This repo contains a provider package for apache airflow.
It provides an auth_manager that is able to connect to any OIDC compliant Identity Provider, and manages user permissions based on their group memberships, which are mapped to team-roles.
The exact mapping is still work in progress, but it should conform to the roles defined as the current airflow default roles: ANONYMOUS, VIEWER, USER, OPERATOR and ADMIN.
An example config via variables in a yaml file can look like this:
AIRFLOW__OAUTH2_AUTH_MANAGER__CLIENT_ID: airflow
AIRFLOW__OAUTH2_AUTH_MANAGER__CLIENT_SECRET: 'secret configured in the IdP'
AIRFLOW__OAUTH2_AUTH_MANAGER__SERVER_URL: https://someserver:1234/realms/airflow/.well-known/openid-configuration
AIRFLOW__OAUTH2_AUTH_MANAGER__SCOPES: "profile email openid roles"
AIRFLOW__OAUTH2_AUTH_MANAGER__TOKEN_PARSER_CLASS: airflow_oidc_provider.auth_manager.token_parser.SimpleOIDCTokenParser
AIRFLOW__OAUTH2_AUTH_MANAGER__TOKEN_PARSER_CONFIG: |
{
"token_key" : "token_key",
"admin_group" : "admin",
"teams" : {
"Team 1" : {
"team1:operator" : "operator",
"team1:user" : "user"
},
"Team 2" : {
"team2:operator" : "operator",
"team2:viewer" : "viewer",
"team2:user" : "user"
}
}
}
Configuration Options
Option name |
default |
description |
|---|---|---|
AIRFLOW__OAUTH2_AUTH_MANAGER__CLIENT_ID |
mandatory |
The client id to be used with the IdP. |
AIRFLOW__OAUTH2_AUTH_MANAGER__CLIENT_SECRET |
mandatory |
The client secret to be used with the IdP. |
AIRFLOW__OAUTH2_AUTH_MANAGER__SERVER_URL |
mandatory |
The URL for the OIDC endpoint of the IdP. Often ends in ‘.well-known/openid-configuration’. |
AIRFLOW__OAUTH2_AUTH_MANAGER__SCOPES |
profile email openid roles |
The scopes that need to be requested for the token to contain groups information. |
AIRFLOW__OAUTH2_AUTH_MANAGER__TOKEN_PARSER_CLASS |
airflow_oidc_provider.auth_manager.token_parser.SimpleOIDCTokenParser |
The class that parses the OIDC token for userinformation. |
AIRFLOW__OAUTH2_AUTH_MANAGER__TOKEN_PARSER_CONFIG |
mandatory for default class, else depends on class |
A config string for the parser class. More details for the default class below. |
AIRFLOW__OAUTH2_AUTH_MANAGER__LOGOUT_URL |
None |
Optional explicit OIDC provider logout URL. If omitted, Authlib uses the OIDC discovery metadata. |
AIRFLOW__OAUTH2_AUTH_MANAGER__POST_LOGOUT_REDIRECT_URI |
[api] base url |
URI passed to the provider as post_logout_redirect_uri. |
AIRFLOW__OAUTH2_AUTH_MANAGER__PROVIDER_LOGOUT_ENABLED |
False |
Whether logout should redirect to the OIDC provider logout endpoint after deleting Airflow cookies. |
SimpleOIDCTokenParser
The SimpleOIDCTokenParser parses the userinfo returned by the IdP for team memberships and access level of the user. To configure it for your specific IdP, and to support slightly off-standard IdPs, it requires some information to parse a token.
The configuration string should be in json format.
json key |
description |
|---|---|
token_key |
The key within the userinfo token, which contains the list of groups the user is a member of |
admin_group |
The name of the group in the userinfo token, which will be matched to airflow ADMIN permissions. |
teams |
|
Testing
The testcases included in this repository depend on some internal airflow development packages, which are not provided in a public registry, and had to be built from source.
Therefore those testcases are not run if the required packages are not present.
1 maintainer
Metadata
1 maintainer
Release files for airflow-oidc-provider 0.2.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| airflow_oidc_provider-0.2.1.tar.gz | 17.0 kB | With provenance | Details for airflow_oidc_provider-0.2.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| airflow_oidc_provider-0.2.1-py3-none-any.whl | Python 3 | none | any | Details for airflow_oidc_provider-0.2.1-py3-none-any.whl |
Total release size: 34.4 kB
Release files / airflow_oidc_provider-0.2.1.tar.gz
| Download URL | airflow_oidc_provider-0.2.1.tar.gz |
|---|---|
| Size | 17.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
992b5453b1e57b3275e2419aff82f625b877cb88d99533d8c53aade06b5d2723
|
|
BLAKE2b-256 checksum How to use checksums |
45a6b96f68467d26f267442d883761a7062662d310a07108466321a5a2a0faee
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 11, 2026.
Transparency logRelease files / airflow_oidc_provider-0.2.1-py3-none-any.whl
| Download URL | airflow_oidc_provider-0.2.1-py3-none-any.whl |
|---|---|
| Size | 17.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
0daeb73587a9e0174aaed0694232df6c398c79914129864b07fa7e01f9070b1c
|
|
BLAKE2b-256 checksum How to use checksums |
fc05f7664d627849b748fe178d18e8128a97fd906f047f0cc2efe1022d74fb8b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 11, 2026.
Transparency logSecurity for airflow-oidc-provider 0.2.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for airflow_oidc_provider-0.2.1.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 11, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
