Role-based access control (RBAC) in Apache Airflow - Time & Space Complexity

Time Complexity: Role-based access control (RBAC)

O(r * p)

Understanding Time Complexity

When using RBAC in Airflow, we want to know how the system handles permission checks as the number of users and roles grows.

We ask: How does the time to check access change when more roles or users are added?

Scenario Under Consideration

Analyze the time complexity of the following Airflow RBAC permission check code.

# Check if user has permission
user_roles = get_user_roles(user_id)  # returns list of roles
for role in user_roles:
    permissions = get_role_permissions(role)  # returns list of permissions
    if required_permission in permissions:
        return True
return False
    

This code checks if a user has a specific permission by looking through all their roles and the permissions each role grants.

Identify Repeating Operations

Look at what repeats in the code:

• Primary operation: Looping through each role the user has.
• How many times: Once for each role assigned to the user.
• Inside that, checking permissions for each role involves scanning the permissions list.
• The dominant work is scanning permissions for each role.

How Execution Grows With Input

As the number of roles and permissions grows, the checks take longer.

Input Size (n)	Approx. Operations
10 roles, 5 permissions each	~50 permission checks
100 roles, 10 permissions each	~1000 permission checks
1000 roles, 20 permissions each	~20,000 permission checks

Pattern observation: The total checks grow roughly by multiplying roles and permissions, so more roles or permissions means more work.

Final Time Complexity

Time Complexity: O(r * p)

This means the time to check permission grows with the number of roles (r) the user has times the number of permissions (p) each role contains.

Common Mistake

[X] Wrong: "Checking one permission is always fast and constant time regardless of roles or permissions."

[OK] Correct: Because the code checks each role and its permissions one by one, more roles or permissions mean more checks, so time grows with input size.

Interview Connect

Understanding how permission checks scale helps you design systems that stay fast as users and roles grow. This skill shows you can think about real system limits and keep things running smoothly.

Self-Check

"What if permissions for each role were stored in a fast lookup like a set instead of a list? How would that change the time complexity?"

Practice

1. What is the main purpose of Role-Based Access Control (RBAC) in Apache Airflow?

easy

A. To assign users specific roles that define their permissions

B. To schedule DAG runs automatically

C. To monitor system resource usage

D. To create new DAGs from templates

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling who can do what by assigning roles with permissions.

2. Step 2: Identify RBAC purpose in Airflow

   In Airflow, RBAC assigns roles to users to control access to features and data.

3. Final Answer:

   To assign users specific roles that define their permissions -> Option A

4. Quick Check:

   RBAC = Assign roles with permissions [OK]

Hint: RBAC means roles control user permissions [OK]

Common Mistakes:

• Confusing RBAC with scheduling tasks
• Thinking RBAC monitors system resources
• Believing RBAC creates DAGs

2. Which Airflow CLI command correctly creates a user with the role 'Admin'?

easy

A. airflow users create --username alice --role Admin --email [e-mail]

B. airflow create user --name alice --role Admin

C. airflow user add --username alice --role Admin

D. airflow users add --user alice --role Admin

Solution

1. Step 1: Recall correct CLI syntax for user creation

   The correct command uses 'airflow users create' with flags for username, role, and email.

2. Step 2: Match options to syntax

   airflow users create --username alice --role Admin --email [e-mail] matches the correct syntax exactly; others have wrong commands or flags.

3. Final Answer:

   airflow users create --username alice --role Admin --email [e-mail] -> Option A

4. Quick Check:

   Correct CLI syntax = airflow users create --username alice --role Admin --email [e-mail] [OK]

Hint: Use 'airflow users create' with proper flags [OK]

Common Mistakes:

• Using 'create user' instead of 'users create'
• Missing required flags like --email
• Using incorrect command verbs like 'add'

3. Given this Airflow RBAC role assignment command, what will be the user's role?

airflow users create --username bob --role Viewer --email [e-mail]

medium

A. User

B. Admin

C. Viewer

D. Operator

Solution

1. Step 1: Read the command carefully

   The command assigns the role 'Viewer' to user 'bob'.

2. Step 2: Identify the assigned role

   The role specified with --role is 'Viewer', so that is the user's role.

3. Final Answer:

   Viewer -> Option C

4. Quick Check:

   Role assigned = Viewer [OK]

Hint: Look for --role flag value in command [OK]

Common Mistakes:

• Assuming default role instead of specified
• Confusing username with role
• Choosing a role not in the command

4. You run this command but get an error:

airflow users create --username carol --role Admin

What is the most likely cause?

medium

A. Username 'carol' already exists

B. Role 'Admin' does not exist

C. Incorrect command 'users create'

D. Missing required --email flag

Solution

1. Step 1: Check required flags for user creation

   The 'airflow users create' command requires --email flag along with username and role.

2. Step 2: Identify missing flag causing error

   The command lacks --email, so it triggers an error for missing required argument.

3. Final Answer:

   Missing required --email flag -> Option D

4. Quick Check:

   Required flags missing = Missing required --email flag [OK]

Hint: Always include --email when creating users [OK]

Common Mistakes:

• Ignoring required flags
• Assuming role names cause error
• Thinking command syntax is wrong

5. You want to restrict a user to only view DAGs but not edit or trigger them. Which role should you assign in Airflow RBAC to achieve this?

hard

A. Admin

B. Viewer

C. User

D. Op

Solution

1. Step 1: Understand role permissions in Airflow

   'Admin' has full access, 'User' and 'Op' have more permissions than just viewing.

2. Step 2: Identify role for view-only access

   'Viewer' role is designed to allow users to see DAGs without editing or triggering them.

3. Final Answer:

   Viewer -> Option B

4. Quick Check:

   View-only access = Viewer role [OK]

Hint: Use 'Viewer' role for read-only DAG access [OK]

Common Mistakes:

• Assigning Admin role for limited access
• Confusing 'User' or 'Op' with view-only
• Not knowing role permission differences