🛡️ Dagster AuthKit

Community authentication wrapper for self-hosted Dagster OSS.

Authentication, RBAC, and Audit logs for Dagster without touching internal code.

🎯 What is this?

Dagster OSS has no auth. If you run it in a VPC or locally, anyone with the URL has full admin access.

AuthKit solves this by wrapping the dagster-webserver command to add:

• ✅ Login Interface: Simple username/password flow.
• ✅ RBAC (4 Levels): Granular control over who can do what.
• ✅ Audit Logs: JSON logs for monitoring who is doing what.
• ✅ Multi-Backend: Works with SQLite, Postgres, MySQL (via Peewee ORM) and Redis.

No code changes required. You don't touch your repository.py or dagster.yaml.

✨ What's New in v0.4.0

🔐 Security Hardening (Breaking Changes)

• SECRET_KEY is now required in production. The server will refuse to start if DAGSTER_AUTH_SECRET_KEY is not set and DAGSTER_AUTH_ENV=production. Auto-generated keys caused silent session breakage in multi-pod deployments.
• Proxy mode now requires trusted IPs. Set DAGSTER_AUTH_PROXY_TRUSTED_IPS (comma-separated) or explicitly opt into the insecure default with DAGSTER_AUTH_PROXY_TRUST_ALL=true.
• RBAC is now deny-by-default for unknown mutations. New GraphQL mutations added by future Dagster releases require ADMIN role until explicitly audited. Configure via DAGSTER_AUTH_UNKNOWN_MUTATION_ROLE.

🔄 Cross-Pod Session Revocation

• DB-backed session_version column. change_password, change_role, and delete_user now invalidate sessions across ALL pods without Redis. A new session_version column is automatically added to existing databases on upgrade.
• Dual rate-limiting (username + IP). Prevents both credential stuffing and brute-force on a single account.

🛡️ Attack Surface Reduction

• CSRF protection on the login form (double-submit signed cookie).
• WebSocket authentication — GraphQL subscriptions at /graphql are now authenticated (pure ASGI middleware).
• XSS prevention in login and 403 pages via HTML escaping.
• Open redirect hardening — protocol-relative URLs (//evil.com) are blocked.
• Empty password rejection across all backends (prevents unauthenticated LDAP binds).

🏗️ Core Improvements

• operationName support in GraphQL RBAC. Clients sending multiple operations in one document no longer trigger false-positive blocks.
• Backend instance caching. Backend connections are reused across requests instead of being recreated per call.
• Unified role serialization. to_dict() now uses role.value (int) for cross-backend consistency.

⚠️ Upgrading from v0.3.x

1. Set DAGSTER_AUTH_SECRET_KEY in your environment. Generate one with:

   python -c 'import secrets; print(secrets.token_urlsafe(32))'
   

2. If using proxy mode, set DAGSTER_AUTH_PROXY_TRUSTED_IPS to your proxy's IP address.
3. Database migration happens automatically on first boot — no manual steps needed for SQLite/Postgres/MySQL. A session_version column is added to the users table.
4. Role serialization changed from string ("ADMIN") to int (40) in session cookies. Existing sessions continue to work (backward-compatible from_dict).

📂 Ready-to-Run Examples

We provide ready-to-use stacks for different scenarios in the examples/ directory:

examples
├── authelia              # NEW! Authelia + Caddy + LDAP SSO (Docker)
│   ├── Makefile
│   ├── docker-compose.yml
│   ├── Caddyfile
│   └── authelia/
├── kubernetes            # NEW! Minikube deployment
│   ├── Makefile
│   └── k8s/
├── ldap                  # Active Directory integration (**Experimental**)
│   ├── Makefile
│   ├── docker-compose.yml
│   └── ldap-bootstrap.ldif
├── postgresql_redis      # Recommended production setup
│   ├── Makefile
│   └── docker-compose.yml
└── quickstart-sqlite     # Simple local testing
    ├── Makefile
    └── docker-compose.yml

How to run

Pick a scenario, go into the folder, and check the Makefile.

1. Authelia SSO (Docker) Complete SSO with Authelia, Caddy, and OpenLDAP:

cd examples/authelia
make up
# Access: https://auth.company.com (admin/password123)
# Then:   https://dagster.company.com

2. Kubernetes (Minikube) Same stack running on Kubernetes:

cd examples/kubernetes
make build  # Build the Docker image inside Minikube
make up     # Deploy everything
# In another terminal: make connect (runs minikube tunnel)
# Add to /etc/hosts: $(minikube ip) auth.company.com dagster.company.com

3. Standard Setup (Postgres + Redis)

cd examples/postgresql_redis
make up

4. Local Quickstart (SQLite)

cd examples/quickstart-sqlite
make up

5. LDAP/AD Testing ⚠️ EXPERIMENTAL

cd examples/ldap
make up

🚀 Manual Installation (Python)

If you aren't using Docker, you can install via pip.

# For local testing (SQLite)
pip install dagster-authkit[sqlite]

# For server usage (Postgres + Redis recommended)
pip install dagster-authkit[postgresql,redis]

# For LDAP/Active Directory integration (**Experimental**)
pip install dagster-authkit[ldap]

Usage:

# Initialize the database and create the first admin
dagster-authkit init-db --with-admin

# Run Dagster (replaces the standard 'dagster-webserver' command)
dagster-authkit -f your_pipeline.py -h 0.0.0.0 -p 3000

# For proxy mode (Authelia/OAuth2 Proxy)
export DAGSTER_AUTH_BACKEND=proxy
export DAGSTER_AUTH_PROXY_LOGIN_URL=https://auth.yourcompany.com
dagster-authkit -f your_pipeline.py -h 0.0.0.0 -p 3000

🔐 Roles (RBAC)

We provide 4 levels of access. Permissions are enforced via GraphQL query analysis.

How it works: AuthKit analyzes GraphQL queries using the official GraphQL parser to accurately identify mutations and block unauthorized actions.

📦 Backends

🛠️ CLI Management

Manage users directly from the shell. Useful for CI/CD or admin tasks.

# Create a new launcher
dagster-authkit add-user bob --role launcher

# Reset password
dagster-authkit change-password bob

# List everyone
dagster-authkit list-users

# View RBAC permissions matrix
dagster-authkit list-permissions

🔮 Roadmap

Current (v0.4.0)

• ✅ Username/password auth (bcrypt)
• ✅ 4-level RBAC (ADMIN/EDITOR/LAUNCHER/VIEWER)
• ✅ SQLite, PostgreSQL, MySQL, Redis support
• ✅ GraphQL mutation blocking with official AST parser
• ✅ LDAP backend (experimental)
• ✅ Proxy authentication (Authelia, Caddy, Traefik)
• ✅ Kubernetes example with full SSO stack
• ✅ Redis session revocation and rate limiting
• ✅ Centralized UI templates
• ✅ CSRF protection
• ✅ Cross-pod session revocation (DB-backed session_version)
• ✅ WebSocket authentication (GraphQL subscriptions)
• ✅ Dual rate-limiting (username + IP)
• ✅ Proxy trusted IP allowlist

Next

• 🔄 Helm chart for Kubernetes deployments
• 🔄 OIDC backend (beyond proxy mode)

What we will NOT do:

• ❌ Inject React code into Dagster UI (too brittle)
• ❌ Complex enterprise features (that's what Dagster+ is for)

🤝 Contributing

Found a bug? Want to add a feature? Open a PR. If it works and keeps things simple, we'll merge it.

Especially needed:

• People with Active Directory experience to validate the LDAP backend
• Testing on different Dagster versions
• Helm chart contributions

📄 License

Apache 2.0 - see LICENSE

🙏 Credits

Built by Demetrius Albuquerque because self-hosting Dagster shouldn't mean no auth.

Inspired by the community's need for a middle ground between "no auth" and "pay for Dagster+".