You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "bahiaxur (via GitHub)" <gi...@apache.org> on 2025/06/03 15:56:23 UTC
[I] Airflow does not create a webserver user when using FAB and logging_level=DEBUG [airflow]
bahiaxur opened a new issue, #51370:
URL: https://github.com/apache/airflow/issues/51370
### Apache Airflow version
3.0.1
### If "Other Airflow 2 version" selected, which one?
_No response_
### What happened?
I ran into an issue with the Docker image `slim-3.0.1-python3.12`. After changing the `logging_level` to `DEBUG`, I consistently received "invalid credentials" errors when trying to log into the webserver via `localhost:8080/`.
Upon reviewing the logs from the `airflow-init` container, I saw the message: "Skipping user creation as auth manager different from Fab is used." This was despite explicitly setting `AIRFLOW__CORE__AUTH_MANAGER` to `airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager`.
Additionally, the logs showed a `BrokenPipeError`:
```
Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>
BrokenPipeError: [Errno 32] Broken pipe
```
After some investigation, I discovered the problem stemmed from the entrypoint, specifically within the condition `if airflow config get-value core auth_manager | grep -q "FabAuthManager"; then`.
The `Broken Pipe`:
1. airflow, running through log.debug, starts writing output.
2. If `grep -q` finds 'FabAuthManager' early on in the output stream (or processes enough to know it won't find it, though less common for a broken pipe), it exits.
3. When grep exits, the receiving end of the pipe is closed.
4. If airflow tries to write more data (e.g., more log.debug messages) to that now-closed pipe, the operating system sends a SIGPIPE signal leading to `BrokenPipeError`.
5. The condition never gets true.
6. The user is not created.
After removing `-q` from `grep` the problem was gone.
### What you think should happen instead?
User must be created regardless logging_level value. `grep` command should not exit immediately.
### How to reproduce
1. Download the docker-compose.yaml provided by airflow
2. Adjust the env variables to setup the containers
3. set AIRFLOW__LOGGING__LOGGING_LEVEL=DEBUG, _AIRFLOW_WWW_USER_CREATE=True, _AIRFLOW_WWW_USER_USERNAME=airflow and _AIRFLOW_WWW_USER_PASSWORD=airflow
4. run the containers
5. Try to log in the webserver
### Operating System
Ubuntu 24.04.2 LTS
### Versions of Apache Airflow Providers
apache-airflow-providers-common-compat==1.6.1
apache-airflow-providers-common-io==1.5.4
apache-airflow-providers-common-sql==1.27.0
apache-airflow-providers-smtp==2.0.3
apache-airflow-providers-standard==1.1.0
### Deployment
Docker-Compose
### Deployment details
docker compose version
> Docker Compose version v2.34.0
docker version
> Client: Docker Engine - Community
> Version: 28.0.4
> API version: 1.48
> Go version: go1.23.7
> Git commit: b8034c0
> Built: Tue Mar 25 15:07:16 2025
> OS/Arch: linux/amd64
> Context: default
>
> Server: Docker Engine - Community
> Engine:
> Version: 28.0.4
> API version: 1.48 (minimum version 1.24)
> Go version: go1.23.7
> Git commit: 6430e49
> Built: Tue Mar 25 15:07:16 2025
> OS/Arch: linux/amd64
> Experimental: false
> containerd:
> Version: 1.7.27
> GitCommit: 05044ec0a9a75232cad458027ca83437aae3f4da
> runc:
> Version: 1.2.5
> GitCommit: v1.2.5-0-g59923ef
> docker-init:
> Version: 0.19.0
> GitCommit: https://github.com/apache/airflow/commit/de40ad0af8a4ed16854121fe384152193ffbee98
### Anything else?
_No response_
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Airflow does not create a webserver user when using FAB and logging_level=DEBUG [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #51370:
URL: https://github.com/apache/airflow/issues/51370#issuecomment-4468669421
This issue has been closed because it has not received response from the issue author.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Airflow does not create a webserver user when using FAB and logging_level=DEBUG [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on issue #51370:
URL: https://github.com/apache/airflow/issues/51370#issuecomment-3451606215
I am not a system expert but are you suggesting to remove -q from grep?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Airflow does not create a webserver user when using FAB and logging_level=DEBUG [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #51370: Airflow does not create a webserver user when using FAB and logging_level=DEBUG
URL: https://github.com/apache/airflow/issues/51370
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Airflow does not create a webserver user when using FAB and logging_level=DEBUG [airflow]
Posted by "DhavalGojiya (via GitHub)" <gi...@apache.org>.
DhavalGojiya commented on issue #51370:
URL: https://github.com/apache/airflow/issues/51370#issuecomment-5253357957
Still reproducible on **3.0.6** with `FabAuthManager`. Adding `AIRFLOW__LOGGING__LOGGING_LEVEL=DEBUG` makes `airflow-init` skip admin-user creation:
```
airflow-init-1 | BrokenPipeError: [Errno 32] Broken pipe
airflow-init-1 | Skipping user creation as auth manager different from Fab is used
```
Cause: under `set -euo pipefail`, `airflow config get-value core auth_manager | grep -q "FabAuthManager"` prints ~100 lines at DEBUG, `grep -q` exits at the match and closes the pipe, so the left side dies with `BrokenPipeError` and exits 120. `PIPESTATUS` is `120 0`, so grep matched but `pipefail` fails the check and the `else` branch runs.
```bash
docker run --rm \
-e AIRFLOW__CORE__AUTH_MANAGER=airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager \
-e AIRFLOW__LOGGING__LOGGING_LEVEL=DEBUG \
--entrypoint bash apache/airflow:3.0.6 -c \
'set -euo pipefail
airflow config get-value core auth_manager | grep -q FabAuthManager
echo "PIPESTATUS: ${PIPESTATUS[@]}"'
```
`ab_user` then stays empty, so a still-valid JWT resolves to `None` and every UI request returns HTTP 500 instead of an auth error:
<details>
<summary>Full traceback (Airflow 3.0.6)</summary>
```
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/core_api/security.py", line 106, in <lambda>
is_authorized_callback=lambda: get_auth_manager().is_authorized_dag(
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/fab_auth_manager.py", line 342, in is_authorized_dag
return self._is_authorized_dag(method=method, details=details, user=user)
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/fab_auth_manager.py", line 580, in _is_authorized_dag
authorized_dags = self.get_authorized_dag_ids(user=user, method=method)
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/fab_auth_manager.py", line 444, in get_authorized_dag_ids
.where(User.id == user.id)
^^^^^^^
AttributeError: 'NoneType' object has no attribute 'id'
```
</details>
The 500 looks fixed on `main` (`deserialize_user` now raises `ValueError`), but the entrypoint check is unchanged
<img width="1915" height="940" alt="Image" src="https://github.com/user-attachments/assets/23a9fe30-93de-439e-88bc-40a5f7fc37f5" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org