Remove default as auth backend

airflow/api/__init__.py

@@ -23,18 +23,14 @@
 from importlib import import_module
 
 from airflow.configuration import conf
-from airflow.exceptions import AirflowConfigException, AirflowException
+from airflow.exceptions import AirflowException
 
 log = logging.getLogger(__name__)
 
 
 def load_auth():
     """Load authentication backends."""
-    auth_backends = "airflow.api.auth.backend.default"
-    try:
-        auth_backends = conf.get("api", "auth_backends")
-    except AirflowConfigException:
-        pass
+    auth_backends = conf.get("api", "auth_backends")
 
     backends = []
     try:

airflow/config_templates/config.yml

@@ -1377,12 +1377,11 @@ api:
       description: |
         Comma separated list of auth backends to authenticate users of the API. See
         `Security: API
-        <https://airflow.apache.org/docs/apache-airflow/stable/security/api.html>`__ for possible values.
-        ("airflow.api.auth.backend.default" allows all requests for historic reasons)
+        <https://airflow.apache.org/docs/apache-airflow/stable/security/api.html>`__ for possible values
       version_added: 2.3.0
       type: string
       example: ~
-      default: "airflow.api.auth.backend.session"
+      default: "airflow.providers.fab.auth_manager.api.auth.backend.session"
     maximum_page_limit:
       description: |
         Used to set the maximum page limit for API requests. If limit passed as param

airflow/config_templates/unit_tests.cfg

@@ -71,7 +71,7 @@ celery_logging_level = INFO
 smtp_mail_from = airflow@example.com
 
 [api]
-auth_backends = airflow.api.auth.backend.default
+auth_backends = airflow.providers.fab.auth_manager.api.auth.backend.session
 
 [hive]
 # Hive uses the configuration below to run the tests

airflow/configuration.py

@@ -670,11 +670,11 @@ def _upgrade_auth_backends(self):
         This is required by the UI for ajax queries.
         """
         old_value = self.get("api", "auth_backends", fallback="")
-        if old_value in ("airflow.api.auth.backend.default", ""):
-            # handled by deprecated_values
-            pass
-        elif old_value.find("airflow.api.auth.backend.session") == -1:
-            new_value = old_value + ",airflow.api.auth.backend.session"
+        if (
+            old_value.find("airflow.api.auth.backend.session") == -1
+            and old_value.find("airflow.providers.fab.auth_manager.api.auth.backend.session") == -1
+        ):
+            new_value = old_value + ",airflow.providers.fab.auth_manager.api.auth.backend.session"
             self._update_env_var(section="api", name="auth_backends", new_value=new_value)
             self.upgraded_values[("api", "auth_backends")] = old_value
 

airflow/www/extensions/init_security.py

@@ -20,7 +20,7 @@
 from importlib import import_module
 
 from airflow.configuration import conf
-from airflow.exceptions import AirflowConfigException, AirflowException
+from airflow.exceptions import AirflowException
 
 log = logging.getLogger(__name__)
 
@@ -46,11 +46,7 @@ def apply_caching(response):
 
 def init_api_auth(app):
     """Load authentication backends."""
-    auth_backends = "airflow.api.auth.backend.default"
-    try:
-        auth_backends = conf.get("api", "auth_backends")
-    except AirflowConfigException:
-        pass
+    auth_backends = conf.get("api", "auth_backends")
 
     app.api_auth = []
     try:

newsfragments/43096.significant.rst

@@ -0,0 +1 @@
+Removed auth backend ``airflow.api.auth.backend.default``

tests/core/test_configuration.py

@@ -664,7 +664,7 @@ def test_auth_backends_adds_session(self):
                 test_conf.validate()
                 assert (
                     test_conf.get("api", "auth_backends")
-                    == "airflow.providers.fab.auth_manager.api.auth.backend.basic_auth,airflow.api.auth.backend.session"
+                    == "airflow.providers.fab.auth_manager.api.auth.backend.basic_auth,airflow.providers.fab.auth_manager.api.auth.backend.session"
                 )
 
     def test_command_from_env(self):