Skip to content

🛡️ Dagster AuthKit

Python Version Build Status License Coverage PyPI Version Downloads

Community authentication wrapper for self-hosted Dagster OSS.

Authentication, RBAC, and Audit logs for Dagster without touching internal code.

🎯 What is this?

Dagster OSS has no auth. If you run it in a VPC or locally, anyone with the URL has full admin access.

AuthKit solves this by wrapping the dagster-webserver command to add:

  • ✅ Login Interface: Simple username/password flow.
  • ✅ RBAC (4 Levels): Granular control over who can do what.
  • ✅ Audit Logs: JSON logs for monitoring who is doing what.
  • ✅ Multi-Backend: Works with SQLite, Postgres, MySQL (via Peewee ORM) and Redis.

No code changes required. You don't touch your repository.py or dagster.yaml.

✨ What's New in v1.0.0

☸️ Helm Chart

  • Production-ready Kubernetes chart under helm/dagster-authkit/, synced with the application's config (env vars, secrets, image tag) and versioned automatically by semantic-release. Requires an explicit image.tag.

🔄 Automated CHANGELOG

  • CHANGELOG.md is now auto-generated by semantic-release on each release, alongside the version bump. Versions are inserted above the <!-- version list --> marker.
  • RBAC deny-by-default — unknown GraphQL mutations require ADMIN by default.

🔐 Hardening & Fixes

  • Rebuild of the fix backlog from v0.4.2 across CSRF (per-client double-submit), fail-closed GraphQL batches, token-gated /auth/metrics, Redis 6-compatible atomic rate limiting, LDAP connection cleanup, session revoked-token caps, and detection-layer Starlette Middleware.cls compatibility.
  • Test coverage boosted 44% → 52% (+98 tests: detection layer, rate limiter, metrics gate, CookieBackend, CLI, LDAP, middleware).

⚠️ Upgrading from v0.3.x

  1. Set DAGSTER_AUTH_SECRET_KEY in your environment. Generate one with: 
    python -c 'import secrets; print(secrets.token_urlsafe(32))'
  2. If using proxy mode, set DAGSTER_AUTH_PROXY_TRUSTED_IPS to your proxy's IP address.
  3. Database migration happens automatically on first boot — no manual steps needed for SQLite/Postgres/MySQL. A session_version column is added to the users table.
  4. Role serialization changed from string ("ADMIN") to int (40) in session cookies. Existing sessions continue to work (backward-compatible from_dict).

📂 Ready-to-Run Examples

We provide ready-to-use stacks for different scenarios in the examples/ directory:

examples
├── authelia              # NEW! Authelia + Caddy + LDAP SSO (Docker)
│   ├── Makefile
│   ├── docker-compose.yml
│   ├── Caddyfile
│   └── authelia/
├── kubernetes            # NEW! Minikube deployment
│   ├── Makefile
│   └── k8s/
├── ldap                  # Active Directory integration (**Experimental**)
│   ├── Makefile
│   ├── docker-compose.yml
│   └── ldap-bootstrap.ldif
├── postgresql_redis      # Recommended production setup
│   ├── Makefile
│   └── docker-compose.yml
└── quickstart-sqlite     # Simple local testing
    ├── Makefile
    └── docker-compose.yml

How to run

Pick a scenario, go into the folder, and check the Makefile.

1. Authelia SSO (Docker) Complete SSO with Authelia, Caddy, and OpenLDAP: 

cd examples/authelia
make up
# Access: https://auth.company.com (admin/password123)
# Then:   https://dagster.company.com

2. Kubernetes (Minikube) Same stack running on Kubernetes: 

cd examples/kubernetes
make build  # Build the Docker image inside Minikube
make up     # Deploy everything
# In another terminal: make connect (runs minikube tunnel)
# Add to /etc/hosts: $(minikube ip) auth.company.com dagster.company.com

3. Standard Setup (Postgres + Redis) 

cd examples/postgresql_redis
make up

4. Local Quickstart (SQLite) 

cd examples/quickstart-sqlite
make up

5. LDAP/AD Testing ⚠️ EXPERIMENTAL 

cd examples/ldap
make up

🚀 Manual Installation (Python)

If you aren't using Docker, you can install via pip.

# For local testing (SQLite)
pip install dagster-authkit[sqlite]

# For server usage (Postgres + Redis recommended)
pip install dagster-authkit[postgresql,redis]

# For LDAP/Active Directory integration (**Experimental**)
pip install dagster-authkit[ldap]

Usage:

# Initialize the database and create the first admin
dagster-authkit init-db --with-admin

# Run Dagster (replaces the standard 'dagster-webserver' command)
dagster-authkit -f your_pipeline.py -h 0.0.0.0 -p 3000

# For proxy mode (Authelia/OAuth2 Proxy)
export DAGSTER_AUTH_BACKEND=proxy
export DAGSTER_AUTH_PROXY_LOGIN_URL=https://auth.yourcompany.com
dagster-authkit -f your_pipeline.py -h 0.0.0.0 -p 3000

☸️ Helm (Kubernetes)

Deploy on Kubernetes via the Helm chart in helm/dagster-authkit/:

helm upgrade --install dagster-authkit ./helm/dagster-authkit \
  --set image.tag="$(git describe --tags --abbrev=0)" \
  --set authkit.secretKey="$(python -c 'import secrets; print(secrets.token_urlsafe(32))')" \
  --set authkit.adminPassword="your-admin-password"

See values.yaml for all configuration options.

🔐 Roles (RBAC)

We provide 4 levels of access. Permissions are enforced via GraphQL query analysis.

Role Description
Admin Full access. Can manage users, settings, and all pipelines.
Editor Can modify assets and codebase (if allowed) and manage runs.
Launcher Can launch runs and re-execute jobs, but cannot modify code/assets.
Viewer Read-only. Can view runs and assets. GraphQL mutations are blocked.

How it works: AuthKit analyzes GraphQL queries using the official GraphQL parser to accurately identify mutations and block unauthorized actions.

📦 Backends

Backend Implementation Status Use Case
SQLite Peewee ORM Stable Local / Simple. Single instance only.
PostgreSQL Peewee + psycopg2 Stable Production. Recommended for Docker/K8s.
MySQL/MariaDB Peewee + mysql-connector Stable Production.
Redis Native redis Stable Session Storage + Distributed Rate Limiting.
LDAP ldap3 library Experimental Active Directory / OpenLDAP. Community maintained.
Proxy Header-based Stable Authelia, OAuth2 Proxy, Traefik, Caddy.
OpenID Connect Header-based Experimental AuthKit supports OIDC providers (Google, GitHub, Okta, Keycloak) via Authelia
---

🛠️ CLI Management

Manage users directly from the shell. Useful for CI/CD or admin tasks.

# Create a new launcher
dagster-authkit add-user bob --launcher

# Reset password
dagster-authkit change-password bob

# List everyone
dagster-authkit list-users

# View RBAC permissions matrix
dagster-authkit list-permissions

🔮 Roadmap

Current (v1.0.0)

  • ✅ Username/password auth (bcrypt)
  • ✅ 4-level RBAC (ADMIN/EDITOR/LAUNCHER/VIEWER)
  • ✅ SQLite, PostgreSQL, MySQL, Redis support
  • ✅ GraphQL mutation blocking with official AST parser
  • ✅ LDAP backend (experimental)
  • ✅ Proxy authentication (Authelia, Caddy, Traefik)
  • ✅ Kubernetes example with full SSO stack
  • ✅ Helm chart for Kubernetes deployments
  • ✅ Redis session revocation and rate limiting
  • ✅ Centralized UI templates
  • ✅ CSRF protection
  • ✅ Cross-pod session revocation (DB-backed session_version)
  • ✅ WebSocket authentication (GraphQL subscriptions)
  • ✅ Dual rate-limiting (username + IP)
  • ✅ Proxy trusted IP allowlist
  • ✅ Token-protected /auth/metrics
  • ✅ Automated CHANGELOG.md generation

Next

  • 🔄 OIDC backend (beyond proxy mode)

What we will NOT do:

  • ❌ Inject React code into Dagster UI (too brittle)
  • ❌ Complex enterprise features (that's what Dagster+ is for)

🤝 Contributing

Found a bug? Want to add a feature? Open a PR. If it works and keeps things simple, we'll merge it.

Especially needed:

  • People with Active Directory experience to validate the LDAP backend
  • Testing on different Dagster versions
  • Helm chart contributions

📄 License

Apache 2.0 - see LICENSE

🙏 Credits

Built by Demetrius Albuquerque because self-hosting Dagster shouldn't mean no auth.

Inspired by the community's need for a middle ground between "no auth" and "pay for Dagster+".