Enable multiple Authentication method in Airflow 3

[trongchata]

Description

context

Now we have deployed airflow 3 and integrated with OAuth2 SSO. But we still have a requirement for triggering the DAG via RESTful from python code.

requirement

Is there any possible to enable two types of Authentication method for Airflow 3?
Or
Is there any possible we deploy two api-server, one with OAuth2 and another one with LDAP username/password ?
Both of these two airflow api-server service need to connect to same airflow db.

Thank you

Use case/motivation

No response

Related issues

No response

Are you willing to submit a PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg[bot]]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[potiuk]

You can write your own AuthManager that would cover that scenario.

[potiuk]

Converted to a discussion

[aeroyorch]

We also want to support both local users and Keycloak authentication in Airflow. From the FAB docs, it seems possible to integrate multiple auth mechanisms, but I haven’t found a concrete example of how to configure more than one at the same time.

You mentioned this can be done with a custom AuthManager, but I couldn’t find an example in the documentation. Should we, for instance, enable AUTH_API_LOGIN_ALLOW_MULTIPLE_PROVIDERS to support both local and OAuth logins?

Any minimal example or clarification on how to properly configure both methods would be greatly appreciated :).

[potiuk]

Any minimal example or clarification on how to properly configure both methods would be greatly appreciated :).

No example/clarification for now, but if you figure it out, documenting it back woudl be cool. Generally speaking - you need to write your custom auth manager https://airflow.apache.org/docs/apache-airflow/stable/core-concepts/auth-manager/index.html#writing-your-own-auth-manager using essentiallly strategy pattern https://refactoring.guru/design-patterns/strategy

Strategy pattern means that you can instantiate two Auth Manager and based on strategy defined by you your custom auth manager will route auth manger method calls that it will receive to either one or the other.

That's the theory - you are the first to want it and maybe implementing it, so once you do it, documenting it would be a great contribution.