create-team in multi-team failing to allow access to team DAGs

[joshua-cogliati-inl]

Under which category would you file this issue?

Providers

Apache Airflow version

3.3.0

What happened and how to reproduce it?

In the docker compose file the command:
airflow keycloak-auth-manager create-team team-analytics --username "$${KEYCLOAK_ADMIN}" --password "$${KEYCLOAK_ADMIN_PASSWORD}"

was used to create a team. This generated ReadOnly-team-analytics with a decision strategy of UNANIMOUS.

However, this prevented Op and User level roles in that team from being able to access the DAGs since only one of Allow-Op-team-analytics and Allow-User-team-analytics was true. Essentially this is impossible, since only one of these roles will be true, they can never be unanimous.

Manually switching the decision strategy for ReadOnly-team-analytics to AFFIRMATIVE with the keycloak fixed the problem.

What you think should happen instead?

This should automatically work when create-team is run.

Claude suggested the following patch:

diff --git a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
index 705fc4eb0b..ab69caafa4 100644
--- a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
+++ b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
@@ -792,6 +792,7 @@ def _attach_team_permissions(
         policy_name=_team_role_policy_name(team, "Viewer"),
         scope_names=["GET", "LIST"],
         resource_names=team_readable_resources,
+        decision_strategy="AFFIRMATIVE",
         _dry_run=_dry_run,
     )
     for role_name in ("User", "Op", "Admin"):
@@ -802,6 +803,7 @@ def _attach_team_permissions(
             policy_name=_team_role_policy_name(team, role_name),
             scope_names=["GET", "LIST"],
             resource_names=team_readable_resources,
+            decision_strategy="AFFIRMATIVE",
             _dry_run=_dry_run,
         )
     _attach_policy_to_scope_permission(

Operating System

Debian GNU/Linux 12 (bookworm)

Deployment

Docker-Compose

Apache Airflow Provider(s)

keycloak

Versions of Apache Airflow Providers

apache-airflow-providers-keycloak==0.8.1

Official Helm Chart version

Not Applicable

Kubernetes Version

No response

Helm Chart configuration

No response

Docker Image customizations

No response

Anything else?

I think this would occur anytime that create-team is used and someone tries to access the DAGs with less than Admin permission.

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[joshua-cogliati-inl]

Note that if you need a workaround, something like this might work by extending/changing the team names at the bottom and possibly other fixes depending on your environment (The script was generated with Claude):

#!/usr/bin/env bash
set -euo pipefail

kcadm=/opt/keycloak/bin/kcadm.sh
server=http://keycloak:8080
realm=airflow

"$kcadm" config credentials --server "$server" --realm master \
  --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD"

# `airflow keycloak-auth-manager create-team` seeds a "ReadOnly-<team>"
# permission that aggregates one policy per role (Op/Viewer/User/Admin) with
# decisionStrategy=UNANIMOUS. Unanimous requires every attached policy to
# vote PERMIT, but the four role-policies are mutually exclusive
# alternatives (a user only ever holds one role) -- so no non-omni-role user
# can ever satisfy all four, and ReadOnly-<team> always denies for anyone
# who isn't also independently covered by a different, non-Unanimous
# permission (e.g. Admin). Patch it to AFFIRMATIVE: any one qualifying role
# should be sufficient for read access.
airflow_client_id=$("$kcadm" get clients -r "$realm" -q clientId=airflow --fields id --format csv --noquotes | head -n 1)
test -n "$airflow_client_id"

fix_permission() {
  local perm_name=$1
  local perm_id
  perm_id=$("$kcadm" get "clients/$airflow_client_id/authz/resource-server/permission" -r "$realm" \
    -q "name=$perm_name" --fields id --format csv --noquotes | head -n 1)

  if [[ -z "$perm_id" ]]; then
    echo "Skipping $perm_name: not found (team may not exist yet)"
    return
  fi

  "$kcadm" update "clients/$airflow_client_id/authz/resource-server/permission/scope/$perm_id" -r "$realm" \
    -s decisionStrategy=AFFIRMATIVE
  echo "Patched $perm_name to AFFIRMATIVE"
}

# Extend this list if you add more teams.
fix_permission "ReadOnly-team-analytics"

echo "Keycloak permission decision strategies patched."

[joshua-cogliati-inl]

Possible other needed patch (Op seems to be missing the ability to trigger dags, which this code suggested by Claude should fix):

diff --git a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
index ab69caafa4..b17cdc44c8 100644
--- a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
+++ b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
@@ -832,6 +832,7 @@ def _attach_team_permissions(
             f"{KeycloakResource.CONNECTION.value}:{team}",
             f"{KeycloakResource.POOL.value}:{team}",
             f"{KeycloakResource.VARIABLE.value}:{team}",
+            f"{KeycloakResource.DAG.value}:{team}",
         ],
         _dry_run=_dry_run,
     )

[joshua-cogliati-inl]

Workaround for the other Op issue (from Claude):

#!/usr/bin/env bash
set -euo pipefail

# fix-op-team-dag-resource.sh
#
# Workaround for environments running a keycloak provider version whose
# `_attach_team_permissions` omits DAG:{team} from the Op-{team}
# resource-based permission (see commands.py fix, tracked in [issue link]).
#
# Once every environment is on a provider version with the commands.py
# fix, this script is no longer needed and can be deleted.
#
# IMPORTANT: the Keycloak "update permission resources" endpoint REPLACES
# the resource list rather than merging (confirmed empirically). This
# script does explicit read -> merge -> write to avoid dropping the
# existing Connection/Variable/Pool resources already attached to
# Op-{team}.
#
# NOTE: deliberately avoids jq (not present in the stock Keycloak image).
# Uses `kcadm ... --format csv --noquotes` to get one ID/name per line
# instead, same pattern the rest of this repo's kcadm scripts already use.
#
# Usage:
#   KEYCLOAK_ADMIN=admin KEYCLOAK_ADMIN_PASSWORD=... \
#     ./fix-op-team-dag-resource.sh team-analytics ...
#
# Safe to re-run: if DAG:{team} is already attached, the script detects
# this and skips the write for that team.

kcadm=/opt/keycloak/bin/kcadm.sh
server=http://keycloak:8080
realm=airflow

if [[ $# -eq 0 ]]; then
  echo "Usage: $0 <team-name> [<team-name> ...]"
  exit 1
fi

"$kcadm" config credentials --server "$server" --realm master \
  --user "$KEYCLOAK_ADMIN" --password "$KEYCLOAK_ADMIN_PASSWORD"

airflow_client_id=$("$kcadm" get clients -r "$realm" -q clientId=airflow \
  --fields id --format csv --noquotes | head -n 1)
test -n "$airflow_client_id" || { echo "ERROR: could not resolve airflow client id"; exit 1; }
echo "airflow client id: $airflow_client_id"
echo

# Join an array of quoted strings with commas, e.g.:
#   join_csv_json "a" "b" "c"  ->  "a","b","c"
join_csv_json() {
  local IFS=,
  echo "$*"
}

fix_op_dag_resource() {
  local team=$1
  local perm_name="Op-${team}"
  # NOTE: resource is named "Dag:{team}" (confirmed casing from live
  # kcadm output), not "DAG:{team}".
  local dag_resource_name="Dag:${team}"

  echo "=== $team ==="

  local perm_id
  perm_id=$("$kcadm" get "clients/$airflow_client_id/authz/resource-server/permission" -r "$realm" \
    -q "name=$perm_name" --fields id --format csv --noquotes | head -n 1)
  if [[ -z "$perm_id" ]]; then
    echo "  Skipping: permission '$perm_name' not found (team may not exist yet)"
    echo
    return
  fi

  local dag_resource_id
  dag_resource_id=$("$kcadm" get "clients/$airflow_client_id/authz/resource-server/resource" -r "$realm" \
    -q "name=$dag_resource_name" --fields _id --format csv --noquotes | head -n 1)
  if [[ -z "$dag_resource_id" ]]; then
    echo "  Skipping: resource '$dag_resource_name' not found"
    echo
    return
  fi

  # Read current resources attached to the permission, one "id,name" pair
  # per line via CSV (no jq). --fields order below matches the header-less
  # csv output order.
  local current_csv
  current_csv=$("$kcadm" get "clients/$airflow_client_id/authz/resource-server/permission/$perm_id/resources" \
    -r "$realm" --fields _id,name --format csv --noquotes)

  local current_ids=()
  local current_names=()
  while IFS=, read -r id name; do
    [[ -z "$id" ]] && continue
    current_ids+=("$id")
    current_names+=("$name")
  done <<< "$current_csv"

  echo "  Current resources: ${current_names[*]:-(none)}"

  # Check whether DAG is already present.
  local id
  for id in "${current_ids[@]}"; do
    if [[ "$id" == "$dag_resource_id" ]]; then
      echo "  Already has $dag_resource_name attached. Skipping."
      echo
      return
    fi
  done

  # Build merged ID list (existing + new), each quoted for the JSON array
  # kcadm expects in -s 'resources=[...]'.
  local quoted_ids=()
  for id in "${current_ids[@]}"; do
    quoted_ids+=("\"$id\"")
  done
  quoted_ids+=("\"$dag_resource_id\"")

  local merged_json
  merged_json="[$(join_csv_json "${quoted_ids[@]}")]"

  echo "  Adding: $dag_resource_name"
  local before_count=${#current_ids[@]}

  "$kcadm" update "clients/$airflow_client_id/authz/resource-server/permission/resource/$perm_id" \
    -r "$realm" -s "resources=$merged_json"

  # Verify: re-read and confirm count is exactly +1 and DAG is present.
  local after_csv
  after_csv=$("$kcadm" get "clients/$airflow_client_id/authz/resource-server/permission/$perm_id/resources" \
    -r "$realm" --fields _id,name --format csv --noquotes)

  local after_ids=()
  local after_names=()
  local found_dag=false
  while IFS=, read -r id name; do
    [[ -z "$id" ]] && continue
    after_ids+=("$id")
    after_names+=("$name")
    [[ "$id" == "$dag_resource_id" ]] && found_dag=true
  done <<< "$after_csv"

  echo "  After:    ${after_names[*]:-(none)}"

  local after_count=${#after_ids[@]}
  if [[ "$after_count" -ne $((before_count + 1)) ]]; then
    echo "  WARNING: expected $((before_count + 1)) resources after update, got $after_count."
    echo "  Please inspect manually -- the merge may not have applied as expected."
  elif [[ "$found_dag" != "true" ]]; then
    echo "  WARNING: resource count looks right but $dag_resource_name was not found in the after list."
    echo "  Please inspect manually."
  else
    echo "  OK: $dag_resource_name added, existing resources preserved."
  fi
  echo
}

for team in "$@"; do
  fix_op_dag_resource "$team"
done

echo "Done."

[joshua-cogliati-inl]

Combined suggested patch:

diff --git a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/
commands.py b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli
/commands.py
index 705fc4eb0b..b17cdc44c8 100644
--- a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/command
s.py
+++ b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/command
s.py
@@ -792,6 +792,7 @@ def _attach_team_permissions(
         policy_name=_team_role_policy_name(team, "Viewer"),
         scope_names=["GET", "LIST"],
         resource_names=team_readable_resources,
+        decision_strategy="AFFIRMATIVE",
         _dry_run=_dry_run,
     )
     for role_name in ("User", "Op", "Admin"):
@@ -802,6 +803,7 @@ def _attach_team_permissions(
             policy_name=_team_role_policy_name(team, role_name),
             scope_names=["GET", "LIST"],
             resource_names=team_readable_resources,
+            decision_strategy="AFFIRMATIVE",
             _dry_run=_dry_run,
         )
     _attach_policy_to_scope_permission(
@@ -830,6 +832,7 @@ def _attach_team_permissions(
             f"{KeycloakResource.CONNECTION.value}:{team}",
             f"{KeycloakResource.POOL.value}:{team}",
             f"{KeycloakResource.VARIABLE.value}:{team}",
+            f"{KeycloakResource.DAG.value}:{team}",
         ],
         _dry_run=_dry_run,
     )