MannXo opened a new pull request, #71852: URL: https://github.com/apache/airflow/pull/71852
Following the FAB SSO guide as written does not produce a working SSO setup. - Step 1 puts `auth_manager` in `[webserver]`. Airflow reads it from `[core]`, and there is no deprecation mapping for the `[webserver]` spelling, so the setting is silently ignored and the deployment stays on `SimpleAuthManager`. - Step 4 offers `AIRFLOW__FAB__OAUTH_PROVIDERS` and `[fab] oauth_providers`. Neither exists. The provider declares no `oauth_providers` option, and `FabAirflowSecurityManagerOverride.oauth_providers` returns `current_app.config["OAUTH_PROVIDERS"]`, which is populated from `webserver_config.py`. With `AUTH_TYPE = AUTH_OAUTH` set and the providers configured the way the guide describes, the API server refuses to start with `KeyError: 'OAUTH_PROVIDERS'`. - The Okta, Azure and Google examples all use the same non-functional environment variable. The Azure group-authorization example further down already used the correct `webserver_config.py` form, so the guide contradicted itself. Verified on Airflow 3.3.1 with `apache-airflow-providers-fab==3.8.1rc1`. Following the corrected guide verbatim against a fresh `AIRFLOW_HOME`, the API server starts, the provider appears on the login page, and `/auth/login/google` redirects to the IdP with `redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fauth%2Foauth-authorized%2Fgoogle`. Found while verifying #71624 for the RC round in #71847. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
