Role-based access control (RBAC) in Apache Airflow - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Airflow RBAC Roles

In Apache Airflow's RBAC system, which role has the ability to create and edit DAGs but cannot manage users or roles?

A Op

B User

C Admin

D Viewer

💡 Hint

Think about roles that allow operational control but restrict user management.

The Op role in Airflow RBAC allows users to create and edit DAGs but does not grant permissions to manage users or roles. The Admin role has full permissions, User can trigger DAGs but not edit, and Viewer can only view.

💻 Command Output

intermediate

Output of Airflow RBAC User Creation Command

What is the output of the following command when creating a new Airflow user with RBAC enabled? airflow users create --username testuser --firstname Test --lastname User --role Viewer --email [e-mail]

Apache Airflow

airflow users create --username testuser --firstname Test --lastname User --role Viewer --email [e-mail]

A Syntax error: missing required argument

B Error: Role Viewer does not exist

C User testuser already exists

D User testuser created successfully

💡 Hint

Assuming the Viewer role exists and the username is new.

If the role exists and the username is not taken, Airflow confirms user creation with a success message.

❓ Configuration

advanced

Configuring Airflow to Enable RBAC

Which configuration change in airflow.cfg enables the RBAC UI and security features?

Apache Airflow

[webserver]
# What should be set to True to enable RBAC?

A enable_rbac = True

B rbac_enabled = True

C rbac = True

D webserver_rbac = True

💡 Hint

Check the official Airflow configuration for the webserver section.

The correct setting is rbac = True under the [webserver] section to enable RBAC UI and security.

❓ Troubleshoot

advanced

Troubleshooting Airflow RBAC Permission Denied Error

A user with the 'User' role tries to access the Airflow Admin panel but gets a '403 Forbidden' error. What is the most likely cause?

A The 'User' role does not have permission to access the Admin panel

B The Airflow webserver is not running

C The user's password has expired

D The Airflow database is corrupted

💡 Hint

Consider what permissions the 'User' role typically has.

The 'User' role in Airflow RBAC does not have admin panel access permissions, causing the 403 error.

🔀 Workflow

expert

Sequence to Add a New RBAC Role with Custom Permissions

What is the correct order of steps to add a new custom role with specific permissions in Airflow RBAC?

A 2,1,3,4

B 1,2,3,4

C 1,3,2,4

D 3,1,2,4

💡 Hint

Think about the logical UI navigation flow.

You must first log in as Admin, then go to the roles list, add a new role, and finally assign permissions before saving.

Practice

1. What is the main purpose of Role-Based Access Control (RBAC) in Apache Airflow?

easy

A. To assign users specific roles that define their permissions

B. To schedule DAG runs automatically

C. To monitor system resource usage

D. To create new DAGs from templates

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling who can do what by assigning roles with permissions.

2. Step 2: Identify RBAC purpose in Airflow

   In Airflow, RBAC assigns roles to users to control access to features and data.

3. Final Answer:

   To assign users specific roles that define their permissions -> Option A

4. Quick Check:

   RBAC = Assign roles with permissions [OK]

Hint: RBAC means roles control user permissions [OK]

Common Mistakes:

• Confusing RBAC with scheduling tasks
• Thinking RBAC monitors system resources
• Believing RBAC creates DAGs

2. Which Airflow CLI command correctly creates a user with the role 'Admin'?

easy

A. airflow users create --username alice --role Admin --email [e-mail]

B. airflow create user --name alice --role Admin

C. airflow user add --username alice --role Admin

D. airflow users add --user alice --role Admin

Solution

1. Step 1: Recall correct CLI syntax for user creation

   The correct command uses 'airflow users create' with flags for username, role, and email.

2. Step 2: Match options to syntax

   airflow users create --username alice --role Admin --email [e-mail] matches the correct syntax exactly; others have wrong commands or flags.

3. Final Answer:

   airflow users create --username alice --role Admin --email [e-mail] -> Option A

4. Quick Check:

   Correct CLI syntax = airflow users create --username alice --role Admin --email [e-mail] [OK]

Hint: Use 'airflow users create' with proper flags [OK]

Common Mistakes:

• Using 'create user' instead of 'users create'
• Missing required flags like --email
• Using incorrect command verbs like 'add'

3. Given this Airflow RBAC role assignment command, what will be the user's role?

airflow users create --username bob --role Viewer --email [e-mail]

medium

A. User

B. Admin

C. Viewer

D. Operator

Solution

1. Step 1: Read the command carefully

   The command assigns the role 'Viewer' to user 'bob'.

2. Step 2: Identify the assigned role

   The role specified with --role is 'Viewer', so that is the user's role.

3. Final Answer:

   Viewer -> Option C

4. Quick Check:

   Role assigned = Viewer [OK]

Hint: Look for --role flag value in command [OK]

Common Mistakes:

• Assuming default role instead of specified
• Confusing username with role
• Choosing a role not in the command

4. You run this command but get an error:

airflow users create --username carol --role Admin

What is the most likely cause?

medium

A. Username 'carol' already exists

B. Role 'Admin' does not exist

C. Incorrect command 'users create'

D. Missing required --email flag

Solution

1. Step 1: Check required flags for user creation

   The 'airflow users create' command requires --email flag along with username and role.

2. Step 2: Identify missing flag causing error

   The command lacks --email, so it triggers an error for missing required argument.

3. Final Answer:

   Missing required --email flag -> Option D

4. Quick Check:

   Required flags missing = Missing required --email flag [OK]

Hint: Always include --email when creating users [OK]

Common Mistakes:

• Ignoring required flags
• Assuming role names cause error
• Thinking command syntax is wrong

5. You want to restrict a user to only view DAGs but not edit or trigger them. Which role should you assign in Airflow RBAC to achieve this?

hard

A. Admin

B. Viewer

C. User

D. Op

Solution

1. Step 1: Understand role permissions in Airflow

   'Admin' has full access, 'User' and 'Op' have more permissions than just viewing.

2. Step 2: Identify role for view-only access

   'Viewer' role is designed to allow users to see DAGs without editing or triggering them.

3. Final Answer:

   Viewer -> Option B

4. Quick Check:

   View-only access = Viewer role [OK]

Hint: Use 'Viewer' role for read-only DAG access [OK]

Common Mistakes:

• Assigning Admin role for limited access
• Confusing 'User' or 'Op' with view-only
• Not knowing role permission differences