dhkim1920 commented on issue #71847: URL: https://github.com/apache/airflow/issues/71847#issuecomment-5379839876
Validated my change included in the current provider RC round: - `apache-airflow-providers-keycloak==0.9.0rc2` — #70906 I reviewed the relevant implementation and verified that the RC creates the team `ReadOnly` permission with the `AFFIRMATIVE` strategy while retaining the individual Viewer, User, Op, and Admin policies. I also tested the behavior before and after the change by restoring the team `ReadOnly` permission to its previous `UNANIMOUS` strategy in the same provisioned realm: | Team `ReadOnly` strategy | Client resource-server strategy | Viewer UMA result | | --- | --- | --- | | Previous: `UNANIMOUS` | `AFFIRMATIVE` | HTTP 403 | | Current RC: `AFFIRMATIVE` | `AFFIRMATIVE` | HTTP 200 with `Dag:team-a` / `GET` granted | This confirms that #70906 changes the Viewer result from denied to granted as intended. One configuration requirement should be documented: the Keycloak client's resource-server-level decision strategy must also be `AFFIRMATIVE`. With Keycloak's default `UNANIMOUS` client strategy, the Viewer request returned HTTP 403 both before and after the permission-level change. The provider documentation and provisioning CLI do not currently document or validate this requirement. Environment: Breeze with mounted provider sources removed, Airflow 3.3.1, Python 3.10, Keycloak 23.0.6, PostgreSQL 14. --- Drafted-by: OpenAI Codex (GPT-5); reviewed by @dhkim1920 before posting -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
