joshua-cogliati-inl opened a new issue, #70251:
URL: https://github.com/apache/airflow/issues/70251
### Under which category would you file this issue?
Providers
### Apache Airflow version
3.3.0
### What happened and how to reproduce it?
In the docker compose file the command:
`airflow keycloak-auth-manager create-team team-analytics --username
"$${KEYCLOAK_ADMIN}" --password "$${KEYCLOAK_ADMIN_PASSWORD}"`
was used to create a team. This generated ReadOnly-team-analytics with a
decision strategy of UNANIMOUS.
However, this prevented Op and User level roles in that team from being able
to access the DAGs since only one of Allow-Op-team-analytics and
Allow-User-team-analytics was true. Essentially this is impossible, since only
one of these roles will be true, they can never be unanimous.
Manually switching the decision strategy for ReadOnly-team-analytics to
AFFIRMATIVE with the keycloak fixed the problem.
### What you think should happen instead?
This should automatically work when create-team is run.
Claude suggested the following patch:
```diff
diff --git
a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
index 705fc4eb0b..ab69caafa4 100644
---
a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
+++
b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
@@ -792,6 +792,7 @@ def _attach_team_permissions(
policy_name=_team_role_policy_name(team, "Viewer"),
scope_names=["GET", "LIST"],
resource_names=team_readable_resources,
+ decision_strategy="AFFIRMATIVE",
_dry_run=_dry_run,
)
for role_name in ("User", "Op", "Admin"):
@@ -802,6 +803,7 @@ def _attach_team_permissions(
policy_name=_team_role_policy_name(team, role_name),
scope_names=["GET", "LIST"],
resource_names=team_readable_resources,
+ decision_strategy="AFFIRMATIVE",
_dry_run=_dry_run,
)
_attach_policy_to_scope_permission(
```
### Operating System
Debian GNU/Linux 12 (bookworm)
### Deployment
Docker-Compose
### Apache Airflow Provider(s)
keycloak
### Versions of Apache Airflow Providers
apache-airflow-providers-keycloak==0.8.1
### Official Helm Chart version
Not Applicable
### Kubernetes Version
_No response_
### Helm Chart configuration
_No response_
### Docker Image customizations
_No response_
### Anything else?
I think this would occur anytime that create-team is used and someone tries
to access the DAGs with less than Admin permission.
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
