[jira] [Commented] (AIRFLOW-3298) Webserver with ldap is not robust to changes in underlying database

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/AIRFLOW-3298?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16675182#comment-16675182 ] 

ASF GitHub Bot commented on AIRFLOW-3298:
-----------------------------------------

BradHolmes opened a new pull request #4132: [AIRFLOW-3298] Return None if user not found in session.
URL: https://github.com/apache/incubator-airflow/pull/4132
 
 
   * It is possible for the browser to have a user-id stored, but the user to be absent from the session (database backend).
   * This was encountered in a setup where, during development, a new database is instantiated for each branch, per developer
   
   ### Jira
   
   - [x] AIRFLOW-3298
   
   ### Description
   
   - [x] [AIRFLOW-3298] Return None if user not found in session. 
     * It is possible for the browser to have a user-id stored, but the user to be absent from the session (database backend). 
     * This was encountered in a setup where, during development, a new database is instantiated for each branch, per developer
   
   ### Tests
   
   - [ ] I have no idea how to test this.  Anyone have any tips or suggestions?
   
   ### Commits
   
   - [x] Good commit message
   
   ### Documentation
   
   - [x] No new functionality.  No new docs.
   
   ### Code Quality
   
   - [x] Passes `flake8`
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


> Webserver with ldap is not robust to changes in underlying database
> -------------------------------------------------------------------
>
>                 Key: AIRFLOW-3298
>                 URL: https://issues.apache.org/jira/browse/AIRFLOW-3298
>             Project: Apache Airflow
>          Issue Type: Bug
>          Components: authentication
>    Affects Versions: 1.10.0
>            Reporter: Brad Holmes
>            Assignee: Brad Holmes
>            Priority: Major
>
> When a user-id is stored in the web-browser, and the underlying database changes so that the user-id is invalid, the webserver gets stuck, and throws an exception as it tries to use {{None}} as an object, and find the {{username}}.
> The problem is in {{load_user}} or {{ldap_auth.py}}:
> {code}
> def load_user(userid, session=None):
>     log.debug("Loading user %s", userid)
>     if not userid or userid == 'None':
>         return None
>     user = session.query(models.User).filter(models.User.id == int(userid)).first()
>     return LdapUser(user)
> {code}
> {{LdapUser}} must not be constructed with {{user=None}}.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)