Remove auth backends from core Airflow

Dockerfile.ci

@@ -1017,7 +1017,6 @@ function start_api_server_with_examples(){
         return
     fi
     export AIRFLOW__CORE__LOAD_EXAMPLES=True
-    export AIRFLOW__API__AUTH_BACKENDS=airflow.providers.fab.auth_manager.api.auth.backend.session,airflow.providers.fab.auth_manager.api.auth.backend.basic_auth
     export AIRFLOW__WEBSERVER__EXPOSE_CONFIG=True
     echo
     echo "${COLOR_BLUE}Initializing database${COLOR_RESET}"

airflow/api/client/__init__.py

@@ -19,20 +19,8 @@
 
 from __future__ import annotations
 
-from airflow import api
 from airflow.api.client.local_client import Client
 
 
 def get_current_api_client() -> Client:
-    """Return current API Client based on current Airflow configuration."""
-    auth_backends = api.load_auth()
-    session = None
-    for backend in auth_backends:
-        session_factory = getattr(backend, "create_client_session", None)
-        if session_factory:
-            session = session_factory()
-        api_client = Client(
-            auth=getattr(backend, "CLIENT_AUTH", None),
-            session=session,
-        )
-    return api_client
+    return Client()

airflow/cli/cli_config.py

@@ -1570,12 +1570,6 @@ class GroupCommand(NamedTuple):
         func=lazy_load_command("airflow.cli.commands.remote_commands.provider_command.secrets_backends_list"),
         args=(ARG_OUTPUT, ARG_VERBOSE),
     ),
-    ActionCommand(
-        name="auth",
-        help="Get information about API auth backends provided",
-        func=lazy_load_command("airflow.cli.commands.remote_commands.provider_command.auth_backend_list"),
-        args=(ARG_OUTPUT, ARG_VERBOSE),
-    ),
     ActionCommand(
         name="executors",
         help="Get information about executors provided",

airflow/cli/commands/remote_commands/config_command.py

@@ -219,7 +219,11 @@ def message(self) -> str:
     ),
     ConfigChange(
         config=ConfigParameter("api", "auth_backend"),
-        renamed_to=ConfigParameter("api", "auth_backends"),
+        renamed_to=ConfigParameter("fab", "auth_backends"),
+    ),
+    ConfigChange(
+        config=ConfigParameter("api", "auth_backends"),
+        renamed_to=ConfigParameter("fab", "auth_backends"),
     ),
     # logging
     ConfigChange(

airflow/cli/commands/remote_commands/provider_command.py

@@ -194,19 +194,6 @@ def secrets_backends_list(args):
     )
 
 
-@suppress_logs_and_warning
-@providers_configuration_loaded
-def auth_backend_list(args):
-    """List all API auth backend modules at the command line."""
-    AirflowConsole().print_as(
-        data=list(ProvidersManager().auth_backend_module_names),
-        output=args.output,
-        mapper=lambda x: {
-            "api_auth_backend_module": x,
-        },
-    )
-
-
 @suppress_logs_and_warning
 @providers_configuration_loaded
 def auth_managers_list(args):

airflow/config_templates/config.yml

@@ -1364,15 +1364,6 @@ api:
       type: string
       example: ~
       default: ""
-    auth_backends:
-      description: |
-        Comma separated list of auth backends to authenticate users of the API. See
-        `Security: API
-        <https://airflow.apache.org/docs/apache-airflow/stable/security/api.html>`__ for possible values
-      version_added: 2.3.0
-      type: string
-      example: ~
-      default: "airflow.providers.fab.auth_manager.api.auth.backend.session"
     maximum_page_limit:
       description: |
         Used to set the maximum page limit for API requests. If limit passed as param

airflow/config_templates/unit_tests.cfg

@@ -71,6 +71,9 @@ celery_logging_level = INFO
 smtp_mail_from = airflow@example.com
 
 [api]
+
+
+[fab]
 auth_backends = airflow.providers.fab.auth_manager.api.auth.backend.session
 
 [hive]

airflow/configuration.py

@@ -374,13 +374,6 @@ def inversed_deprecated_sections(self):
                 "3.0",
             ),
         },
-        "api": {
-            "auth_backends": (
-                re.compile(r"^airflow\.api\.auth\.backend\.deny_all$|^$"),
-                "airflow.providers.fab.auth_manager.api.auth.backend.session",
-                "3.0",
-            ),
-        },
         "elasticsearch": {
             "log_id_template": (
                 re.compile("^" + re.escape("{dag_id}-{task_id}-{logical_date}-{try_number}") + "$"),
@@ -674,35 +667,9 @@ def validate(self):
                         version=version,
                     )
 
-        self._upgrade_auth_backends()
         self._upgrade_postgres_metastore_conn()
         self.is_validated = True
 
-    def _upgrade_auth_backends(self):
-        """
-        Ensure a custom auth_backends setting contains session.
-
-        This is required by the UI for ajax queries.
-        """
-        old_value = self.get("api", "auth_backends", fallback="")
-        if "airflow.providers.fab.auth_manager.api.auth.backend.session" not in old_value:
-            new_value = old_value + ",airflow.providers.fab.auth_manager.api.auth.backend.session"
-            self._update_env_var(section="api", name="auth_backends", new_value=new_value)
-            self.upgraded_values[("api", "auth_backends")] = old_value
-
-            # if the old value is set via env var, we need to wipe it
-            # otherwise, it'll "win" over our adjusted value
-            old_env_var = self._env_var_name("api", "auth_backend")
-            os.environ.pop(old_env_var, None)
-
-            warnings.warn(
-                "The auth_backends setting in [api] missed airflow.providers.fab.auth_manager.api.auth.backend.session "
-                "in the running config, which is needed by the UI. Please update your config before "
-                "Apache Airflow 3.0.",
-                FutureWarning,
-                stacklevel=1,
-            )
-
     def _upgrade_postgres_metastore_conn(self):
         """
         Upgrade SQL schemas.

airflow/providers_manager.py

@@ -422,7 +422,6 @@ def __init__(self):
         self._secrets_backend_class_name_set: set[str] = set()
         self._executor_class_name_set: set[str] = set()
         self._provider_configs: dict[str, dict[str, Any]] = {}
-        self._api_auth_backend_module_names: set[str] = set()
         self._trigger_info_set: set[TriggerInfo] = set()
         self._notification_info_set: set[NotificationInfo] = set()
         self._provider_schema_validator = _create_provider_info_schema_validator()
@@ -574,12 +573,6 @@ def _initialize_providers_configuration(self):
 
         conf.load_providers_configuration()
 
-    @provider_info_cache("auth_backends")
-    def initialize_providers_auth_backends(self):
-        """Lazy initialization of providers API auth_backends information."""
-        self.initialize_providers_list()
-        self._discover_auth_backends()
-
     @provider_info_cache("plugins")
     def initialize_providers_plugins(self):
         self.initialize_providers_list()
@@ -1096,14 +1089,6 @@ def _discover_secrets_backends(self) -> None:
                     if _correctness_check(provider_package, secrets_backends_class_name, provider):
                         self._secrets_backend_class_name_set.add(secrets_backends_class_name)
 
-    def _discover_auth_backends(self) -> None:
-        """Retrieve all API auth backends defined in the providers."""
-        for provider_package, provider in self._provider_dict.items():
-            if provider.data.get("auth-backends"):
-                for auth_backend_module_name in provider.data["auth-backends"]:
-                    if _correctness_check(provider_package, auth_backend_module_name + ".init_app", provider):
-                        self._api_auth_backend_module_names.add(auth_backend_module_name)
-
     def _discover_executors(self) -> None:
         """Retrieve all executors defined in the providers."""
         for provider_package, provider in self._provider_dict.items():
@@ -1237,12 +1222,6 @@ def secrets_backend_class_names(self) -> list[str]:
         self.initialize_providers_secrets_backends()
         return sorted(self._secrets_backend_class_name_set)
 
-    @property
-    def auth_backend_module_names(self) -> list[str]:
-        """Returns set of API auth backend class names."""
-        self.initialize_providers_auth_backends()
-        return sorted(self._api_auth_backend_module_names)
-
     @property
     def executor_class_names(self) -> list[str]:
         self.initialize_providers_executors()
@@ -1296,7 +1275,6 @@ def _cleanup(self):
         self._secrets_backend_class_name_set.clear()
         self._executor_class_name_set.clear()
         self._provider_configs.clear()
-        self._api_auth_backend_module_names.clear()
         self._trigger_info_set.clear()
         self._notification_info_set.clear()
         self._plugins_set.clear()

dev/breeze/src/airflow_breeze/commands/kubernetes_commands.py

@@ -1025,8 +1025,6 @@ def _deploy_helm_chart(
             "-v",
             "1",
             "--set",
-            "config.api.auth_backends=airflow.providers.fab.auth_manager.api.auth.backend.basic_auth",
-            "--set",
             "config.logging.logging_level=DEBUG",
             "--set",
             f"executor={executor}",

docs/apache-airflow-providers/howto/create-custom-providers.rst

@@ -80,9 +80,6 @@ Exposing customized functionality to the Airflow's core:
   provider provides. See :doc:`apache-airflow:administration-and-deployment/logging-monitoring/logging-tasks`
   for description of the logging handlers.
 
-* ``auth-backends`` - this field should contain the authentication backend module names for API/UI.
-  See :doc:`apache-airflow:security/api` for description of the auth backends.
-
 * ``notifications`` - this field should contain the notification classes.
   See :doc:`apache-airflow:howto/notifications` for description of the notifications.