wilsonjefferson commented on issue #71277: URL: https://github.com/apache/airflow/issues/71277#issuecomment-5218506140
**Update: root cause is in the Keycloak provider's `create-all` CLI, not Airflow core.** Airflow's team filtering works correctly — `get_authorized_dag_ids` groups Dags by team, `filter_authorized_dag_ids` passes `team_name` through, and `_is_authorized` builds per-team resource names (`Dag:team-a#LIST`). The problem is the Keycloak config that `create-all --teams` generates. **1. `ReadOnly` has no resource binding.** It's created scope-based with `resources: []`, scopes `GET/LIST/MENU`, and role-only policies. An unbound scope-based permission matches *every* resource carrying those scopes, including `Dag:team-b`. So it shadows the correctly built `ReadOnly-team-b` (aggregate role+group, UNANIMOUS) and grants on role alone. *Fix:* set `resources` on `ReadOnly` to the non-team resources only. Isolation then works in both directions — verified with two users in different teams. **2. The four roles are created flat, but permissions assume a hierarchy.** `Admin` covers only `*:team-*` resources; global `Dag` is covered by `User`, and global `Variable`/`Pool`/ `Connection` by `Op`. So an Admin-only user gets 403 on global resources: `PATCH /api/v2/dags/check_dag_running (team-a) → 200 PATCH /api/v2/dags/test_dag (shared, no team) → 403 PATCH /api/v2/variables/shared_var (global) → 403` Contradicts "Resources without a team assignment are considered global and accessible to all teams." *Fix:* assign all four roles, or make them Keycloak composites. **Decision strategy:** `create-all` doesn't set it, so it defaults to UNANIMOUS — under which the resource-based `Op`/`User` permissions veto everything (the 403s I originally hit). Under AFFIRMATIVE, problem 1 bypasses team scoping. Neither value is correct for the generated config. **Suggested:** bind `ReadOnly` to non-team resources under `--teams`, create the roles as composites, and set the resource-server decision strategy explicitly. Airflow 3.3.0, `apache-airflow-providers-keycloak` 0.8.2, Keycloak 26, Python 3.13. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
