Community authentication wrapper for self-hosted Dagster OSS.
Authentication, RBAC, and Audit logs for Dagster without touching internal code.
Dagster OSS has no auth. If you run it in a VPC or locally, anyone with the URL has full admin access.
AuthKit solves this by wrapping the dagster-webserver command to add:
- ✅ Login Interface: Simple username/password flow.
- ✅ RBAC (4 Levels): Granular control over who can do what.
- ✅ Audit Logs: JSON logs for monitoring who is doing what.
- ✅ Multi-Backend: Works with SQLite, Postgres, MySQL (via Peewee ORM) and Redis.
No code changes required. You don't touch your repository.py or dagster.yaml.
- Production-ready Kubernetes chart under
helm/dagster-authkit/, synced with the application's config (env vars, secrets, image tag) and versioned automatically by semantic-release. Requires an explicitimage.tag.
CHANGELOG.mdis now auto-generated by semantic-release on each release, alongside the version bump. Versions are inserted above the<!-- version list -->marker.- RBAC deny-by-default — unknown GraphQL mutations require
ADMINby default.
- Rebuild of the fix backlog from v0.4.2 across CSRF (per-client double-submit), fail-closed GraphQL batches, token-gated
/auth/metrics, Redis 6-compatible atomic rate limiting, LDAP connection cleanup, session revoked-token caps, and detection-layer StarletteMiddleware.clscompatibility. - Test coverage boosted 44% → 52% (+98 tests: detection layer, rate limiter, metrics gate, CookieBackend, CLI, LDAP, middleware).
- Set
DAGSTER_AUTH_SECRET_KEYin your environment. Generate one with:python -c 'import secrets; print(secrets.token_urlsafe(32))' - If using proxy mode, set
DAGSTER_AUTH_PROXY_TRUSTED_IPSto your proxy's IP address. - Database migration happens automatically on first boot — no manual steps needed for SQLite/Postgres/MySQL. A
session_versioncolumn is added to theuserstable. - Role serialization changed from string (
"ADMIN") to int (40) in session cookies. Existing sessions continue to work (backward-compatiblefrom_dict).
We provide ready-to-use stacks for different scenarios in the examples/ directory:
examples
├── authelia # NEW! Authelia + Caddy + LDAP SSO (Docker)
│ ├── Makefile
│ ├── docker-compose.yml
│ ├── Caddyfile
│ └── authelia/
├── kubernetes # NEW! Minikube deployment
│ ├── Makefile
│ └── k8s/
├── ldap # Active Directory integration (**Experimental**)
│ ├── Makefile
│ ├── docker-compose.yml
│ └── ldap-bootstrap.ldif
├── postgresql_redis # Recommended production setup
│ ├── Makefile
│ └── docker-compose.yml
└── quickstart-sqlite # Simple local testing
├── Makefile
└── docker-compose.ymlPick a scenario, go into the folder, and check the Makefile.
1. Authelia SSO (Docker) Complete SSO with Authelia, Caddy, and OpenLDAP:
cd examples/authelia
make up
# Access: https://auth.company.com (admin/password123)
# Then: https://dagster.company.com2. Kubernetes (Minikube) Same stack running on Kubernetes:
cd examples/kubernetes
make build # Build the Docker image inside Minikube
make up # Deploy everything
# In another terminal: make connect (runs minikube tunnel)
# Add to /etc/hosts: $(minikube ip) auth.company.com dagster.company.com3. Standard Setup (Postgres + Redis)
cd examples/postgresql_redis
make up4. Local Quickstart (SQLite)
cd examples/quickstart-sqlite
make up5. LDAP/AD Testing
cd examples/ldap
make upIf you aren't using Docker, you can install via pip.
# For local testing (SQLite)
pip install dagster-authkit[sqlite]
# For server usage (Postgres + Redis recommended)
pip install dagster-authkit[postgresql,redis]
# For LDAP/Active Directory integration (**Experimental**)
pip install dagster-authkit[ldap]
Usage:
# Initialize the database and create the first admin
dagster-authkit init-db --with-admin
# Run Dagster (replaces the standard 'dagster-webserver' command)
dagster-authkit -f your_pipeline.py -h 0.0.0.0 -p 3000
# For proxy mode (Authelia/OAuth2 Proxy)
export DAGSTER_AUTH_BACKEND=proxy
export DAGSTER_AUTH_PROXY_LOGIN_URL=https://auth.yourcompany.com
dagster-authkit -f your_pipeline.py -h 0.0.0.0 -p 3000Deploy on Kubernetes via the Helm chart in helm/dagster-authkit/:
helm upgrade --install dagster-authkit ./helm/dagster-authkit \
--set image.tag="$(git describe --tags --abbrev=0)" \
--set authkit.secretKey="$(python -c 'import secrets; print(secrets.token_urlsafe(32))')" \
--set authkit.adminPassword="your-admin-password"See values.yaml for all configuration options.
We provide 4 levels of access. Permissions are enforced via GraphQL query analysis.
| Role | Description |
|---|---|
| Admin | Full access. Can manage users, settings, and all pipelines. |
| Editor | Can modify assets and codebase (if allowed) and manage runs. |
| Launcher | Can launch runs and re-execute jobs, but cannot modify code/assets. |
| Viewer | Read-only. Can view runs and assets. GraphQL mutations are blocked. |
How it works: AuthKit analyzes GraphQL queries using the official GraphQL parser to accurately identify mutations and block unauthorized actions.
| Backend | Implementation | Status | Use Case |
|---|---|---|---|
| SQLite | Peewee ORM | Stable | Local / Simple. Single instance only. |
| PostgreSQL | Peewee + psycopg2 |
Stable | Production. Recommended for Docker/K8s. |
| MySQL/MariaDB | Peewee + mysql-connector |
Stable | Production. |
| Redis | Native redis |
Stable | Session Storage + Distributed Rate Limiting. |
| LDAP | ldap3 library |
Experimental | Active Directory / OpenLDAP. Community maintained. |
| Proxy | Header-based | Stable | Authelia, OAuth2 Proxy, Traefik, Caddy. |
| OpenID Connect | Header-based | Experimental | AuthKit supports OIDC providers (Google, GitHub, Okta, Keycloak) via Authelia |
Manage users directly from the shell. Useful for CI/CD or admin tasks.
# Create a new launcher
dagster-authkit add-user bob --launcher
# Reset password
dagster-authkit change-password bob
# List everyone
dagster-authkit list-users
# View RBAC permissions matrix
dagster-authkit list-permissions- ✅ Username/password auth (bcrypt)
- ✅ 4-level RBAC (ADMIN/EDITOR/LAUNCHER/VIEWER)
- ✅ SQLite, PostgreSQL, MySQL, Redis support
- ✅ GraphQL mutation blocking with official AST parser
- ✅ LDAP backend (experimental)
- ✅ Proxy authentication (Authelia, Caddy, Traefik)
- ✅ Kubernetes example with full SSO stack
- ✅ Helm chart for Kubernetes deployments
- ✅ Redis session revocation and rate limiting
- ✅ Centralized UI templates
- ✅ CSRF protection
- ✅ Cross-pod session revocation (DB-backed
session_version) - ✅ WebSocket authentication (GraphQL subscriptions)
- ✅ Dual rate-limiting (username + IP)
- ✅ Proxy trusted IP allowlist
- ✅ Token-protected
/auth/metrics - ✅ Automated
CHANGELOG.mdgeneration
- 🔄 OIDC backend (beyond proxy mode)
What we will NOT do:
- ❌ Inject React code into Dagster UI (too brittle)
- ❌ Complex enterprise features (that's what Dagster+ is for)
Found a bug? Want to add a feature? Open a PR. If it works and keeps things simple, we'll merge it.
Especially needed:
- People with Active Directory experience to validate the LDAP backend
- Testing on different Dagster versions
- Helm chart contributions
Apache 2.0 - see LICENSE
Built by Demetrius Albuquerque because self-hosting Dagster shouldn't mean no auth.
Inspired by the community's need for a middle ground between "no auth" and "pay for Dagster+".