This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 957198466d2 Grant team Op role access to team Dags in Keycloak auth
manager (#71572)
957198466d2 is described below
commit 957198466d2baf36f3d42100e0491ed0d1a01433
Author: Cole Heflin <[email protected]>
AuthorDate: Fri Aug 14 07:13:46 2026 -0700
Grant team Op role access to team Dags in Keycloak auth manager (#71572)
The Op-{team} permission created by create-team (and by the standalone
create-permissions --teams flow) only ever included the team's
Connection/Pool/Variable resources, never Dag:{team} — unlike
User-{team}, which already has it. Op is meant to be a superset of
User's Dag access plus connection/pool/variable management, so team Op
users had no way to act on their own team's Dags.
---
.../airflow/providers/keycloak/auth_manager/cli/commands.py | 2 ++
.../tests/unit/keycloak/auth_manager/cli/test_commands.py | 12 ++++++++++++
2 files changed, 14 insertions(+)
diff --git
a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
index 97d031427b3..5992e64e425 100644
---
a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
+++
b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
@@ -481,6 +481,7 @@ def _get_permissions_to_create(
"type": "resource-based",
"resources": [
f"{KeycloakResource.CONNECTION.value}:{team}",
+ f"{KeycloakResource.DAG.value}:{team}",
f"{KeycloakResource.POOL.value}:{team}",
f"{KeycloakResource.VARIABLE.value}:{team}",
],
@@ -832,6 +833,7 @@ def _attach_team_permissions(
policy_name=_team_role_policy_name(team, "Op"),
resource_names=[
f"{KeycloakResource.CONNECTION.value}:{team}",
+ f"{KeycloakResource.DAG.value}:{team}",
f"{KeycloakResource.POOL.value}:{team}",
f"{KeycloakResource.VARIABLE.value}:{team}",
],
diff --git
a/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
b/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
index 450996ad0a4..f4b9c714fca 100644
--- a/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
+++ b/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
@@ -426,6 +426,17 @@ class TestCommands:
},
skip_exists=True,
)
+ client.create_client_authz_resource_based_permission.assert_any_call(
+ client_id="test-id",
+ payload={
+ "name": "Op-team-a",
+ "type": "scope",
+ "logic": "POSITIVE",
+ "decisionStrategy": "UNANIMOUS",
+ "resources": ["r1", "r2", "r3", "r4"], # Dag, Connection,
Pool, Variable
+ },
+ skip_exists=True,
+ )
@patch("airflow.providers.keycloak.auth_manager.cli.commands._attach_policy_to_resource_permission")
@patch("airflow.providers.keycloak.auth_manager.cli.commands._attach_policy_to_scope_permission")
@@ -601,6 +612,7 @@ class TestCommands:
policy_name="Allow-Op-team-a",
resource_names=[
"Connection:team-a",
+ "Dag:team-a",
"Pool:team-a",
"Variable:team-a",
],
