apache-airflow-providers-fab 3.1.2__tar.gz → 3.2.0__tar.gz

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apache-airflow-providers-fab
-Version: 3.1.2
+Version: 3.2.0
 Summary: Provider package apache-airflow-providers-fab for Apache Airflow
 Keywords: airflow-provider,fab,airflow,integration
 Author-email: Apache Software Foundation <dev@airflow.apache.org>
@@ -36,11 +36,12 @@ Requires-Dist: connexion[flask]>=2.14.2,<3.0; python_version < '3.13'
 Requires-Dist: jmespath>=0.7.0; python_version < '3.13'
 Requires-Dist: werkzeug>=2.2,<4; python_version < '3.13'
 Requires-Dist: wtforms>=3.0,<4; python_version < '3.13'
+Requires-Dist: cachetools>=6.0; python_version < '3.13'
 Requires-Dist: flask_limiter>3,<4,!=3.13
 Requires-Dist: kerberos>=1.3.0 ; extra == "kerberos" and ( python_version < '3.13')
 Project-URL: Bug Tracker, https://github.com/apache/airflow/issues
-Project-URL: Changelog, https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/changelog.html
-Project-URL: Documentation, https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2
+Project-URL: Changelog, https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/changelog.html
+Project-URL: Documentation, https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0
 Project-URL: Mastodon, https://fosstodon.org/@airflow
 Project-URL: Slack Chat, https://s.apache.org/airflow-slack
 Project-URL: Source Code, https://github.com/apache/airflow
@@ -72,7 +73,7 @@ Provides-Extra: kerberos
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``3.1.2``
+Release: ``3.2.0``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -85,7 +86,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/>`_.
 
 Installation
 ------------
@@ -103,7 +104,7 @@ Requirements
 PIP package                                 Version required
 ==========================================  ==========================================
 ``apache-airflow``                          ``>=3.0.2``
-``apache-airflow-providers-common-compat``  ``>=1.10.1``
+``apache-airflow-providers-common-compat``  ``>=1.12.0``
 ``blinker``                                 ``>=1.6.2; python_version < "3.13"``
 ``flask``                                   ``>=2.2.1,<2.3; python_version < "3.13"``
 ``flask-appbuilder``                        ``==5.0.1; python_version < "3.13"``
@@ -116,6 +117,7 @@ PIP package                                 Version required
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
 ``werkzeug``                                ``>=2.2,<4; python_version < "3.13"``
 ``wtforms``                                 ``>=3.0,<4; python_version < "3.13"``
+``cachetools``                              ``>=6.0; python_version < "3.13"``
 ``flask_limiter``                           ``>3,!=3.13,<4``
 ==========================================  ==========================================
 
@@ -148,5 +150,5 @@ Extra         Dependencies
 ============  ============================================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/changelog.html>`_.
 

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/README.rst

@@ -23,7 +23,7 @@
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``3.1.2``
+Release: ``3.2.0``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -36,7 +36,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/>`_.
 
 Installation
 ------------
@@ -54,7 +54,7 @@ Requirements
 PIP package                                 Version required
 ==========================================  ==========================================
 ``apache-airflow``                          ``>=3.0.2``
-``apache-airflow-providers-common-compat``  ``>=1.10.1``
+``apache-airflow-providers-common-compat``  ``>=1.12.0``
 ``blinker``                                 ``>=1.6.2; python_version < "3.13"``
 ``flask``                                   ``>=2.2.1,<2.3; python_version < "3.13"``
 ``flask-appbuilder``                        ``==5.0.1; python_version < "3.13"``
@@ -67,6 +67,7 @@ PIP package                                 Version required
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
 ``werkzeug``                                ``>=2.2,<4; python_version < "3.13"``
 ``wtforms``                                 ``>=3.0,<4; python_version < "3.13"``
+``cachetools``                              ``>=6.0; python_version < "3.13"``
 ``flask_limiter``                           ``>3,!=3.13,<4``
 ==========================================  ==========================================
 
@@ -99,4 +100,4 @@ Extra         Dependencies
 ============  ============================================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/changelog.html>`_.

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/docs/auth-manager/webserver-authentication.rst

@@ -238,6 +238,86 @@ webserver_config.py itself if you wish.
             log.debug(f"User info from GitHub: {user_data}\nTeam info from GitHub: {teams}")
             return {"username": "github_" + user_data.get("login"), "role_keys": roles}
 
+Example using role / group based Authorization with Azure Active Directory
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+Here is an example of what you might have in your ``webserver_config.py``:
+
+.. code-block:: python
+
+    from airflow.providers.fab.auth_manager.security_manager.override import FabAirflowSecurityManagerOverride
+    from flask_appbuilder.security.manager import AUTH_OAUTH
+
+    AUTH_TYPE = AUTH_OAUTH
+    AUTH_USER_REGISTRATION = True
+    AUTH_ROLES_SYNC_AT_LOGIN = True
+
+    AUTH_ROLES_MAPPING = {
+        "Azure-Admins": ["Admin"],
+        "Azure-Users": ["User"],
+        "Azure-Viewers": ["Viewer"],
+    }
+
+    OAUTH_PROVIDERS = [
+        {
+            "name": "azure",
+            "icon": "fa-windows",
+            "token_key": "access_token",
+            "remote_app": {
+                "client_id": "<your-client-id>",
+                "client_secret": "<your-client-secret>",
+                "api_base_url": "https://graph.microsoft.com/v1.0/",
+                "client_kwargs": {"scope": "openid email profile"},
+                "access_token_url": "https://login.microsoftonline.com/<your-tenant-id>/oauth2/v2.0/token",
+                "authorize_url": "https://login.microsoftonline.com/<your-tenant-id>/oauth2/v2.0/authorize",
+                "request_token_url": None,
+            },
+        }
+    ]
+
+
+    class AzureAdSecurityManager(FabAirflowSecurityManagerOverride):
+        def get_oauth_user_info(self, provider, response):
+            if provider != "azure":
+                return {}
+
+            groups = response.get("groups", [])
+            roles = response.get("roles", [])
+
+            return {
+                "username": response.get("preferred_username"),
+                "email": response.get("email"),
+                "first_name": response.get("given_name"),
+                "last_name": response.get("family_name"),
+                "role_keys": groups or roles,
+            }
+
+
+    SECURITY_MANAGER_CLASS = AzureAdSecurityManager
+
+.. note::
+
+   * Azure AD group or role claims must be explicitly enabled in the application
+     registration (for example via ``groupMembershipClaims``).
+   * Depending on tenant configuration, group claims may be returned as IDs
+     rather than display names.
+   * For large group memberships, querying Microsoft Graph may be required
+     instead of relying solely on token claims.
+
+.. figure:: /img/azure-ad-authentication.jpeg
+   :alt: Azure AD app registration authentication settings
+
+   Azure AD app registration authentication configuration showing the redirect URI
+   (``http://localhost:8080/auth/oauth-authorized/azure``) required for Airflow OAuth
+   integration.
+
+.. figure:: /img/azure-ad-token-claims.jpeg
+   :alt: Azure AD token configuration with group or role claims enabled
+
+   Azure AD app registration token configuration showing the ``groups`` optional claim
+   enabled, which allows Azure AD group or role information to be included in the token
+   and mapped to Airflow RBAC roles.
+
 Example using team based Authorization with KeyCloak
 ''''''''''''''''''''''''''''''''''''''''''''''''''''''''
 Here is an example of what you might have in your webserver_config.py:

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/docs/changelog.rst

@@ -20,6 +20,39 @@
 Changelog
 ---------
 
+3.2.0
+.....
+
+Features
+~~~~~~~~
+
+* ``Cache user object fetched per request in FAB auth manager for improved performance. (#60274)``
+
+Bug Fixes
+~~~~~~~~~
+
+* ``(bugfix): Add dark theme support for FAB Security pages (#60908)``
+* ``fix(fab): Align ORM column sizes with migration definitions (#60869)``
+
+Misc
+~~~~
+
+* ``Migrate Flask based user APIs to Fastapi (#60973)``
+* ``Improve typing in Fab (#61001)``
+* ``Bump lodash from 4.17.21 to 4.17.23 in /providers/fab/src/airflow/providers/fab/www (#60911)``
+* ``Bump mini-css-extract-plugin from 2.9.4 to 2.10.0 in /providers/fab/src/airflow/providers/fab/www in the fab-ui-package-updates group across 1 directory (#60831)``
+* ``Remove non-logic redundant selection and query in FAB (#60807)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 5 updates (#60791)``
+* ``Migrate FAB POST /users to FastAPI (#60523)``
+
+Doc-only
+~~~~~~~~
+
+* ``Add Azure AD OAuth webserver authentication example with role mapping (#60756)``
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+
 3.1.2
 .....
 

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/docs/index.rst

@@ -84,7 +84,7 @@ apache-airflow-providers-fab package
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
 
 
-Release: 3.1.2
+Release: 3.2.0
 
 Provider package
 ----------------
@@ -121,6 +121,7 @@ PIP package                                 Version required
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
 ``werkzeug``                                ``>=2.2,<4; python_version < "3.13"``
 ``wtforms``                                 ``>=3.0,<4; python_version < "3.13"``
+``cachetools``                              ``>=6.0; python_version < "3.13"``
 ``flask_limiter``                           ``>3,!=3.13,<4``
 ==========================================  ==========================================
 
@@ -149,5 +150,5 @@ Downloading official packages
 You can download officially released packages and verify their checksums and signatures from the
 `Official Apache Download site <https://downloads.apache.org/airflow/providers/>`_
 
-* `The apache-airflow-providers-fab 3.1.2 sdist package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.1.2.tar.gz>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.1.2.tar.gz.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.1.2.tar.gz.sha512>`__)
-* `The apache-airflow-providers-fab 3.1.2 wheel package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.1.2-py3-none-any.whl>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.1.2-py3-none-any.whl.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.1.2-py3-none-any.whl.sha512>`__)
+* `The apache-airflow-providers-fab 3.2.0 sdist package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.2.0.tar.gz>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.2.0.tar.gz.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.2.0.tar.gz.sha512>`__)
+* `The apache-airflow-providers-fab 3.2.0 wheel package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.2.0-py3-none-any.whl>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.2.0-py3-none-any.whl.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-3.2.0-py3-none-any.whl.sha512>`__)

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/provider.yaml

@@ -28,13 +28,14 @@ description: |
 # For providers until we think it should be released.
 state: ready
 
-source-date-epoch: 1768334947
+source-date-epoch: 1769461317
 
 # Note that those versions are maintained by release manager - do not update them manually
 # with the exception of case where other provider in sources has >= new provider version.
 # In such case adding >= NEW_VERSION and bumping to NEW_VERSION in a provider have
 # to be done in the same PR
 versions:
+  - 3.2.0
   - 3.1.2
   - 3.1.1
   - 3.1.0
@@ -250,6 +251,14 @@ config:
         type: integer
         example: ~
         default: "1"
+      cache_ttl:
+        description: |
+          Number of seconds after which the user cache will expire to refetch updated user and
+          permissions.
+        version_added: 3.2.0
+        type: integer
+        example: ~
+        default: "30"
 
 auth-managers:
   - airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/pyproject.toml

@@ -25,7 +25,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "apache-airflow-providers-fab"
-version = "3.1.2"
+version = "3.2.0"
 description = "Provider package apache-airflow-providers-fab for Apache Airflow"
 readme = "README.rst"
 license = "Apache-2.0"
@@ -81,6 +81,7 @@ dependencies = [
     "jmespath>=0.7.0; python_version < '3.13'",
     "werkzeug>=2.2,<4; python_version < '3.13'",
     "wtforms>=3.0,<4; python_version < '3.13'",
+    "cachetools>=6.0; python_version < '3.13'",
 
     # https://github.com/dpgaspar/Flask-AppBuilder/blob/release/4.6.3/setup.py#L54C8-L54C26
     # with an exclusion to account for https://github.com/alisaifee/flask-limiter/issues/479
@@ -131,8 +132,8 @@ apache-airflow-providers-common-sql = {workspace = true}
 apache-airflow-providers-standard = {workspace = true}
 
 [project.urls]
-"Documentation" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2"
-"Changelog" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/changelog.html"
+"Documentation" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0"
+"Changelog" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/3.2.0/changelog.html"
 "Bug Tracker" = "https://github.com/apache/airflow/issues"
 "Source Code" = "https://github.com/apache/airflow"
 "Slack Chat" = "https://s.apache.org/airflow-slack"

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/src/airflow/providers/fab/__init__.py

@@ -29,7 +29,7 @@ from airflow import __version__ as airflow_version
 
 __all__ = ["__version__"]
 
-__version__ = "3.1.2"
+__version__ = "3.2.0"
 
 if packaging.version.parse(packaging.version.parse(airflow_version).base_version) < packaging.version.parse(
     "3.0.2"

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/src/airflow/providers/fab/auth_manager/api_endpoints/user_endpoint.py

@@ -120,7 +120,9 @@ def post_user() -> APIResponse:
         raise BadRequest(detail=detail)
 
     if not roles_to_add:  # No roles provided, use the F.A.B's default registered user role.
-        roles_to_add.append(security_manager.find_role(security_manager.auth_user_registration_role))
+        r = security_manager.find_role(security_manager.auth_user_registration_role)
+        if r:
+            roles_to_add.append(r)
 
     user = security_manager.add_user(role=roles_to_add, **data)
     if not user:

{apache_airflow_providers_fab-3.1.2 → apache_airflow_providers_fab-3.2.0}/src/airflow/providers/fab/auth_manager/api_fastapi/datamodels/roles.py

@@ -40,6 +40,12 @@ class ActionResource(BaseModel):
     resource: Resource
 
 
+class Role(BaseModel):
+    """Lightweight role reference used by /users schemas."""
+
+    name: str
+
+
 class RoleBody(StrictBaseModel):
     """Incoming payload for creating/updating a role."""
 

apache_airflow_providers_fab-3.2.0/src/airflow/providers/fab/auth_manager/api_fastapi/datamodels/users.py

@@ -0,0 +1,68 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from __future__ import annotations
+
+from pydantic import Field, SecretStr
+
+from airflow.api_fastapi.common.types import UtcDateTime
+from airflow.api_fastapi.core_api.base import BaseModel, StrictBaseModel
+from airflow.providers.fab.auth_manager.api_fastapi.datamodels.roles import Role
+
+
+class UserBody(StrictBaseModel):
+    """Incoming payload for creating a user."""
+
+    username: str = Field(min_length=1)
+    email: str = Field(min_length=1)
+    first_name: str = Field(min_length=1)
+    last_name: str = Field(min_length=1)
+    roles: list[Role] | None = None
+    password: SecretStr
+
+
+class UserPatchBody(StrictBaseModel):
+    """Incoming payload for updating a user (all fields optional)."""
+
+    username: str | None = Field(default=None, min_length=1)
+    email: str | None = Field(default=None, min_length=1)
+    first_name: str | None = Field(default=None, min_length=1)
+    last_name: str | None = Field(default=None, min_length=1)
+    roles: list[Role] | None = None
+    password: SecretStr | None = None
+
+
+class UserResponse(BaseModel):
+    """Outgoing representation of a user (no password)."""
+
+    username: str
+    email: str
+    first_name: str
+    last_name: str
+    roles: list[Role] | None = None
+    active: bool | None = None
+    last_login: UtcDateTime | None = None
+    login_count: int | None = None
+    fail_login_count: int | None = None
+    created_on: UtcDateTime | None = None
+    changed_on: UtcDateTime | None = None
+
+
+class UserCollectionResponse(BaseModel):
+    """Response model for a collection of users."""
+
+    users: list[UserResponse]
+    total_entries: int