Connecting Airflow 3 to a specific identity provider through the FAB, Keycloak or AWS auth managers, with role mapping and the configuration each provider needs.
Signing in to Airflow with Active Directory or OpenLDAP through the FAB auth manager: bind settings, TLS, mapping directory groups to Airflow roles, syncing roles at login and keeping a break-glass admin.
Using Microsoft Entra ID (formerly Azure AD) as the Airflow login with the FAB azure OAuth provider: app registration, redirect URLs under /auth, group or app role claims and mapping them to Admin, Op and Viewer.
Signing in to Airflow with Okta through the FAB okta OAuth provider: OIDC app setup, group claims, role mapping and registration of new users, plus API access for automation outside the browser.
Using Google sign-in for Airflow with the FAB google OAuth provider: restricting access to your domain, assigning roles when Google does not send groups, and the default role for new users.
Using GitHub OAuth for Airflow sign-in: the github provider in FAB, a custom role mapping from team IDs, organization restrictions and when a central identity provider is the better choice.
Using authentik as the Airflow identity provider through FAB OAuth: issuer and audience checks on the ID token, the issuer setting authentik needs, group mapping to roles, and self-hosting both together.
Using AWS IAM Identity Center for Airflow sign-in and Amazon Verified Permissions for authorization: the three setup areas, policy store schema, IdP-initiated SSO, its experimental status and when FAB is safer.
Designing Airflow roles around identity provider groups: AUTH_ROLES_MAPPING, syncing roles at every login, default roles for new users, DAG-level permissions and the auth manager methods that enforce them.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.