potiuk opened a new pull request, #76231: URL: https://github.com/apache/airflow/pull/76231
`FabAuthManager.create_token()` checked a username and password against the database for every `AUTH_TYPE`: after LDAP, and also for authentication types that never use a local password (OAuth, remote user), where users are stored without one. It now checks only against the configured authentication type (`AUTH_DB` or `AUTH_LDAP`) and issues no token for the others, which matches Flask-AppBuilder's own login views. A password made only of NUL bytes is also rejected as empty, as Flask-AppBuilder's login API does. A provider changelog note describes the behaviour change for LDAP deployments that relied on the database fallback for API tokens. Related: airflow-s/airflow-s#690 ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Opus 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
