dagster_authkit

dagster_authkit

dagster-authkit

Production-ready authentication and UI orchestration for Dagster OSS.

AuthBackend

Bases: ABC

Abstract base class for authentication backends.

All backends (SQLite, LDAP, OAuth, etc.) must inherit from this class and implement the abstract methods.

__init__

__init__(config)

Initializes backend with configuration.

Parameters:

Name	Type	Description	Default
config	Dict[str, Any]	Dict with settings (usually config.dict)	required

authenticate abstractmethod

authenticate(username, password)

Authenticates user with username and password.

Parameters:

Name	Type	Description	Default
username	str	Username	required
password	str	Password in plain text	required

Returns:

Type	Description
Optional[AuthUser]	AuthUser if authenticated, None if failed

get_user abstractmethod

get_user(username)

Fetches user info without authenticating.

Used for session validation (already authenticated).

Parameters:

Name	Type	Description	Default
username	str	Username	required

Returns:

Type	Description
Optional[AuthUser]	AuthUser or None if user doesn't exist

get_name abstractmethod

get_name()

Returns backend identifier.

Returns:

Name	Type	Description
str	str	Backend name (e.g., 'sqlite', 'ldap', 'dummy')

add_user

add_user(username, password, role, email='', full_name='', performed_by='system', **kwargs)

Creates a new user (OPTIONAL - only for local backends).

Parameters:

Name	Type	Description	Default
username	str	Username	required
password	str	Password in plain text (will be hashed)	required
role	Role	Role level (Role.ADMIN, Role.EDITOR, etc)	required
email	str	User's email	''
full_name	str	Display name	''
performed_by	str	Who created the user (for auditing)	'system'

Returns:

Name	Type	Description
bool	bool	True if created, False if failed

Raises:

Type	Description
NotImplementedError	If backend doesn't support it (LDAP, OAuth)

delete_user

delete_user(username, performed_by='system')

Removes a user (OPTIONAL - only for local backends).

Parameters:

Name	Type	Description	Default
username	str	Username	required
performed_by	str	Who deleted the user (for auditing)	'system'

Returns:

Name	Type	Description
bool	bool	True if deleted, False if user doesn't exist

Raises:

Type	Description
NotImplementedError	If backend doesn't support it

change_password

change_password(username, new_password, performed_by='system')

Changes a user's password (OPTIONAL - only for local backends).

Parameters:

Name	Type	Description	Default
username	str	Username	required
new_password	str	New password in plain text (will be hashed)	required
performed_by	str	Who changed it (for auditing)	'system'

Returns:

Name	Type	Description
bool	bool	True if changed, False if user doesn't exist

Raises:

Type	Description
NotImplementedError	If backend doesn't support it

list_users

list_users()

Lists all users (OPTIONAL - only for local backends).

Returns:

Type	Description
List[AuthUser]	List of AuthUser instances

Raises:

Type	Description
NotImplementedError	If backend doesn't support it

change_role

change_role(username, new_role, performed_by='system')

Changes a user's role (OPTIONAL).

Parameters:

Name	Type	Description	Default
username	str	Username	required
new_role	Role	New role level	required
performed_by	str	Who changed it (for auditing)	'system'

Returns:

Name	Type	Description
bool	bool	True if updated

Raises:

Type	Description
NotImplementedError	If backend doesn't support it

get_backend

get_backend(name, config)

Convenience function to get backend.

Parameters:

Name	Type	Description	Default
name	str	Backend name	required
config	Dict[str, Any]	Configuration	required

Returns:

Type	Description
AuthBackend	AuthBackend instance

Example

backend = get_backend('dummy', {}) user = backend.authenticate('admin', 'admin')

list_available_backends

list_available_backends()

Lists all available backends.

Returns:

Type	Description
list	List of names

Example

backends = list_available_backends() print(f"Available: {backends}")