Provision a User with a Role

Provision a User with a Role

Create a role if needed, then create a user assigned to it and verify.

1. List the deployment's permission catalog so the role's action and resource names are drawn from what this Airflow actually offers rather than guessed.
2. Look the role up by name. A 200 means it already exists and the user can be bound straight to it; a 404 means it must be created first. Both are expected outcomes.
3. Create the role with the requested action/resource pairs before any user is attached to it.
4. Create the user with the role attached at creation time, so the account never exists in an unintended permission state.
5. Read the user back and require the account to be active, returning the roles Airflow actually recorded against it.

What you'll need to have ready

• roleName: The role to bind the user to (e.g. "PipelineViewer").
• roleActions: The action/resource pairs granted to the role when it must be created, each shaped as {"action": {"name": "can_read"}, "resource": {"name": "DAGs"}}. Valid name
• username: The login name for the new user.
• email: The user's email address, which must be unique in the deployment.
• firstName: The user's given name.
• lastName: The user's family name.
• password: The initial password. Airflow stores it hashed and never returns it on read.

For your developer

Arazzo workflow apache-airflow:provision-user, 5 operations: get_permissions → get_role → post_role → post_user → get_user. Specs on APIs.io.