Role-based access control (RBAC) in Apache Airflow - Step-by-Step Execution

Process Flow - Role-based access control (RBAC)

User logs in

↓

System checks user role

↓

Match role to permissions

↓

Grant access to allowed features

↓

Deny access to restricted features

↓

User performs actions based on permissions

User logs in, system checks their role, matches permissions, then grants or denies access accordingly.

Execution Sample

Apache Airflow

from airflow.www.fab_security.manager import AUTH_ROLE_ADMIN

# Assign role to user
user.roles.append(AUTH_ROLE_ADMIN)

# Check permission
if 'can_read' in user.get_permissions():
    print('Access granted')

Assigns an admin role to a user and checks if the user has read permission to grant access.

Process Table

Step	Action	User Roles	Permissions Checked	Result
1	User logs in	[]	None	No access yet
2	Assign role AUTH_ROLE_ADMIN	['Admin']	None	Role assigned
3	Check if 'can_read' permission exists	['Admin']	'can_read'	Permission found
4	Grant access	['Admin']	'can_read'	Access granted
5	User performs action	['Admin']	Allowed actions	Action executed

💡 User has 'Admin' role with 'can_read' permission, so access is granted and action executed.

Status Tracker

Variable	Start	After Step 2	After Step 3	Final
user.roles	[]	['Admin']	['Admin']	['Admin']
permissions_checked	None	None	['can_read']	['can_read']
access_granted	False	False	True	True

Key Moments - 2 Insights

Why does the user get access only after role assignment?

Because permissions depend on roles. Before assigning 'Admin' role, user.roles is empty (see step 1 and 2 in execution_table), so no permissions are found.

What happens if the permission checked is not in the user's role?

Access is denied. The system checks permissions linked to roles (step 3). If permission is missing, result would be 'Permission not found' and no access granted.

Visual Quiz - 3 Questions

Look at the execution table, what is the user's roles after step 2?

A ['Admin']

B []

C ['User']

D ['ReadOnly']

💡 Hint

Check the 'User Roles' column at step 2 in the execution_table.

At which step does the system confirm the user has 'can_read' permission?

A Step 1

B Step 3

C Step 4

D Step 5

💡 Hint

Look at the 'Permissions Checked' and 'Result' columns in the execution_table.

If the user had no roles assigned, what would be the result at step 3?

A Permission found

B Access granted

C Permission not found

D Action executed

💡 Hint

Refer to the 'Result' column at step 3 and consider what happens if user.roles is empty.

Concept Snapshot

Role-based access control (RBAC) in Airflow:
- Users have roles.
- Roles have permissions.
- System checks user roles on login.
- Permissions determine access to features.
- Assign roles to grant permissions.

Full Transcript

Role-based access control (RBAC) in Airflow works by assigning roles to users. When a user logs in, the system checks their roles and the permissions linked to those roles. If the user has the required permission, such as 'can_read', access is granted to perform actions. Without roles, users have no permissions and cannot access protected features. This flow ensures users only access what their roles allow.

Practice

1. What is the main purpose of Role-Based Access Control (RBAC) in Apache Airflow?

easy

A. To assign users specific roles that define their permissions

B. To schedule DAG runs automatically

C. To monitor system resource usage

D. To create new DAGs from templates

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling who can do what by assigning roles with permissions.

2. Step 2: Identify RBAC purpose in Airflow

   In Airflow, RBAC assigns roles to users to control access to features and data.

3. Final Answer:

   To assign users specific roles that define their permissions -> Option A

4. Quick Check:

   RBAC = Assign roles with permissions [OK]

Hint: RBAC means roles control user permissions [OK]

Common Mistakes:

• Confusing RBAC with scheduling tasks
• Thinking RBAC monitors system resources
• Believing RBAC creates DAGs

2. Which Airflow CLI command correctly creates a user with the role 'Admin'?

easy

A. airflow users create --username alice --role Admin --email [e-mail]

B. airflow create user --name alice --role Admin

C. airflow user add --username alice --role Admin

D. airflow users add --user alice --role Admin

Solution

1. Step 1: Recall correct CLI syntax for user creation

   The correct command uses 'airflow users create' with flags for username, role, and email.

2. Step 2: Match options to syntax

   airflow users create --username alice --role Admin --email [e-mail] matches the correct syntax exactly; others have wrong commands or flags.

3. Final Answer:

   airflow users create --username alice --role Admin --email [e-mail] -> Option A

4. Quick Check:

   Correct CLI syntax = airflow users create --username alice --role Admin --email [e-mail] [OK]

Hint: Use 'airflow users create' with proper flags [OK]

Common Mistakes:

• Using 'create user' instead of 'users create'
• Missing required flags like --email
• Using incorrect command verbs like 'add'

3. Given this Airflow RBAC role assignment command, what will be the user's role?

airflow users create --username bob --role Viewer --email [e-mail]

medium

A. User

B. Admin

C. Viewer

D. Operator

Solution

1. Step 1: Read the command carefully

   The command assigns the role 'Viewer' to user 'bob'.

2. Step 2: Identify the assigned role

   The role specified with --role is 'Viewer', so that is the user's role.

3. Final Answer:

   Viewer -> Option C

4. Quick Check:

   Role assigned = Viewer [OK]

Hint: Look for --role flag value in command [OK]

Common Mistakes:

• Assuming default role instead of specified
• Confusing username with role
• Choosing a role not in the command

4. You run this command but get an error:

airflow users create --username carol --role Admin

What is the most likely cause?

medium

A. Username 'carol' already exists

B. Role 'Admin' does not exist

C. Incorrect command 'users create'

D. Missing required --email flag

Solution

1. Step 1: Check required flags for user creation

   The 'airflow users create' command requires --email flag along with username and role.

2. Step 2: Identify missing flag causing error

   The command lacks --email, so it triggers an error for missing required argument.

3. Final Answer:

   Missing required --email flag -> Option D

4. Quick Check:

   Required flags missing = Missing required --email flag [OK]

Hint: Always include --email when creating users [OK]

Common Mistakes:

• Ignoring required flags
• Assuming role names cause error
• Thinking command syntax is wrong

5. You want to restrict a user to only view DAGs but not edit or trigger them. Which role should you assign in Airflow RBAC to achieve this?

hard

A. Admin

B. Viewer

C. User

D. Op

Solution

1. Step 1: Understand role permissions in Airflow

   'Admin' has full access, 'User' and 'Op' have more permissions than just viewing.

2. Step 2: Identify role for view-only access

   'Viewer' role is designed to allow users to see DAGs without editing or triggering them.

3. Final Answer:

   Viewer -> Option B

4. Quick Check:

   View-only access = Viewer role [OK]

Hint: Use 'Viewer' role for read-only DAG access [OK]

Common Mistakes:

• Assigning Admin role for limited access
• Confusing 'User' or 'Op' with view-only
• Not knowing role permission differences