Skip to content

feat(fab): Add configurable role key for Azure OAuth groups#61585

Merged
vincbeck merged 3 commits into
apache:mainfrom
Eason09053360:fix/azure-oauth-groups-support
Feb 16, 2026
Merged

feat(fab): Add configurable role key for Azure OAuth groups#61585
vincbeck merged 3 commits into
apache:mainfrom
Eason09053360:fix/azure-oauth-groups-support

Conversation

@Eason09053360

@Eason09053360 Eason09053360 commented Feb 7, 2026

Copy link
Copy Markdown
Contributor

Add AUTH_OAUTH_ROLE_KEYS configuration to allow Azure AD OAuth to use 'groups' claim instead of hardcoded 'roles' claim.

This enables organizations using Azure AD groups for access control to map group memberships to Airflow roles without requiring custom app role definitions.

Changes:

  • Add AUTH_OAUTH_ROLE_KEYS config support in get_oauth_user_info
  • Default to 'roles' for backward compatibility
  • Add test case for Azure OAuth with groups configuration
  • Add documentation for Azure AD group-based authorization

closes: #61567

Was generative AI tooling used to co-author this PR?
  • Yes (please specify the tool below)
  • Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
  • For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
  • When adding dependency, check compliance with the ASF 3rd Party License Policy.
  • For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

@Eason09053360
feat(fab): Add configurable role key for Azure OAuth groups
96b0efd 
Add AUTH_OAUTH_ROLE_KEYS configuration to allow Azure AD OAuth
to use 'groups' claim instead of hardcoded 'roles' claim.

This enables organizations using Azure AD groups for access control
to map group memberships to Airflow roles without requiring custom
app role definitions.

Changes:
- Add AUTH_OAUTH_ROLE_KEYS config support in get_oauth_user_info
- Default to 'roles' for backward compatibility
- Add test case for Azure OAuth with groups configuration
- Add documentation for Azure AD group-based authorization
@henry3260

henry3260 commented Feb 7, 2026

Copy link
Copy Markdown
Contributor

We should ensure the tests run within an application context.

@shahar1

shahar1 commented Feb 7, 2026

Copy link
Copy Markdown
Contributor

Add AUTH_OAUTH_ROLE_KEYS configuration to allow Azure AD OAuth to use 'groups' claim instead of hardcoded 'roles' claim.

This enables organizations using Azure AD groups for access control to map group memberships to Airflow roles without requiring custom app role definitions.

Changes:

  • Add AUTH_OAUTH_ROLE_KEYS config support in get_oauth_user_info
  • Default to 'roles' for backward compatibility
  • Add test case for Azure OAuth with groups configuration
  • Add documentation for Azure AD group-based authorization

closes: #61567

Was generative AI tooling used to co-author this PR?

  • Yes (please specify the tool below)

  • Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.

  • For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.

  • When adding dependency, check compliance with the ASF 3rd Party License Policy.

  • For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

For your next PRs that refer to a specific issue - please also comment on the issue that you ask to be assigned for, and check please if others asked for that just before you - so there won't be a situation where two people work on the same issue in parallel. Thank you!

@Eason09053360

Eason09053360 commented Feb 7, 2026

Copy link
Copy Markdown
Contributor Author

Thanks for the heads-up! I wasn't aware of the strict assignment protocol as a new contributor. I'll make sure to claim the issue first next time. Thanks for reviewing!

@Eason09053360 Eason09053360 force-pushed the fix/azure-oauth-groups-support branch from 40cc26c to 05f33ed Compare February 10, 2026 17:13
@Eason09053360
Fix Azure OAuth to support configurable role key via AUTH_OAUTH_ROLE_…
00a3f06 
…KEYS

- Add has_app_context() check in get_oauth_user_info() to support both production and test environments

- Update test to use real Flask app context instead of mocking current_app
@Eason09053360 Eason09053360 force-pushed the fix/azure-oauth-groups-support branch from 05f33ed to 00a3f06 Compare February 10, 2026 17:30
vincbeck
vincbeck reviewed Feb 12, 2026
View reviewed changes
Comment thread providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py Outdated
@Eason09053360
Remove has_app_context() check per review feedback
88c4898 
- Removed has_app_context() conditional in Azure OAuth handler
- Added Flask app context to tests to simulate production environment
- Updated test_get_oauth_user_info to provide Flask context for all providers
- Updated test_get_oauth_user_info_azure_with_groups_config with app.config setup

Per committer feedback: "this function is always called within the request context"
@potiuk

potiuk commented Feb 15, 2026

Copy link
Copy Markdown
Member

LGTM - but would love @vincbeck to confirm :)

@vincbeck vincbeck merged commit 07ef470 into apache:main Feb 16, 2026
86 checks passed
OscarLigthart pushed a commit to OscarLigthart/airflow that referenced this pull request Feb 17, 2026
@Eason09053360 @OscarLigthart
feat(fab): Add configurable role key for Azure OAuth groups (apache#6…
1d19296 
…1585)

* feat(fab): Add configurable role key for Azure OAuth groups

Add AUTH_OAUTH_ROLE_KEYS configuration to allow Azure AD OAuth
to use 'groups' claim instead of hardcoded 'roles' claim.

This enables organizations using Azure AD groups for access control
to map group memberships to Airflow roles without requiring custom
app role definitions.

Changes:
- Add AUTH_OAUTH_ROLE_KEYS config support in get_oauth_user_info
- Default to 'roles' for backward compatibility
- Add test case for Azure OAuth with groups configuration
- Add documentation for Azure AD group-based authorization

* Fix Azure OAuth to support configurable role key via AUTH_OAUTH_ROLE_KEYS

- Add has_app_context() check in get_oauth_user_info() to support both production and test environments

- Update test to use real Flask app context instead of mocking current_app

* Remove has_app_context() check per review feedback

- Removed has_app_context() conditional in Azure OAuth handler
- Added Flask app context to tests to simulate production environment
- Updated test_get_oauth_user_info to provide Flask context for all providers
- Updated test_get_oauth_user_info_azure_with_groups_config with app.config setup

Per committer feedback: "this function is always called within the request context"
choo121600 pushed a commit to choo121600/airflow that referenced this pull request Feb 22, 2026
@Eason09053360 @choo121600
feat(fab): Add configurable role key for Azure OAuth groups (apache#6…
b8df02f 
…1585)

* feat(fab): Add configurable role key for Azure OAuth groups

Add AUTH_OAUTH_ROLE_KEYS configuration to allow Azure AD OAuth
to use 'groups' claim instead of hardcoded 'roles' claim.

This enables organizations using Azure AD groups for access control
to map group memberships to Airflow roles without requiring custom
app role definitions.

Changes:
- Add AUTH_OAUTH_ROLE_KEYS config support in get_oauth_user_info
- Default to 'roles' for backward compatibility
- Add test case for Azure OAuth with groups configuration
- Add documentation for Azure AD group-based authorization

* Fix Azure OAuth to support configurable role key via AUTH_OAUTH_ROLE_KEYS

- Add has_app_context() check in get_oauth_user_info() to support both production and test environments

- Update test to use real Flask app context instead of mocking current_app

* Remove has_app_context() check per review feedback

- Removed has_app_context() conditional in Azure OAuth handler
- Added Flask app context to tests to simulate production environment
- Updated test_get_oauth_user_info to provide Flask context for all providers
- Updated test_get_oauth_user_info_azure_with_groups_config with app.config setup

Per committer feedback: "this function is always called within the request context"
@potiuk potiuk mentioned this pull request Feb 26, 2026
Closed
Subham-KRLX pushed a commit to Subham-KRLX/airflow that referenced this pull request Mar 4, 2026
@Eason09053360 @Subham-KRLX
feat(fab): Add configurable role key for Azure OAuth groups (apache#6…
bb109b4 
…1585)

* feat(fab): Add configurable role key for Azure OAuth groups

Add AUTH_OAUTH_ROLE_KEYS configuration to allow Azure AD OAuth
to use 'groups' claim instead of hardcoded 'roles' claim.

This enables organizations using Azure AD groups for access control
to map group memberships to Airflow roles without requiring custom
app role definitions.

Changes:
- Add AUTH_OAUTH_ROLE_KEYS config support in get_oauth_user_info
- Default to 'roles' for backward compatibility
- Add test case for Azure OAuth with groups configuration
- Add documentation for Azure AD group-based authorization

* Fix Azure OAuth to support configurable role key via AUTH_OAUTH_ROLE_KEYS

- Add has_app_context() check in get_oauth_user_info() to support both production and test environments

- Update test to use real Flask app context instead of mocking current_app

* Remove has_app_context() check per review feedback

- Removed has_app_context() conditional in Azure OAuth handler
- Added Flask app context to tests to simulate production environment
- Updated test_get_oauth_user_info to provide Flask context for all providers
- Updated test_get_oauth_user_info_azure_with_groups_config with app.config setup

Per committer feedback: "this function is always called within the request context"
dominikhei pushed a commit to dominikhei/airflow that referenced this pull request Mar 11, 2026
@Eason09053360 @dominikhei
feat(fab): Add configurable role key for Azure OAuth groups (apache#6…
3c26734 
…1585)

* feat(fab): Add configurable role key for Azure OAuth groups

Add AUTH_OAUTH_ROLE_KEYS configuration to allow Azure AD OAuth
to use 'groups' claim instead of hardcoded 'roles' claim.

This enables organizations using Azure AD groups for access control
to map group memberships to Airflow roles without requiring custom
app role definitions.

Changes:
- Add AUTH_OAUTH_ROLE_KEYS config support in get_oauth_user_info
- Default to 'roles' for backward compatibility
- Add test case for Azure OAuth with groups configuration
- Add documentation for Azure AD group-based authorization

* Fix Azure OAuth to support configurable role key via AUTH_OAUTH_ROLE_KEYS

- Add has_app_context() check in get_oauth_user_info() to support both production and test environments

- Update test to use real Flask app context instead of mocking current_app

* Remove has_app_context() check per review feedback

- Removed has_app_context() conditional in Azure OAuth handler
- Added Flask app context to tests to simulate production environment
- Updated test_get_oauth_user_info to provide Flask context for all providers
- Updated test_get_oauth_user_info_azure_with_groups_config with app.config setup

Per committer feedback: "this function is always called within the request context"
Ankurdeewan pushed a commit to Ankurdeewan/airflow that referenced this pull request Mar 15, 2026
@Eason09053360 @Ankurdeewan
feat(fab): Add configurable role key for Azure OAuth groups (apache#6…
cbcb059 
…1585)

* feat(fab): Add configurable role key for Azure OAuth groups

Add AUTH_OAUTH_ROLE_KEYS configuration to allow Azure AD OAuth
to use 'groups' claim instead of hardcoded 'roles' claim.

This enables organizations using Azure AD groups for access control
to map group memberships to Airflow roles without requiring custom
app role definitions.

Changes:
- Add AUTH_OAUTH_ROLE_KEYS config support in get_oauth_user_info
- Default to 'roles' for backward compatibility
- Add test case for Azure OAuth with groups configuration
- Add documentation for Azure AD group-based authorization

* Fix Azure OAuth to support configurable role key via AUTH_OAUTH_ROLE_KEYS

- Add has_app_context() check in get_oauth_user_info() to support both production and test environments

- Update test to use real Flask app context instead of mocking current_app

* Remove has_app_context() check per review feedback

- Removed has_app_context() conditional in Azure OAuth handler
- Added Flask app context to tests to simulate production environment
- Updated test_get_oauth_user_info to provide Flask context for all providers
- Updated test_get_oauth_user_info_azure_with_groups_config with app.config setup

Per committer feedback: "this function is always called within the request context"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@potiuk potiuk potiuk approved these changes
@vincbeck vincbeck vincbeck approved these changes

Assignees

No one assigned

Labels

area:providers kind:documentation provider:fab

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Fab Auth Azure SSO Integration Issue

5 participants

@Eason09053360 @henry3260 @shahar1 @potiuk @vincbeck