From 384d062e40a6cb13e421d5061292fb42088c9a6a Mon Sep 17 00:00:00 2001 From: Vincent <97131062+vincbeck@users.noreply.github.com> Date: Wed, 3 Jan 2024 13:02:36 -0500 Subject: [PATCH] Fix security manager inheritance in fab provider (#36538) (cherry picked from commit 2093b6f3b94be9fae5d61042a9c280d9a835687b) --- airflow/auth/managers/fab/fab_auth_manager.py | 14 ++-- ...t_sbom_generate-providers-requirements.svg | 68 ++++++++++--------- ...t_sbom_generate-providers-requirements.txt | 2 +- generated/provider_dependencies.json | 9 +++ .../managers/fab/test_fab_auth_manager.py | 30 +++++++- 5 files changed, 81 insertions(+), 42 deletions(-) diff --git a/airflow/auth/managers/fab/fab_auth_manager.py b/airflow/auth/managers/fab/fab_auth_manager.py index 5224509039074..e05abc97d31e6 100644 --- a/airflow/auth/managers/fab/fab_auth_manager.py +++ b/airflow/auth/managers/fab/fab_auth_manager.py @@ -222,10 +222,10 @@ def is_authorized_dag( entity (e.g. DAG runs). 2. ``dag_access`` is provided which means the user wants to access a sub entity of the DAG (e.g. DAG runs). - a. If ``method`` is GET, then check the user has READ permissions on the DAG and the sub entity. - b. Else, check the user has EDIT permissions on the DAG and ``method`` on the sub entity. - However, if no specific DAG is targeted, just check the sub entity. + a. If ``method`` is GET, then check the user has READ permissions on the DAG and the sub entity. + b. Else, check the user has EDIT permissions on the DAG and ``method`` on the sub entity. However, + if no specific DAG is targeted, just check the sub entity. :param method: The method to authorize. :param access_entity: The dag access entity. @@ -335,19 +335,19 @@ def get_permitted_dag_ids( def security_manager(self) -> FabAirflowSecurityManagerOverride: """Return the security manager specific to FAB.""" from airflow.auth.managers.fab.security_manager.override import FabAirflowSecurityManagerOverride - from airflow.www.security import AirflowSecurityManager + from airflow.www.security_manager import AirflowSecurityManagerV2 sm_from_config = self.appbuilder.get_app.config.get("SECURITY_MANAGER_CLASS") if sm_from_config: - if not issubclass(sm_from_config, AirflowSecurityManager): + if not issubclass(sm_from_config, AirflowSecurityManagerV2): raise Exception( - """Your CUSTOM_SECURITY_MANAGER must extend FabAirflowSecurityManagerOverride, + """Your CUSTOM_SECURITY_MANAGER must extend AirflowSecurityManagerV2, not FAB's own security manager.""" ) if not issubclass(sm_from_config, FabAirflowSecurityManagerOverride): warnings.warn( "Please make your custom security manager inherit from " - "FabAirflowSecurityManagerOverride instead of AirflowSecurityManager.", + "FabAirflowSecurityManagerOverride instead of FabAirflowSecurityManagerOverride.", DeprecationWarning, ) return sm_from_config(self.appbuilder) diff --git a/dev/breeze/doc/images/output_sbom_generate-providers-requirements.svg b/dev/breeze/doc/images/output_sbom_generate-providers-requirements.svg index eb022ae634fd8..cb90b209604e9 100644 --- a/dev/breeze/doc/images/output_sbom_generate-providers-requirements.svg +++ b/dev/breeze/doc/images/output_sbom_generate-providers-requirements.svg @@ -1,4 +1,4 @@ - +