AUTH_ROLES_MAPPING not working #1641
Comments
|
Well this is mildly humorous. The AUTH_ROLES_MAPPING seems to be case sensitive. I Changed the cn to match what is in AD and it worked. AUTH_ROLES_MAPPING = {
"CN=Airflow-admins,ou=Groups,DC=example,DC=com": ["Admin"],
}I wonder if it would make sense to convert the groups to all lowercase and compare. I haven't checked the code. |
|
@cocampbe the lines which are causing this to be case sensitive are here in _ldap_calculate_user_roles() The issue is we are directly comparing the string provided as the key of the It seems like most of the time, attributes in AD are case-insenstive, but there are probably cases were assuming case-insensitivity might lead to a security issue. We could possibly make the default behaviour to assume case-insentivity, and have a flag to reenable case-sensitivity in role mapping if the user wants. @dpgaspar what are your thoughts? |
|
@thesuperzapper a flag sounds good, but would prefer to just improve documentation |
|
@dpgaspar I agree that the docs are a good way to go. If it had been documented, I would have likely picked up on my issue earlier. |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Feel free to reopen it if it's still relevant to you. Thank you |
|
Bumping for bot. |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Feel free to reopen it if it's still relevant to you. Thank you |
|
I have the exact same issue and so far couldn't resolve it. My setting is: Logs show: I don't understand why it choose the role of Public if the map says Admin. |
|
Hi @eladkal, Take a look at #2149 Do note that {
'sn': [b'Doe'],
'givenName': [b'Alice'],
'mail': [b'alice@example.org'],
'memberOf': [b'cn=readers,ou=groups,dc=example,dc=org', b'cn=staff,ou=groups,dc=example,dc=org']
}So a valid mapping could be: |
|
Thank you @dpgaspar I was able eventually to trace the issue. Another issue we faced is that the current code is expected exact match of all OU. Flask-AppBuilder/flask_appbuilder/security/manager.py Lines 341 to 352 in f591ee5 while in my case we expected for a partial match. Thus setting: would work for user that has record of: |
|
@dpgaspar @thesuperzapper @eladkal @cocampbe """Default configuration for the Airflow webserver""" from airflow.www.fab_security.manager import AUTH_LDAP basedir = os.path.abspath(os.path.dirname(file)) WTF_CSRF_ENABLED = True AUTH_TYPE = AUTH_LDAP AUTH_USER_REGISTRATION = True AUTH_LDAP_SERVER = 'ldaps://ldap.example.com:636' AUTH_LDAP_BIND_USER = 'cn=Yaswanth Amasa,ou=users,dc=example,dc=com' AUTH_ROLES_MAPPING = { AUTH_LDAP_GROUP_FIELD = "memberUid" AUTH_LDAP_USE_TLS = False '''When Configuring this in webserver_config.py in airflow All the members including devops group have Viewer access, But I want Admin access to devops group and rest public access or else I dont want to allow then to view also. Kindly Please Help me I dont have memberOf attribute only memberUid |
|
|
Where to see logs |
|
Try to open the log in the webserver and look how the user(from devops group) look like when it authenticate via LDAP. |
|
|
Yeah Thank you, I think the problem is memberOf attribute Shall you help me in this case I dont have memberOf attribute, I have memberUid attribute |
Environment
Flask-Appbuilder version: 3.3.0
pip freeze output:
Describe the expected results
User logs in and gets role based on group membership.
Describe the actual results
I have airflow deployed in k8s using the airflow helm chart. Airflow version is 2.0.1. User logs in and only has the "User" role. The user is in the airflow-admins group but the role is not mapping. I only get the role defined in AUTH_USER_REGISTRATION_ROLE. If it matters, the ldap provider is AD. The config is pretty much a copy/paste from the FAQ section of the helm chart page.
https://github.com/airflow-helm/charts/tree/main/charts/airflow#how-to-authenticate-airflow-users-with-ldapoauth
The text was updated successfully, but these errors were encountered: