Airflow: Attach roles to AD groups - Azure OAuth

[sk2991]

We have implemented RBAC using Azure OAuth, Is there any way to attach a role to AD group - so that users part of that AD groups/Tenant can get default access to the attached role

Apache Airflow version: 1.10.10

Kubernetes version (if you are using kubernetes) (use kubectl version): 1.15.10

Environment:

• Cloud provider or hardware configuration: Azure (AKS)
• OS (e.g. from /etc/os-release): Debian GNU/Linux
• Kernel (e.g. uname -a): 4.15.0-1089-azure
• Install tools:
• Others:

What happened:

What you expected to happen:

attach a role to AD group (or) Azure tenant

How to reproduce it:

Helm install stable/airflow
Implement RBAC using Azure OAuth

[boring-cyborg[bot]]

Thanks for opening your first issue here! Be sure to follow the issue template!

[elwinarens]

@sk2991 Would you mind sharing your Azure OAuth implementation?

[rafaelpierre]

@sk2991 +1

@sk2991 Would you mind sharing your Azure OAuth implementation?

[mik-laj]

Is this helpful for you? I don't use Azure OAuth, so I'm not sure this change applies here.
https://github.com/dpgaspar/Flask-AppBuilder/pull/1410

[sk2991]

@elwinarens @rafaelpierre - I have used this link to configure Azure OAuth.
Other useful links:
https://github.com/apache/airflow/pull/3015
https://flask-appbuilder.readthedocs.io/en/latest/security.html#authentication-oauth

[sk2991]

@mik-laj It does help to some extent. Is there anyway to extend this? Instead of declaring "AUTH_USER_REGISTRATION_ROLE_JMESPATH = "contains(['[email protected]', '[email protected]'], email) && 'Admin' || 'Public'"" this manually in config file - can we assign it dynamically?