You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Blizzke (via GitHub)" <gi...@apache.org> on 2024/09/13 11:12:03 UTC
[I] DAG-level permissions: DAG._upgrade_outdated_dag_access_control() breaks "complex" definitions [airflow]
Blizzke opened a new issue, #42214:
URL: https://github.com/apache/airflow/issues/42214
### Apache Airflow version
Other Airflow 2 version (please specify below)
### If "Other Airflow 2 version" selected, which one?
2.9.3
### What happened?
We are trying to limit access to some DAGs and have been trying an example that comes verbating from the documentation and that doesn't work:
```
DAG(
dag_id="example_fine_grained_access",
start_date=pendulum.datetime(2021, 1, 1, tz="UTC"),
access_control={
"Viewer": {"DAGs": {"can_edit", "can_read", "can_delete"}, "DAG Runs": {"can_create"}},
},
)
```
(taken from [here](https://airflow.apache.org/docs/apache-airflow-providers-fab/stable/auth-manager/access-control.html))
During debugging, `_upgrade_outdated_dag_access_control` was encountered, and more specific this little gem:
```
updated_access_control = {}
for role, perms in access_control.items():
updated_access_control[role] = {new_perm_mapping.get(perm, perm) for perm in perms}
```
Which "translates" the permissions specified originally into
```
{'Viewer': {'DAG Runs', 'DAGs'}}
```
+ a warning.
### What you think should happen instead?
The Viewer role should get "can_edit/read on DAG:example_fine_grained_access" and "can_create on DAG Run:example_fine_grained_access".
### How to reproduce
Use the example from the documentation.
### Operating System
Linux
### Versions of Apache Airflow Providers
_No response_
### Deployment
Docker-Compose
### Deployment details
_No response_
### Anything else?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] DAG-level permissions: DAG._upgrade_outdated_dag_access_control() breaks "complex" definitions [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #42214:
URL: https://github.com/apache/airflow/issues/42214#issuecomment-3425037709
This issue has been closed because it has not received response from the issue author.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] DAG-level permissions: DAG._upgrade_outdated_dag_access_control() breaks "complex" definitions [airflow]
Posted by "joaopamaral (via GitHub)" <gi...@apache.org>.
joaopamaral commented on issue #42214:
URL: https://github.com/apache/airflow/issues/42214#issuecomment-2352728160
Hi @Blizzke, the access control with Resource definition only works in airflow >= 2.10.x and FAB >= 1.3.x:
- This access_control doesn't work in airflow 2.9.3:
```python
access_control={
"Viewer": {"DAGs": {"can_edit", "can_read", "can_delete"}, "DAG Runs": {"can_create"}},
},
```
- This is the correct access control for airflow 2.9.3
```python
access_control={
"Viewer": {"can_edit", "can_read", "can_delete"},
},
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] DAG-level permissions: DAG._upgrade_outdated_dag_access_control() breaks "complex" definitions [airflow]
Posted by "Blizzke (via GitHub)" <gi...@apache.org>.
Blizzke commented on issue #42214:
URL: https://github.com/apache/airflow/issues/42214#issuecomment-2348778817
If you disable that piece of code, things go wrong further along as well.
In `_sync_dag_view_permissions` to be precise.
Within the loop of the specified roles there's a `action_names = set(action_names)` there that still converts them into `('DAG Runs', 'DAGs')`.
Seems that the code has "forgotten" that an extra layer is possible, only allowing actions on `DAGs`, which makes the entire `access_control` rather pointless.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] DAG-level permissions: DAG._upgrade_outdated_dag_access_control() breaks "complex" definitions [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on issue #42214:
URL: https://github.com/apache/airflow/issues/42214#issuecomment-2351363170
@joaopamaral maybe you can look into this one?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] DAG-level permissions: DAG._upgrade_outdated_dag_access_control() breaks "complex" definitions [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #42214: DAG-level permissions: DAG._upgrade_outdated_dag_access_control() breaks "complex" definitions
URL: https://github.com/apache/airflow/issues/42214
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] DAG-level permissions: DAG._upgrade_outdated_dag_access_control() breaks "complex" definitions [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #42214:
URL: https://github.com/apache/airflow/issues/42214#issuecomment-3301585486
This issue has been automatically marked as stale because it has been open for 365 days without any activity. There has been several Airflow releases since last activity on this issue. Kindly asking to recheck the report against latest Airflow version and let us know if the issue is reproducible. The issue will be closed in next 30 days if no further activity occurs from the issue author.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org