wilsonjefferson commented on issue #71277:
URL: https://github.com/apache/airflow/issues/71277#issuecomment-5218506140

   **Update: root cause is in the Keycloak provider's `create-all` CLI, not 
Airflow core.**
   
   Airflow's team filtering works correctly — `get_authorized_dag_ids` groups 
Dags by team, `filter_authorized_dag_ids` passes `team_name` through, and 
`_is_authorized` builds per-team resource names (`Dag:team-a#LIST`). The 
problem is the Keycloak config that
   `create-all --teams` generates.
   
   **1. `ReadOnly` has no resource binding.** 
   It's created scope-based with `resources: []`, scopes `GET/LIST/MENU`, and 
role-only policies. An unbound scope-based permission matches *every* resource 
carrying those scopes, including `Dag:team-b`. So it shadows the correctly 
built `ReadOnly-team-b` (aggregate role+group, UNANIMOUS) and grants on role 
alone.
   
   *Fix:* set `resources` on `ReadOnly` to the non-team resources only. 
Isolation then works in both directions — verified with two users in different 
teams.
   
   **2. The four roles are created flat, but permissions assume a hierarchy.** 
   `Admin` covers only `*:team-*` resources; global `Dag` is covered by `User`, 
and global `Variable`/`Pool`/ `Connection` by `Op`. So an Admin-only user gets 
403 on global resources:
   `PATCH /api/v2/dags/check_dag_running (team-a) → 200
   PATCH /api/v2/dags/test_dag (shared, no team) → 403
   PATCH /api/v2/variables/shared_var (global) → 403`
   
   Contradicts "Resources without a team assignment are considered global and 
accessible to all teams."
   
   *Fix:* assign all four roles, or make them Keycloak composites.
   
   **Decision strategy:** `create-all` doesn't set it, so it defaults to 
UNANIMOUS — under which the resource-based `Op`/`User` permissions veto 
everything (the 403s I originally hit). Under AFFIRMATIVE, problem 1 bypasses 
team scoping. Neither value is correct for the generated config.
   
   **Suggested:** bind `ReadOnly` to non-team resources under `--teams`, create 
the roles as composites, and set the resource-server decision strategy 
explicitly.
   
   Airflow 3.3.0, `apache-airflow-providers-keycloak` 0.8.2, Keycloak 26, 
Python 3.13.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to