Repository navigation
Fix inheritance chain in security manager - #33901
Merged
Merged
Conversation
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ℹ️ the diff is big because I re-unified the various FAB security managers in one class. See #33901 (comment)
There is currently a weird situation with the security managers, where the
AirflowSecurityManager, which is supposed to be the more generic construct, inherits fromFabAirflowSecurityManagerOverride, supposed to be the more specific one. Because of this,FabAirflowSecurityManagerOverridedoesn't bear well its name, because it cannot override anything fromAirflowSecurityManagersince it sits lower on the inheritance tree.This was done initially to be able to extend functionalities of the Security Manager, while retaining an existing feature which was that users could plug their own security manager inheriting from
AirflowSecurityManager(so we couldn't squeeze the FAB one in between because that'd be a breaking change).The solution I used here is to have an empty shell stay where the
AirflowSecurityManagerwas, just to maintain back-compatibility. That one inherits from FAB Security Manager, which can now sit below the actualAirflowSecurityManager.This means that users can only override the FAB security manager and not other auth provider's SM but that's ok because this feature is pretty much rendered obsolete by AIP-56. See #33690 (comment)
Joining some class diagrams to help understanding.
Arrows read as "is inherited/implemented by".
current situation:

after:

I had to make the
ApplessAirflowSecurityManagerinherit from the "FAB" one instead of the generic airflow SM because it had some dependencies there. It's not ideal, and not what we want in a final state, but for now we just want a state that closer to it.We'll sort that dependency later on.