Airflow 3 LDAP Authentication
You set up airflow 3 ldap authentication by linking your web server to your directory. The app checks user names and passwords against your central user list at log in. Most data teams use a service account to search the directory tree for matching users. When teams map directory groups to broad app roles, too many engineers get full admin power. How airflow 3 ldap authentication works in practice The workflow uses an auth manager inside the web server to handle each user log in. When a perso
Multi-Factor Authentication (MFA) + LDAP Directory Services: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up airflow 3 ldap authentication by linking your web server to your directory. The app checks user names and passwords against your central user list at log in. Most data teams use a service account to search the directory tree for matching users. When teams map directory groups to broad app roles, too many engineers get full admin power.
How airflow 3 ldap authentication works in practice
The workflow uses an auth manager inside the web server to handle each user log in. When a person types a password, the server opens a secure link to your directory host. A dedicated bind account searches your user tree to find the right person by name. After the directory finds the user, it checks the password against the stored record.
Next, the server reads the group memberships attached to that user record in the directory. You define rules that map each directory group to a specific role inside the app. For example, an engineering group can map to a viewer role or an operator role. A small platform group can map to the admin role to manage system settings. The server updates these roles at each log in so directory changes take effect fast. You must also enable TLS on the directory link so passwords do not travel in plain text.
Group mapping for teams and roles
Good group mapping keeps daily workflow tasks separate from system admin work. Many teams start by giving all developers the main operator role so they can test pipelines. That choice lets any user read stored database secrets or change shared system variables. Instead, you should create narrow roles that match the specific jobs of each team.
Your directory groups should reflect who can view logs and who can trigger runs. When someone leaves the team, you remove them from the directory group right away. The next time their session refreshes, the web server drops their old permissions. Still, even strict role mapping only controls what buttons a user can click in the browser.
Multi-Factor Authentication (MFA) + LDAP Directory Services: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native directory log in solves and what it misses
Central directory log in solves the problem of managing separate user lists across many tools. You get one place to turn off accounts when an engineer changes jobs or leaves. You also make sure every user follows the password rules set by your security team. This setup decides who can enter the web app and which screens they can see.
Still, directory log in does not control what happens inside your databases or hosts during a run. Once an engineer can trigger a task or open a shell, the directory check is over. The app uses stored database keys to run SQL queries or shell commands on remote servers. Native directory rules cannot inspect individual SQL statements or stop a risky query in flight. They also cannot mask emails, phone numbers, card numbers, or national IDs in query results. If a task or user runs a broad query, raw sensitive data appears in the output. You also lack a unified audit log that ties each database query to a real person.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
How do directory groups map to roles in the web server?
The web server queries the member attribute on the user record during log in. It matches those group names against your role map and assigns the matching app role.
What happens when a user leaves a directory group?
The server checks group membership again the next time the user logs in. It removes the old role from the user profile so their access matches the directory.
Does directory log in secure the database keys stored in the app?
No, directory log in only verifies the user at the web screen. Users with broad app roles can still read stored keys or run tasks that query raw data.