Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix kerberos authentication for the REST API. #29054

Merged
merged 1 commit into from Jan 20, 2023
Merged

Fix kerberos authentication for the REST API. #29054

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 3 additions & 1 deletion airflow/api/auth/backend/kerberos_auth.py
View file
Open in desktop
Expand Up @@ -16,6 +16,8 @@
# under the License.
from __future__ import annotations

from airflow.utils.airflow_flask_app import get_airflow_app

#
# Copyright (c) 2013, Michael Komitee
# All rights reserved.
Expand Down Expand Up @@ -141,7 +143,7 @@ def decorated(*args, **kwargs):
token = "".join(header.split()[1:])
return_code = _gssapi_authenticate(token)
if return_code == kerberos.AUTH_GSS_COMPLETE:
g.user = ctx.kerberos_user
g.user = get_airflow_app().appbuilder.sm.find_user(username=ctx.kerberos_user)
response = function(*args, **kwargs)
response = make_response(response)
if ctx.kerberos_token is not None:
Expand Down
3 changes: 3 additions & 0 deletions docs/apache-airflow/administration-and-deployment/security/api.rst
View file
Open in desktop
Expand Up @@ -83,6 +83,9 @@ To enable Kerberos authentication, set the following in the configuration:
The Kerberos service is configured as ``airflow/fully.qualified.domainname@REALM``. Make sure this
principal exists in the keytab file.

You have to make sure to name your users with the kerberos full username/realm in order to make it
works. This means that your user name should be ``user_name@KERBEROS-REALM``.

Basic authentication
''''''''''''''''''''

Expand Down