stephen-bracken commented on issue #71499:
URL: https://github.com/apache/airflow/issues/71499#issuecomment-5442145319
From a multi-team perspective I am not sure what the value added by
evaluating auth for every dag is, as we use team level access policies and
split dags into separate sub-teams where needed. Perhaps there are other
organisations where there is a need to have fine grained permissions at the
individual dag level within teams but it feels like an anti-pattern to me.
Keycloak policies also supports resource URI wildcarding, so we could possibly
convert the resource schema to use resource type identifiers like
`/{team_name}/{resource}/{resource_id}` and `/{team_name}/{resource}/*`, which
would allow bulk authorization decisions and also deny policies on specific
dags.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
