ad-m commented on a change in pull request #9848: URL: https://github.com/apache/airflow/pull/9848#discussion_r458736394
########## File path: docs/security.rst ########## @@ -99,6 +99,56 @@ To enable Kerberos authentication, set the following in the configuration: The Kerberos service is configured as ``airflow/fully.qualified.domainname@REALM``. Make sure this principal exists in the keytab file. +You can also configure +`Google OpenID <https://developers.google.com/identity/protocols/oauth2/openid-connect>`__ +for authorization. To enable it, set the following option in the configuration: + +.. code-block:: ini + + [api] + auth_backend = airflow.providers.google.common.auth_backend.google_openid + +It is also highly recommended to configure an OAuth2 audience so that the generated used tokens can only Review comment: ```suggestion It is also highly recommended to configure an OAuth2 audience so that the generated tokens are restricted to use by Airflow only. ``` ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
