joshua-cogliati-inl commented on issue #70251: URL: https://github.com/apache/airflow/issues/70251#issuecomment-5049348383
Note that if you need a workaround, something like this might work: ```bash #!/usr/bin/env bash set -euo pipefail kcadm=/opt/keycloak/bin/kcadm.sh server=http://keycloak:8080 realm=airflow "$kcadm" config credentials --server "$server" --realm master \ --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD" # `airflow keycloak-auth-manager create-team` seeds a "ReadOnly-<team>" # permission that aggregates one policy per role (Op/Viewer/User/Admin) with # decisionStrategy=UNANIMOUS. Unanimous requires every attached policy to # vote PERMIT, but the four role-policies are mutually exclusive # alternatives (a user only ever holds one role) -- so no non-omni-role user # can ever satisfy all four, and ReadOnly-<team> always denies for anyone # who isn't also independently covered by a different, non-Unanimous # permission (e.g. Admin). Patch it to AFFIRMATIVE: any one qualifying role # should be sufficient for read access. airflow_client_id=$("$kcadm" get clients -r "$realm" -q clientId=airflow --fields id --format csv --noquotes | head -n 1) test -n "$airflow_client_id" fix_permission() { local perm_name=$1 local perm_id perm_id=$("$kcadm" get "clients/$airflow_client_id/authz/resource-server/permission" -r "$realm" \ -q "name=$perm_name" --fields id --format csv --noquotes | head -n 1) if [[ -z "$perm_id" ]]; then echo "Skipping $perm_name: not found (team may not exist yet)" return fi "$kcadm" update "clients/$airflow_client_id/authz/resource-server/permission/scope/$perm_id" -r "$realm" \ -s decisionStrategy=AFFIRMATIVE echo "Patched $perm_name to AFFIRMATIVE" } # Extend this list if you add more teams. fix_permission "ReadOnly-team-analytics" echo "Keycloak permission decision strategies patched." ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
