This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 1461ddfdf8a Grant Keycloak SuperAdmin access to teamless resources
(#74640)
1461ddfdf8a is described below
commit 1461ddfdf8acbe54839c0fd4cc47599a47c31e79
Author: Ajneesh <[email protected]>
AuthorDate: Wed Oct 14 12:58:08 2026 +0530
Grant Keycloak SuperAdmin access to teamless resources (#74640)
In multi-team mode SuperAdmin is documented as the role with global admin
access across all teams, but the repaired Admin permission only covered
team-suffixed resources plus Asset, AssetAlias and Configuration. Dags,
Variables, Connections and Pools without a team assignment are checked
against their plain resource names, so a SuperAdmin received 403 when
reading or editing any of them.
---
.../src/airflow/providers/keycloak/auth_manager/cli/commands.py | 2 +-
.../keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git
a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
index 84274b220e5..40a889eb1d5 100644
---
a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
+++
b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
@@ -747,7 +747,7 @@ def _update_admin_permission_resources(
r["_id"]
for r in resources
if any(r["name"].startswith(f"{resource}:") for resource in
TEAM_SCOPED_RESOURCE_NAMES)
- or r["name"] in GLOBAL_SCOPED_RESOURCE_NAMES
+ or r["name"] in TEAM_SCOPED_RESOURCE_NAMES |
GLOBAL_SCOPED_RESOURCE_NAMES
]
existing_policy_ids = _get_permission_policy_ids(client, client_uuid,
permission_id)
diff --git
a/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
b/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
index 418db54d1ec..0a1cfab2020 100644
--- a/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
+++ b/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
@@ -527,7 +527,7 @@ class TestCommands:
client.update_client_authz_scope_permission.assert_called_once()
payload =
client.update_client_authz_scope_permission.call_args.kwargs["payload"]
assert payload["policies"] == ["superadmin-policy"]
- assert payload["resources"] == ["dag-team-a", "dag-team-b",
"asset-global"]
+ assert payload["resources"] == ["dag-global", "dag-team-a",
"dag-team-b", "asset-global"]
@patch("airflow.providers.keycloak.auth_manager.cli.commands._attach_policy_to_resource_permission")
@patch("airflow.providers.keycloak.auth_manager.cli.commands._attach_policy_to_scope_permission")
