ -103,20 +104,20 @@ Requirements
 PIP package                                 Version required
 ==========================================  ==========================================
 ``apache-airflow``                          ``>=3.0.2``
-``apache-airflow-providers-common-compat``  ``>=1.8.0``
+``apache-airflow-providers-common-compat``  ``>=1.12.0``
 ``blinker``                                 ``>=1.6.2; python_version < "3.13"``
 ``flask``                                   ``>=2.2.1,<2.3; python_version < "3.13"``
-``flask-appbuilder``                        ``==5.0.0; python_version < "3.13"``
+``flask-appbuilder``                        ``==5.0.1; python_version < "3.13"``
 ``flask-login``                             ``>=0.6.2; python_version < "3.13"``
 ``flask-session``                           ``>=0.8.0; python_version < "3.13"``
 ``msgpack``                                 ``>=1.0.0; python_version < "3.13"``
 ``flask-sqlalchemy``                        ``>=3.0.5; python_version < "3.13"``
-``sqlalchemy``                              ``<2; python_version < "3.13"``
 ``flask-wtf``                               ``>=1.1.0; python_version < "3.13"``
 ``connexion[flask]``                        ``>=2.14.2,<3.0; python_version < "3.13"``
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
 ``werkzeug``                                ``>=2.2,<4; python_version < "3.13"``
 ``wtforms``                                 ``>=3.0,<4; python_version < "3.13"``
+``cachetools``                              ``>=6.0; python_version < "3.13"``
 ``flask_limiter``                           ``>3,!=3.13,<4``
 ==========================================  ==========================================
 
@@ -149,5 +150,5 @@ Extra         Dependencies
 ============  ============================================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.0.1/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/changelog.html>`_.
 

{apache_airflow_providers_fab-3.0.1rc1 → apache_airflow_providers_fab-3.2.0}/README.rst

@@ -23,7 +23,7 @@
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``3.0.1``
+Release: ``3.2.0``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -36,7 +36,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.0.1/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/>`_.
 
 Installation
 ------------
@@ -54,20 +54,20 @@ Requirements
 PIP package                                 Version required
 ==========================================  ==========================================
 ``apache-airflow``                          ``>=3.0.2``
-``apache-airflow-providers-common-compat``  ``>=1.8.0``
+``apache-airflow-providers-common-compat``  ``>=1.12.0``
 ``blinker``                                 ``>=1.6.2; python_version < "3.13"``
 ``flask``                                   ``>=2.2.1,<2.3; python_version < "3.13"``
-``flask-appbuilder``                        ``==5.0.0; python_version < "3.13"``
+``flask-appbuilder``                        ``==5.0.1; python_version < "3.13"``
 ``flask-login``                             ``>=0.6.2; python_version < "3.13"``
 ``flask-session``                           ``>=0.8.0; python_version < "3.13"``
 ``msgpack``                                 ``>=1.0.0; python_version < "3.13"``
 ``flask-sqlalchemy``                        ``>=3.0.5; python_version < "3.13"``
-``sqlalchemy``                              ``<2; python_version < "3.13"``
 ``flask-wtf``                               ``>=1.1.0; python_version < "3.13"``
 ``connexion[flask]``                        ``>=2.14.2,<3.0; python_version < "3.13"``
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
 ``werkzeug``                                ``>=2.2,<4; python_version < "3.13"``
 ``wtforms``                                 ``>=3.0,<4; python_version < "3.13"``
+``cachetools``                              ``>=6.0; python_version < "3.13"``
 ``flask_limiter``                           ``>3,!=3.13,<4``
 ==========================================  ==========================================
 
@@ -100,4 +100,4 @@ Extra         Dependencies
 ============  ============================================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.0.1/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/changelog.html>`_.

{apache_airflow_providers_fab-3.0.1rc1 → apache_airflow_providers_fab-3.2.0}/docs/auth-manager/access-control.rst

@@ -333,7 +333,7 @@ It's also possible to add Dag Runs resource permissions in a similar way, but ex
         dag_id="example_fine_grained_access",
         start_date=pendulum.datetime(2021, 1, 1, tz="UTC"),
         access_control={
-            "Viewer": {"Dags": {"can_edit", "can_read", "can_delete"}, "Dag Runs": {"can_create"}},
+            "Viewer": {"DAGs": {"can_edit", "can_read", "can_delete"}, "DAG Runs": {"can_create"}},
         },
     )
 

{apache_airflow_providers_fab-3.0.1rc1 → apache_airflow_providers_fab-3.2.0}/docs/auth-manager/api-authentication.rst

@@ -38,9 +38,9 @@ command as in the example below.
 
 .. versionchanged:: 3.0.0
 
-    In Airflow, the default setting is using token based authentication.
-    This approach is independent from which ``auth_backend`` is used.
-    The default setting is using Airflow public API to create a token (JWT) first and use this token in the requests to access the API.
+    Airflow now uses token-based authentication for the public API.
+    This mechanism is independent of the configured ``auth_backend``.
+    Clients must first obtain a JWT token using :doc:`token`, then include that token in subsequent API requests.
 
 Kerberos authentication
 '''''''''''''''''''''''

{apache_airflow_providers_fab-3.0.1rc1 → apache_airflow_providers_fab-3.2.0}/docs/auth-manager/configuring-flask-app.rst

@@ -33,6 +33,6 @@ as the `app context <https://flask.palletsprojects.com/en/2.3.x/appcontext/>`_ i
     from flask import current_app as app
 
 
-    @app.before_requestq
+    @app.before_request
     def print_custom_message() -> None:
         print("Executing before every request")

{apache_airflow_providers_fab-3.0.1rc1 → apache_airflow_providers_fab-3.2.0}/docs/auth-manager/sso.rst

@@ -59,7 +59,33 @@ Configuration Steps
 
    This replaces the default ``SimpleAuthManager``.
 
-2. **Install Required Packages**
+2. **Enable OAuth Authentication Type**
+
+   Set ``AUTH_TYPE`` to ``AUTH_OAUTH`` in your ``webserver_config.py`` file
+   (located at ``$AIRFLOW_HOME/webserver_config.py`` by default, configurable via
+   ``[fab] config_file`` in ``airflow.cfg``):
+
+   .. code-block:: python
+
+      from flask_appbuilder.const import AUTH_OAUTH
+
+      AUTH_TYPE = AUTH_OAUTH
+
+   .. important::
+      This step is required. Without setting ``AUTH_TYPE = AUTH_OAUTH``,
+      the OAuth providers will not be activated even if ``OAUTH_PROVIDERS``
+      is configured. The default ``AUTH_TYPE = AUTH_DB`` uses database
+      authentication only.
+
+   .. note::
+      If the ``webserver_config.py`` file does not exist in your environment,
+      you need to create it manually. A template with default values and examples
+      can be found in the Airflow source at
+      ``airflow-core/src/airflow/config_templates/default_webserver_config.py``.
+      You can copy this file to ``$AIRFLOW_HOME/webserver_config.py`` and modify
+      it for your needs.
+
+3. **Install Required Packages**
 
    If not already installed, ensure the FAB provider is available:
 
@@ -71,7 +97,7 @@ Configuration Steps
       The FAB Auth Manager provider is not installed by default in Airflow 3.
       You must install it explicitly to use OAuth2-based SSO.
 
-3. **Configure OAuth2 Provider**
+4. **Configure OAuth2 Provider**
 
    FAB Auth Manager reads provider configuration from the ``[fab]`` section
    of ``airflow.cfg`` or from environment variables.
@@ -119,13 +145,13 @@ Configuration Steps
 
    Adjust these values according to your provider's documentation.
 
-4. **Restart Airflow Webserver**
+5. **Restart Airflow Webserver**
 
    .. code-block:: bash
 
       airflow webserver --reload
 
-5. **Test SSO Login**
+6. **Test SSO Login**
 
    Open the Airflow UI. You should see a login option for your SSO provider.
 

apache_airflow_providers_fab-3.2.0/docs/auth-manager/token.rst

@@ -0,0 +1,155 @@
+ .. Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+ ..   http://www.apache.org/licenses/LICENSE-2.0
+
+ .. Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+Generate JWT token with FAB auth manager
+========================================
+
+.. note::
+    This guide only applies if your environment is configured with FAB auth manager.
+
+To use the :doc:`Airflow public API <apache-airflow:stable-rest-api-ref>`, you first need to obtain a JWT Token for
+authentication.
+Once you have the token, include it in the ``Authorization`` header when making requests to the public API.
+
+You can generate a JWT token using the ``Create Token`` API endpoint,
+documented in :doc:`/api-ref/fab-token-api-ref`.
+
+Example
+'''''''
+
+Use the following example to generate a token via username and password.
+
+.. code-block:: bash
+
+    ENDPOINT_URL="http://localhost:8080"
+    curl -X 'POST' \
+        "${ENDPOINT_URL}/auth/token" \
+        -H 'Content-Type: application/json' \
+        -d '{
+        "username": "<username>",
+        "password": "<password>"
+        }'
+
+If successful, this request returns a JWT token that you can use for subsequent Airflow public API calls.
+
+Only users authenticated via the database (``AUTH_TYPE = AUTH_DB``) or LDAP
+(``AUTH_TYPE = AUTH_LDAP``) can generate tokens using this method.
+For more details, see :doc:`webserver-authentication`.
+
+If you need to generate a token using a different authentication mechanism, see the next section.
+
+Custom authentication implementation
+------------------------------------
+
+By default, JWT tokens for the Airflow public API can only be generated using
+basic authentication (username and password) for database or LDAP users.
+
+If you want to support another authentication mechanism, such as oauth, you can do so by overriding the
+``create_token`` method in the FAB auth manager.
+
+Example
+'''''''
+
+.. code-block:: python
+
+    class MyAuthManager(FabAuthManager):
+
+        def create_token(self, headers: dict[str, str], body: dict[str, Any]) -> User:
+            """
+            Return the authenticated user for a given payload.
+
+            Implement your own custom token creation logic here.
+            """
+            ...
+
+Oauth example
+'''''''''''''
+
+Below is an example implementation that uses OAuth to allow users to obtain a JWT token.
+This custom logic overrides the default ``create_token`` method from the FAB authentication manager.
+
+.. warning::
+    The example shown below disables signature verification (``verify_signature=False``).
+    This is **insecure** and should only be used for testing. Always validate tokens properly in production.
+    Furthermore you need to make sure that the claims of the JWT are valid.
+    Critical claims that you must verify are for example (but not limited to):
+    - ``iss`` (issuer)
+    - ``aud`` (audience)
+    - ``nbf`` (not before time)
+    - ``exp`` (expiration time)
+    Refer to the documentation of your identity provider for more information.
+
+.. code-block:: python
+
+    class MyAuthManager(FabAuthManager):
+
+        def create_token(self, headers: dict[str, str], body: dict[str, Any]) -> User:
+            """
+            Return the authenticated user derived from an OAuth access token.
+
+            Implement your own custom token validation and user mapping logic here.
+            """
+            user = None
+
+            # Handle OAuth-based authentication
+            if self.security_manager.auth_type == AUTH_OAUTH:
+                # Require a Bearer token
+                auth_header = headers.get("Authorization")
+                if not auth_header:
+                    return None
+
+                token = auth_header.replace("Bearer ", "")
+
+                # Example token decoding
+                #
+                # With signature validation (recommended):
+                # me = jwt.decode(
+                #     token,
+                #     public_key,
+                #     algorithms=['HS256', 'RS256'],
+                #     audience=CLIENT_ID,
+                #     issuer=ISSUER_URL,
+                # )
+                #
+                # Without signature validation (not recommended):
+                me = jwt.decode(token, options={"verify_signature": False})
+
+                # Extract groups/roles (example schema — adjust to your provider)
+                groups = me["resource_access"]["airflow"]["roles"]  # requires validation
+                if not groups:
+                    groups = ["airflow_public"]
+                else:
+                    groups = [g for g in groups if "airflow" in g]
+
+                # Build user info payload for FAB
+                userinfo = {
+                    "username": me.get("preferred_username"),
+                    "email": me.get("email"),
+                    "first_name": me.get("given_name"),
+                    "last_name": me.get("family_name"),
+                    "role_keys": groups,
+                }
+
+                user = self.security_manager.auth_user_oauth(userinfo, rotate_session_id=False)
+
+            # Fall back to the default implementation
+            else:
+                user = super().create_token(headers=headers, body=body)
+
+            log.info("User: %s", user)
+
+            return user

{apache_airflow_providers_fab-3.0.1rc1 → apache_airflow_providers_fab-3.2.0}/docs/auth-manager/webserver-authentication.rst

@@ -23,7 +23,9 @@ FAB auth manager authentication
    While this documentation refers to authentication using the ``apache-airflow-providers-fab`` package, please note:
 
    - The **FAB auth provider** is actively maintained and compatible with the latest versions of Airflow.
-   - The legacy ``webserver_config.py`` file referenced in older docs is **no longer used** in recent versions of Airflow. Instead, authentication is handled via the new ``auth_manager`` framework configured in ``airflow.cfg``.
+   - It is preferred to configure supported authentication options using the new ``auth_manager`` framework configured in ``airflow.cfg``.
+   - The ``webserver_config.py`` file is still used for more advanced options,
+     such as Single Sign-On with OAuth.
 
    For more, see the :doc:`token`.
 
@@ -236,6 +238,86 @@ webserver_config.py itself if you wish.
             log.debug(f"User info from GitHub: {user_data}\nTeam info from GitHub: {teams}")
             return {"username": "github_" + user_data.get("login"), "role_keys": roles}
 
+Example using role / group based Authorization with Azure Active Directory
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+Here is an example of what you might have in your ``webserver_config.py``:
+
+.. code-block:: python
+
+    from airflow.providers.fab.auth_manager.security_manager.override import FabAirflowSecurityManagerOverride
+    from flask_appbuilder.security.manager import AUTH_OAUTH
+
+    AUTH_TYPE = AUTH_OAUTH
+    AUTH_USER_REGISTRATION = True
+    AUTH_ROLES_SYNC_AT_LOGIN = True
+
+    AUTH_ROLES_MAPPING = {
+        "Azure-Admins": ["Admin"],
+        "Azure-Users": ["User"],
+        "Azure-Viewers": ["Viewer"],
+    }
+
+    OAUTH_PROVIDERS = [
+        {
+            "name": "azure",
+            "icon": "fa-windows",
+            "token_key": "access_token",
+            "remote_app": {
+                "client_id": "<your-client-id>",
+                "client_secret": "<your-client-secret>",
+                "api_base_url": "https://graph.microsoft.com/v1.0/",
+                "client_kwargs": {"scope": "openid email profile"},
+                "access_token_url": "https://login.microsoftonline.com/<your-tenant-id>/oauth2/v2.0/token",
+                "authorize_url": "https://login.microsoftonline.com/<your-tenant-id>/oauth2/v2.0/authorize",
+                "request_token_url": None,
+            },
+        }
+    ]
+
+
+    class AzureAdSecurityManager(FabAirflowSecurityManagerOverride):
+        def get_oauth_user_info(self, provider, response):
+            if provider != "azure":
+                return {}
+
+            groups = response.get("groups", [])
+            roles = response.get("roles", [])
+
+            return {
+                "username": response.get("preferred_username"),
+                "email": response.get("email"),
+                "first_name": response.get("given_name"),
+                "last_name": response.get("family_name"),
+                "role_keys": groups or roles,
+            }
+
+
+    SECURITY_MANAGER_CLASS = AzureAdSecurityManager
+
+.. note::
+
+   * Azure AD group or role claims must be explicitly enabled in the application
+     registration (for example via ``groupMembershipClaims``).
+   * Depending on tenant configuration, group claims may be returned as IDs
+     rather than display names.
+   * For large group memberships, querying Microsoft Graph may be required
+     instead of relying solely on token claims.
+
+.. figure:: /img/azure-ad-authentication.jpeg
+   :alt: Azure AD app registration authentication settings
+
+   Azure AD app registration authentication configuration showing the redirect URI
+   (``http://localhost:8080/auth/oauth-authorized/azure``) required for Airflow OAuth
+   integration.
+
+.. figure:: /img/azure-ad-token-claims.jpeg
+   :alt: Azure AD token configuration with group or role claims enabled
+
+   Azure AD app registration token configuration showing the ``groups`` optional claim
+   enabled, which allows Azure AD group or role information to be included in the token
+   and mapped to Airflow RBAC roles.
+
 Example using team based Authorization with KeyCloak
 ''''''''''''''''''''''''''''''''''''''''''''''''''''''''
 Here is an example of what you might have in your webserver_config.py: