Configuration Reference¶
This page contains the list of all available Airflow configurations for the
apache-airflow-providers-fab provider that can be set in the airflow.cfg file or using environment variables.
Note
For more information see Setting Configuration Options.
[fab]¶
This section contains configs specific to FAB provider.
access_denied_message¶
Added in version 2.1.0.
The message displayed when a user attempts to execute actions beyond their authorised privileges.
- Type:
string
- Default:
Access is Denied- Environment Variable:
AIRFLOW__FAB__ACCESS_DENIED_MESSAGE
auth_backends¶
Added in version 2.0.0.
Comma separated list of auth backends to authenticate users of the API.
- Type:
string
- Default:
airflow.providers.fab.auth_manager.api.auth.backend.session- Environment Variable:
AIRFLOW__FAB__AUTH_BACKENDS
auth_rate_limit¶
Added in version 1.0.2.
Rate limit for authentication endpoints.
- Type:
string
- Default:
5 per 40 second- Environment Variable:
AIRFLOW__FAB__AUTH_RATE_LIMIT
auth_rate_limited¶
Added in version 1.0.2.
Boolean for enabling rate limiting on authentication endpoints.
- Type:
boolean
- Default:
True- Environment Variable:
AIRFLOW__FAB__AUTH_RATE_LIMITED
auth_role_public¶
Added in version 3.6.2.
Role that Anonymous (unauthenticated) users are granted. When set, the FAB auth manager will allow access to the API server and UI without requiring a login, and anonymous requests will be treated as members of the given role. Leave empty (the default) to require authentication.
This replaces the previous AUTH_ROLE_PUBLIC setting in webserver_config.py. When
both are set, this [fab] auth_role_public config takes precedence. Setting this
config also applies the equivalent AUTH_ROLE_PUBLIC to the Flask app used by the FAB
auth manager, so all FAB auth code paths (FastAPI-based API server and legacy Flask
views) honor it consistently.
- Type:
string
- Default:
''- Environment Variable:
AIRFLOW__FAB__AUTH_ROLE_PUBLIC- Example:
Admin
cache_ttl¶
Added in version 3.2.0.
Number of seconds after which the user cache will expire to refetch updated user and permissions.
- Type:
integer
- Default:
30- Environment Variable:
AIRFLOW__FAB__CACHE_TTL
config_file¶
Added in version 2.0.0.
Path of webserver config file used for configuring the webserver parameters
- Type:
string
- Default:
{AIRFLOW_HOME}/webserver_config.py- Environment Variable:
AIRFLOW__FAB__CONFIG_FILE
custom_roles¶
JSON object mapping custom role names to lists of objects with action and
resource keys, using FAB permission names such as can_read and DAGs.
Missing roles are created with their permissions during role initialization.
Existing roles are skipped, preserving changes made through the UI or CLI.
Built-in roles are ignored. Startup initialization requires update_fab_perms.
An empty list declares no permissions; normal FAB initialization still grants
custom roles can_read on Website.
- Type:
string
- Default:
{}- Environment Variable:
AIRFLOW__FAB__CUSTOM_ROLES- Example:
{"PythonTester": [{"action": "can_read", "resource": "DAGs"}], "Analyst": []}
enable_proxy_fix¶
Added in version 2.1.0.
Enable werkzeug ProxyFix middleware for reverse proxy
- Type:
boolean
- Default:
False- Environment Variable:
AIRFLOW__FAB__ENABLE_PROXY_FIX
expose_hostname¶
Added in version 2.1.0.
Expose hostname in the web server
- Type:
string
- Default:
False- Environment Variable:
AIRFLOW__FAB__EXPOSE_HOSTNAME
proxy_fix_x_for¶
Added in version 2.1.0.
Number of values to trust for X-Forwarded-For.
See Werkzeug: X-Forwarded-For Proxy Fix for more details.
- Type:
integer
- Default:
1- Environment Variable:
AIRFLOW__FAB__PROXY_FIX_X_FOR
proxy_fix_x_host¶
Added in version 2.1.0.
Number of values to trust for X-Forwarded-Host.
See Werkzeug: X-Forwarded-For Proxy Fix for more details.
- Type:
integer
- Default:
1- Environment Variable:
AIRFLOW__FAB__PROXY_FIX_X_HOST
proxy_fix_x_port¶
Added in version 2.1.0.
Number of values to trust for X-Forwarded-Port.
See Werkzeug: X-Forwarded-For Proxy Fix for more details.
- Type:
integer
- Default:
1- Environment Variable:
AIRFLOW__FAB__PROXY_FIX_X_PORT
proxy_fix_x_prefix¶
Added in version 2.1.0.
Number of values to trust for X-Forwarded-Prefix.
See Werkzeug: X-Forwarded-For Proxy Fix for more details.
- Type:
integer
- Default:
1- Environment Variable:
AIRFLOW__FAB__PROXY_FIX_X_PREFIX
proxy_fix_x_proto¶
Added in version 2.1.0.
Number of values to trust for X-Forwarded-Proto.
See Werkzeug: X-Forwarded-For Proxy Fix for more details.
- Type:
integer
- Default:
1- Environment Variable:
AIRFLOW__FAB__PROXY_FIX_X_PROTO
session_backend¶
Added in version 2.0.0.
The type of backend used to store web session data, can be database or securecookie. For the
database backend, sessions are store in the database and they can be
managed there (for example when you reset password of the user, all sessions for that user are
deleted). For the securecookie backend, sessions are stored in encrypted cookies on the client
side. The securecookie mechanism is ‘lighter’ than database backend, but sessions are not
deleted when you reset password of the user, which means that other than waiting for expiry time,
the only way to invalidate all sessions for a user is to change secret_key and restart webserver
(which also invalidates and logs out all other user’s sessions).
When you are using database backend, make sure to keep your database session table small
by periodically running airflow db clean --table session command, especially if you have
automated API calls that will create a new session for each call rather than reuse the sessions
stored in browser cookies.
- Type:
string
- Default:
database- Environment Variable:
AIRFLOW__FAB__SESSION_BACKEND- Example:
securecookie
session_lifetime_minutes¶
Added in version 2.0.0.
The UI cookie lifetime in minutes. User will be logged out from UI after
[fab] session_lifetime_minutes of inactivity: the deadline slides forward on every
request, so it is only reached once the session has been idle for the whole period.
Note that leaving an Airflow UI tab open counts as activity even when nobody is at the
keyboard. The UI polls the API in the background and silently re-authenticates whenever
its API token expires, which keeps sliding the deadline, so a session with an open tab is
never idle and never expires. Use [fab] session_max_lifetime_minutes to log users out
after a fixed period regardless of activity.
- Type:
integer
- Default:
43200- Environment Variable:
AIRFLOW__FAB__SESSION_LIFETIME_MINUTES
session_max_lifetime_minutes¶
Added in version 3.9.0.
Maximum lifetime of a UI session in minutes, counted from the login time and never
extended by activity. Unlike [fab] session_lifetime_minutes, this deadline is
reached even when the user keeps working in the UI, so it forces periodic
re-authentication. Set to 0 (the default) to disable it.
The API tokens the UI receives are capped so that they never outlive the deadline: their
expiry is the shorter of [api_auth] jwt_expiration_time and the time left in the
session. Without that cap the deadline would only be noticed the next time the UI came
back to the auth manager — which it does when its token expires — and an already-issued
token would keep working against the API in the meantime.
This applies to UI sessions only. Tokens minted for programmatic clients by
POST /auth/token belong to no session and always last [api_auth]
jwt_expiration_time.
- Type:
integer
- Default:
0- Environment Variable:
AIRFLOW__FAB__SESSION_MAX_LIFETIME_MINUTES- Example:
480
update_fab_perms¶
Added in version 1.0.2.
Update FAB permissions and sync security manager roles on webserver startup
- Type:
string
- Default:
True- Environment Variable:
AIRFLOW__FAB__UPDATE_FAB_PERMS