Mailing-List: contact dev-help@airflow.incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@airflow.incubator.apache.org
MIME-Version: 1.0
In-Reply-To: <CA+5xAo17__AK9K9_hwVrOqtNhUH_A+Gr26P+ABQovnMkKhv40A@mail.gmail.com>
References: <CA+5xAo3T951aJnCXVMbt5DnjjqczWrNK4UfGOObLTSebF0PA3A@mail.gmail.com>
 <CA+5xAo17__AK9K9_hwVrOqtNhUH_A+Gr26P+ABQovnMkKhv40A@mail.gmail.com>
From: Thomas Weise <thw@apache.org>
Date: Thu, 6 Apr 2017 12:04:54 -0700
Message-ID: <CA+5xAo2a+cSqXP84mqihux=ia-1cUbMb5XookFvQ9EjrTzi6Pg@mail.gmail.com>
Subject: Re: Airflow user management
To: dev@airflow.incubator.apache.org
Content-Type: multipart/alternative; boundary=001a11352de63a7761054c842f36
archived-at: Thu, 06 Apr 2017 19:05:03 -0000

--001a11352de63a7761054c842f36
Content-Type: text/plain; charset=UTF-8

Hi,

I finally found that with username/password authentication, the superuser
setting in the database is ignored and everyone is a superuser...  See diff
below after which the filtering behaves as expected.

Thanks


*diff --git a/airflow/contrib/auth/backends/password_auth.py
b/airflow/contrib/auth/backends/password_auth.py*

*index 000b9861..7fe00197 100644*

*--- a/airflow/contrib/auth/backends/password_auth.py*

*+++ b/airflow/contrib/auth/backends/password_auth.py*

@@ -89,7 +89,7 @@ class PasswordUser(models.User):


     def is_superuser(self):

         '''Access all the things'''

-        return True

+        return False


On Mon, Apr 3, 2017 at 5:42 PM, Thomas Weise <thw@apache.org> wrote:

> I was able to set a password from the command line, now I can login with
> the user that was created through the UI.
>
> Filtering by owner doesn't work though. I confirmed that the user also has
> superuser = False, but still it can see DAGs of other users.
>
> Any suggestions what to look for?
>
> I tried to put some debug statements into www/views.py but they don't see
> to take effect. How do I rebuild the installation (under
> /usr/local/lib/python2.7/dist-packages/airflow) after making changes?
>
> Thanks
>
>
> On Fri, Mar 31, 2017 at 3:10 PM, Thomas Weise <thw@apache.org> wrote:
>
>> Hi,
>>
>> I would like to create a few users that only can see their respective
>> DAGs and have no global access like user administration.
>> I have enabled password authentication and created the initial user as
>> instructed here:
>>
>> https://airflow.incubator.apache.org/security.html?highlight
>> =multi%20tenancy#web-authentication
>>
>> My airflow.cfg has the following settings:
>>
>> # Set to true to turn on authentication:
>>
>> # http://pythonhosted.org/airflow/security.html#web-authentication
>>
>> authenticate = True
>>
>> auth_backend = airflow.contrib.auth.backends.password_auth
>>
>> # Filter the list of dags by owner name (requires authentication to be
>> enabled)
>>
>> filter_by_owner = True
>>
>> The (admin?) user that I created will after login see all DAGs (even
>> though filtering was enabled) and is able to create other users. However,
>> while creating new users through the UI, there seems to be no way to
>> specify a password?
>>
>> Thanks,
>>
>> Thomas
>>
>>
>>
>

--001a11352de63a7761054c842f36--