Skip to content

Proxy Backend

dagster_authkit.auth.backends.proxy

Proxy Authentication Backend (Authelia Forward Auth)

Reads authentication headers set by upstream reverse proxy (Authelia). Does NOT handle sessions, passwords, or rate limiting - that's Authelia's job.

Expected Headers (Authelia defaults): - Remote-User: username - Remote-Groups: comma-separated groups (e.g., "cn=admins,ou=groups,dc=company,dc=com") - Remote-Email: user email - Remote-Name: full name

Group → Role Mapping: Configure via DAGSTER_AUTH_PROXY_GROUP_PATTERN: cn={role},ou=groups,dc=company,dc=com

Examples:

  • cn=admins,ou=groups,dc=company,dc=com → Role.ADMIN
  • cn=editors,ou=groups,dc=company,dc=com → Role.EDITOR
  • cn=launchers,ou=groups,dc=company,dc=com → Role.LAUNCHER
  • cn=viewers,ou=groups,dc=company,dc=com → Role.VIEWER

If DAGSTER_AUTH_PROXY_GROUP_PATTERN is not set, falls back to simple matching: - "admins" → Role.ADMIN - "editors" → Role.EDITOR - etc.

ProxyAuthBackend

Bases: AuthBackend

Proxy-based authentication for Authelia/Traefik forward auth.

ALL configuration comes from dagster_authkit.utils.config. No config parsing here - just uses what's already loaded.

__init__ 

__init__(config)

Initialise proxy backend with header name mappings and group-to-role pattern.

Parameters:

Name Type Description Default
config Dict[str, Any]

Dict from AuthConfig containing proxy header names, group pattern, and trusted IP settings.

 required

authenticate 

authenticate(username, password)

NOT USED in proxy mode. Authentication happens at Authelia, not here.

Raises:

Type Description
NotImplementedError

Always (passwords handled by Authelia)

get_user 

get_user(username)

NOT USED in proxy mode. User data comes from HTTP headers, not database lookups.

Raises:

Type Description
NotImplementedError

Always (user data from headers)

get_user_from_headers 

get_user_from_headers(headers)

Extracts user from HTTP headers set by Authelia.

This is the MAIN method used by the middleware in proxy mode.

Parameters:

Name Type Description Default
headers Dict[str, str]

HTTP headers dict (case-insensitive)

 required

Returns:

Type Description
Optional[AuthUser]

AuthUser if headers valid, None if missing required headers
Example

headers = { "Remote-User": "john", "Remote-Groups": "cn=admins,ou=groups,dc=company,dc=com", "Remote-Email": "john@company.com", "Remote-Name": "John Doe" } user = backend.get_user_from_headers(headers)

Returns: AuthUser(username="john", role=Role.ADMIN, ...)

add_user 

add_user(*args, **kwargs)

Not supported - users managed in Authelia/LDAP.

delete_user 

delete_user(*args, **kwargs)

Not supported - users managed in Authelia/LDAP.

change_password 

change_password(*args, **kwargs)

Not supported - passwords managed in Authelia/LDAP.

list_users 

list_users()

Not supported - query LDAP directly.

change_role 

change_role(*args, **kwargs)

Not supported - roles managed via LDAP groups.