LDAP Auth Manager for Airflow 3+

[emredjan]

Hi everyone, since I didn't want to depend on FAB and wanted a lightweight authentication system that can sync to LDAP, I built may own using the new Auth Manager framework.

You can find the initial implementation here: Airflow LDAP Auth Manager

This works for my use case for authenticating against LDAP on Active Directory, but your mileage may vary.

Disclaimer: The code in the repository is written with the help of AI (specifically, ChatGPT 5), although I tried my best to streamline and validate most of it, there may still be some intricacies that need to be sorted out.

[emredjan]

This is now a proper installable python library: https://pypi.org/project/airflow-ldap-auth-manager/

[potiuk]

Nice. I suggest you add it in https://airflow.apache.org/ecosystem/ (just click "suggest a change on this page" and PR will be open for you)

[emredjan]

Thank you @potiuk, I will add it.

[vincbeck]

Very nice! :) As per my knowledge you're the first one (besides me) to implement an auth manager. Really happy to see that happening :) You also become the best person to give feedback on the documentation available to implement an auth manager. How did you find it? If you feel it could be improved, or some information is missing, I would love it if you could create PRs to improve it :) Thanks!

[emredjan]

Thank you, it was born out of a necessity really, as the old FAB auth manager and getting to make it work with LDAP was bit of a headache with Airflow 3+ (and it was a bit overkill for our use case, I needed something lighter).
I think the documentation for the auth manager framework is quite extensive, and it helped me understand the internals well (and it helped ChatGPT to quickly prototype a working auth manager, with some nudging). You still need to dive into the existing code a bit to get a working implementations of the provided functions, but that's to be expected when developing a plugin that integrates that much with the API server. Nevertheless, I will have another look at the documentation and see if I can come up with any suggestions / improvements.

[potiuk]

Fantastic! Thanks for all the effort and good words!

And yes. Precisely that was the thinking that FAB is heavy and that smaller Auth Managers - specifically targetted to specific backends (+ delegating out to KeyCloak provider for all the "heavy-ish" cases that require more sophisticated integration with a number of backends) is what people would be able to use.

Also - once the implementaiton is maybe battle tested, and maybe if you would like to consider that - contributing the LDAP Auth Manager Backend to Airflow as part of the LDAP integration, does not seem like a bad idea.

[vincbeck]

Fantastic! Thanks for all the effort and good words!

And yes. Precisely that was the thinking that FAB is heavy and that smaller Auth Managers - specifically targetted to specific backends (+ delegating out to KeyCloak provider for all the "heavy-ish" cases that require more sophisticated integration with a number of backends) is what people would be able to use.

Also - once the implementaiton is maybe battle tested, and maybe if you would like to consider that - contributing the LDAP Auth Manager Backend to Airflow as part of the LDAP integration, does not seem like a bad idea.

+1