 .. Licensed to the Apache Software Foundation (ASF) under one
    or more contributor license agreements.  See the NOTICE file
    distributed with this work for additional information
    regarding copyright ownership.  The ASF licenses this file
    to you under the Apache License, Version 2.0 (the
    "License"); you may not use this file except in compliance
    with the License.  You may obtain a copy of the License at

 ..   http://www.apache.org/licenses/LICENSE-2.0

 .. Unless required by applicable law or agreed to in writing,
    software distributed under the License is distributed on an
    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    KIND, either express or implied.  See the License for the
    specific language governing permissions and limitations
    under the License.

=====================
Keycloak auth manager
=====================

.. warning::
  The Keycloak auth manager is alpha/experimental at the moment and may be subject to change without warning.

The Keycloak auth manager is an authentication and authorization manager that uses Keycloak as the identity provider.
It enables you to manage users, roles, groups, and permissions entirely within Keycloak.

**Getting started**

.. toctree::
    :maxdepth: 2

    setup/env
    setup/config

**Manage the environment**

.. toctree::
    :maxdepth: 2

    manage/users
    manage/permissions

**Generate a JWT token to use Airflow public API**

.. toctree::
    :maxdepth: 2

    token

**Setup client Access/Login Settings**

.. toctree::
    :maxdepth: 2

    manage/login

**Note on Multi Team Clients**
When using the Keycloak auth manager with a multi-team deployment, you will need to keep the keycloak client up to date by creating the required policies and resources for each new team that is added.

If a team has dags added to Airflow but they are not setup in the keycloak client, keycloak will return a 400 error on the ``/dags`` screen:
``{"error":"invalid_resource", "error_description": "Resource with id [Dag:team-a] does not exist."}``
The keycloak auth manager will handle this error by registering it as a 'deny' response to preserve access to the ``/dags`` screen for other teams.
