You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "jotamartos (via GitHub)" <gi...@apache.org> on 2026/04/23 15:02:01 UTC

[I] [Bug] CLI `airflow users create` ignores FAB_PASSWORD_HASH_METHOD and fails on FIPS systems (Werkzeug 3.0+) [airflow]

jotamartos opened a new issue, #65728:
URL: https://github.com/apache/airflow/issues/65728

   ### Apache Airflow version
   3.2.0 (FAB Provider)
   
   ### What happened?
   When running the CLI command `airflow users create` on a FIPS-enabled system (e.g., Photon OS), the command crashes with the following error:
   
   ```python
   ValueError: [digital envelope routines] unsupported
   ```
   
   This happens even if `FAB_PASSWORD_HASH_METHOD="pbkdf2:sha256"` is explicitly set in `webserver_config.py`.
   
   ### Why it happens
   In `providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py`, the `add_user` function calls `generate_password_hash(password)` without passing the `method` argument:
   
   https://github.com/apache/airflow/blob/main/providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py#L1407
   
   Because the `method` argument is omitted, it falls back to Werkzeug's default, which is `scrypt` in Werkzeug >= 3.0.0. `scrypt` is not a FIPS-approved algorithm, so OpenSSL rejects it and throws the `[digital envelope routines] unsupported` error.
   
   This completely bypasses the `FAB_PASSWORD_HASH_METHOD` configuration that was introduced in PR #51858 to fix this exact issue for the Web UI. The Web UI works fine because it uses Flask-AppBuilder's internal views which correctly read the config, but the CLI bypasses this and uses `override.py`.
   
   This bug also affects `add_register_user` and `reset_password` in the same file.
   
   ### What you think should happen instead?
   The `add_user`, `add_register_user`, and `reset_password` methods in `override.py` should read and respect the `FAB_PASSWORD_HASH_METHOD` configuration (or fallback to `pbkdf2:sha256` for older Werkzeug versions), rather than relying on Werkzeug's hardcoded default.
   
   For example:
   ```python
   hash_method = current_app.config.get("FAB_PASSWORD_HASH_METHOD", "pbkdf2:sha256")
   user.password = generate_password_hash(password, method=hash_method)
   ```
   
   ### How to reproduce
   1. Use a FIPS-enabled OS (e.g., Bitnami Airflow on Photon OS FIPS).
   2. Ensure Werkzeug >= 3.0.0 is installed.
   3. Set `FAB_PASSWORD_HASH_METHOD="pbkdf2:sha256"` in `webserver_config.py`.
   4. Run `airflow users create -r Admin -u admin -e admin@example.com -p admin -f admin -l admin`
   5. Observe the `ValueError: [digital envelope routines] unsupported` crash.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] CLI `airflow users create` ignores FAB_PASSWORD_HASH_METHOD and fails on FIPS systems (Werkzeug 3.0+) [airflow]

Posted by "MdSadiqMd (via GitHub)" <gi...@apache.org>.
MdSadiqMd commented on issue #65728:
URL: https://github.com/apache/airflow/issues/65728#issuecomment-4305764495

   Hey @jotamartos are you working on it?
   If not, can i take this up


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] CLI `airflow users create` ignores FAB_PASSWORD_HASH_METHOD and fails on FIPS systems (Werkzeug 3.0+) [airflow]

Posted by "MdSadiqMd (via GitHub)" <gi...@apache.org>.
MdSadiqMd commented on issue #65728:
URL: https://github.com/apache/airflow/issues/65728#issuecomment-4310709166

   Looks like someone else has already made the PR, and it looks good to me
   
   I’ll work on other issues then


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] CLI `airflow users create` ignores FAB_PASSWORD_HASH_METHOD and fails on FIPS systems (Werkzeug 3.0+) [airflow]

Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #65728:
URL: https://github.com/apache/airflow/issues/65728#issuecomment-4305497205

   Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] CLI `airflow users create` ignores FAB_PASSWORD_HASH_METHOD and fails on FIPS systems (Werkzeug 3.0+) [airflow]

Posted by "jotamartos (via GitHub)" <gi...@apache.org>.
jotamartos commented on issue #65728:
URL: https://github.com/apache/airflow/issues/65728#issuecomment-4305834841

   > Hey [@jotamartos](https://github.com/jotamartos) are you working on it? If not, can i take this up
   
   All yours @MdSadiqMd. Thank you for your time.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] CLI `airflow users create` ignores FAB_PASSWORD_HASH_METHOD and fails on FIPS systems (Werkzeug 3.0+) [airflow]

Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck closed issue #65728: [Bug] CLI `airflow users create` ignores FAB_PASSWORD_HASH_METHOD and fails on FIPS systems (Werkzeug 3.0+)
URL: https://github.com/apache/airflow/issues/65728


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org