You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "BevisDev (via GitHub)" <gi...@apache.org> on 2026/06/08 07:30:26 UTC
[I] [Airflow 3.2.2] api-server: Azure OAuth button not shown at /auth/login/ [airflow]
BevisDev opened a new issue, #68208:
URL: https://github.com/apache/airflow/issues/68208
### Under which category would you file this issue?
Providers
### Apache Airflow version
3.2.2
### What happened and how to reproduce it?
## **What happened**
On Airflow 3.2.2 with FabAuthManager and Azure Entra ID OAuth, the login page shows only the database login form (Username / Password), not the OAuth page with a "Sign in with azure" button.
In the api-server pod we confirmed:
- apache-airflow-providers-fab is installed (v3.6.4)
- /opt/airflow/webserver_config.py is mounted with AUTH_TYPE = AUTH_OAUTH and Azure OAUTH_PROVIDERS
AZ_TENANT_ID, AZ_CLIENT_ID, AZ_CLIENT_SECRET env vars are set (non-empty)
- Manual config load succeeds:
```python
app.config.from_pyfile('/opt/airflow/webserver_config.py', silent=False)
# AUTH_TYPE=4, OAUTH_PROVIDERS=1
```
- The running airflow api-server UI still shows Username/Password only, suggesting OAuth config is not applied at process startup.
## **Environment**
| Item | Value |
|------|-------|
| **Airflow version** | 3.2.2 |
| **Helm chart version** | `1.22.0` |
| **Executor** | `KubernetesExecutor` |
| **Auth manager** | `FabAuthManager` (`apache-airflow-providers-fab` 3.6.4) |
| **UI component** | `api-server` (webserver disabled) |
| **Ingress class** | `nginx` |
## **Steps to reproduce**
1. Deploy Airflow 3.2.x with FabAuthManager, api-server enabled, webserver disabled.
2. Mount webserver_config.py with AUTH_TYPE = AUTH_OAUTH and Azure provider to /opt/airflow/webserver_config.py on api-server
3. Set AZ_TENANT_ID, AZ_CLIENT_ID, AZ_CLIENT_SECRET on the api-server pod
4. Set config.api.base_url and config.fab.enable_proxy_fix = True
5. Open: https://domain.com/auth/login/?next=https://domain.com/
**Actual**: Username/Password form only.
**Expected**: "Sign in with azure" button.
### What you think should happen instead?
- /auth/login/ should render the OAuth login page (login_oauth.html), not the database form (login_db.html), when webserver_config.py sets AUTH_TYPE = AUTH_OAUTH
- The page should show "Sign in with azure", consistent with Airflow 2 + FAB + Azure OAuth.
- Clicking the button should redirect to Microsoft Entra ID, then callback to https://domain/auth/oauth-authorized/azure
- After successful auth, the user should be logged into the Airflow 3 UI.
- On api-server startup, webserver_config.py should be loaded successfully (not silently skipped), so the running process uses AUTH_TYPE = AUTH_OAUTH (4), matching manual from_pyfile() in the same pod.
### Operating System
24.04.3 LTS
### Deployment
Official Apache Airflow Helm Chart
### Apache Airflow Provider(s)
fab
### Versions of Apache Airflow Providers
apache-airflow-providers-fab==3.6.4
### Official Helm Chart version
1.22.0 (latest released)
### Kubernetes Version
1.30.14
### Helm Chart configuration
```yaml
config:
api:
base_url: "https://domain.company.com"
core:
auth_manager: "airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager"
fab:
config_file: "/opt/airflow/webserver_config.py"
enable_proxy_fix: "True"
apiServer:
enabled: true
replicas: 1
args: ["bash", "-c", "exec airflow api-server"]
env:
- name: AZ_TENANT_ID
valueFrom:
secretKeyRef:
name: airflow-azure-oidc
key: tenant-id
- name: AZ_CLIENT_ID
valueFrom:
secretKeyRef:
name: airflow-azure-oidc
key: client-id
- name: AZ_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: airflow-azure-oidc
key: client-secret
- name: AIRFLOW__FAB__ENABLE_PROXY_FIX
value: "True"
- name: AIRFLOW__APISERVER__PREFERRED_URL_SCHEME
value: https
- name: FORWARDED_ALLOW_IPS
value: "*"
- name: AIRFLOW__LOGGING__FAB_LOGGING_LEVEL
value: "DEBUG"
apiServerConfig: ~
apiServerConfigConfigMapName: airflow-api-server-config
```
### Docker Image customizations
_No response_
### Anything else?
- Azure credentials stored in K8s secret airflow-azure-oidc (values redacted).
- webserver_config.py mounted from ConfigMap airflow-api-server-config at /opt/airflow/webserver_config.py.
- Login URL: https://domain.company.com/auth/login/?next=https://domain.company.com/
- In pod: AZ_* env vars present (len 36/36/41), manual webserver_config.py load returns AUTH_TYPE=4, but UI shows only Username/Password form.
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Airflow 3.2.2] api-server: Azure OAuth button not shown at /auth/login/ [airflow]
Posted by "BevisDev (via GitHub)" <gi...@apache.org>.
BevisDev closed issue #68208: [Airflow 3.2.2] api-server: Azure OAuth button not shown at /auth/login/
URL: https://github.com/apache/airflow/issues/68208
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Airflow 3.2.2] api-server: Azure OAuth button not shown at /auth/login/ [airflow]
Posted by "BevisDev (via GitHub)" <gi...@apache.org>.
BevisDev closed issue #68208: [Airflow 3.2.2] api-server: Azure OAuth button not shown at /auth/login/
URL: https://github.com/apache/airflow/issues/68208
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Airflow 3.2.2] api-server: Azure OAuth button not shown at /auth/login/ [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #68208:
URL: https://github.com/apache/airflow/issues/68208#issuecomment-4646380218
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Airflow 3.2.2] api-server: Azure OAuth button not shown at /auth/login/ [airflow]
Posted by "BevisDev (via GitHub)" <gi...@apache.org>.
BevisDev closed issue #68208: [Airflow 3.2.2] api-server: Azure OAuth button not shown at /auth/login/
URL: https://github.com/apache/airflow/issues/68208
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org