You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "gongomgra (via GitHub)" <gi...@apache.org> on 2025/06/17 10:22:04 UTC
[I] Can't create users from the web UI [airflow]
gongomgra opened a new issue, #51833:
URL: https://github.com/apache/airflow/issues/51833
### Apache Airflow version
3.0.2
### If "Other Airflow 2 version" selected, which one?
_No response_
### What happened?
I have installed the Helm chart (from `main` branch) with default values and the Airflow `3.0.2` version image. When completing the form to add a new user (`/security/users/add` URI), an "unsupported hash type scrypt" error is returned and the new user is not created.
### What you think should happen instead?
This workflow has worked in all previous versions of Airflow. I don't see much related information in the api-server pod logs
```
INFO: 127.0.0.1:38264 - "POST /auth/users/add HTTP/1.1" 302 Found
INFO: 127.0.0.1:38264 - "GET /auth/users/list/ HTTP/1.1" 200 OK
INFO: 127.0.0.1:38264 - "GET /auth/static/appbuilder/css/bootstrap.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38270 - "GET /auth/static/appbuilder/css/fontawesome/fontawesome.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38304 - "GET /auth/static/appbuilder/css/fontawesome/regular.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38292 - "GET /auth/static/appbuilder/css/fontawesome/brands.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38252 - "GET /auth/static/appbuilder/css/fontawesome/v4-shims.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38278 - "GET /auth/static/appbuilder/css/fontawesome/solid.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38270 - "GET /auth/static/appbuilder/css/select2/select2.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38264 - "GET /auth/static/appbuilder/css/bootstrap-datepicker/bootstrap-datepicker3.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38270 - "GET /auth/static/dist/materialIcons.4fd835641d53f81af3d3.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38304 - "GET /auth/static/appbuilder/css/select2/select2-bootstrap.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38252 - "GET /auth/static/appbuilder/css/flags/flags16.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38264 - "GET /auth/static/dist/main.49c4d5787ef1f247f004.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38292 - "GET /auth/static/appbuilder/css/ab.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38270 - "GET /auth/static/dist/loadingDots.96221bc8b6345c7d65b3.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38278 - "GET /auth/static/dist/airflowDefaultTheme.48540e25fb1e474cef20.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38304 - "GET /auth/static/dist/jquery-ui.min.css HTTP/1.1" 304 Not Modified
INFO: 127.0.0.1:38252 - "GET /auth/static/dist/flash.02dea0c2ac20820e8d1b.css HTTP/1.1" 304 Not Modified
```
### How to reproduce
Install the Helm chart with default values and try to create a new user from the web UI.
### Operating System
Debian 12
### Versions of Apache Airflow Providers
```
airflow@airflow-api-server-6449f95df8-rfcw6:/opt/airflow$ pip freeze | grep apache-airflow-providers
apache-airflow-providers-amazon==9.8.0
apache-airflow-providers-celery==3.11.0
apache-airflow-providers-cncf-kubernetes==10.5.0
apache-airflow-providers-common-compat==1.7.0
apache-airflow-providers-common-io==1.6.0
apache-airflow-providers-common-messaging==1.0.2
apache-airflow-providers-common-sql==1.27.1
apache-airflow-providers-docker==4.4.0
apache-airflow-providers-elasticsearch==6.3.0
apache-airflow-providers-fab==2.2.0
apache-airflow-providers-ftp==3.13.0
apache-airflow-providers-git==0.0.2
apache-airflow-providers-google==15.1.0
apache-airflow-providers-grpc==3.8.0
apache-airflow-providers-hashicorp==4.2.0
apache-airflow-providers-http==5.3.0
apache-airflow-providers-microsoft-azure==12.4.0
apache-airflow-providers-mysql==6.3.0
apache-airflow-providers-odbc==4.10.0
apache-airflow-providers-openlineage==2.3.0
apache-airflow-providers-postgres==6.2.0
apache-airflow-providers-redis==4.1.0
apache-airflow-providers-sendgrid==4.1.0
apache-airflow-providers-sftp==5.3.0
apache-airflow-providers-slack==9.1.0
apache-airflow-providers-smtp==2.1.0
apache-airflow-providers-snowflake==6.3.1
apache-airflow-providers-ssh==4.1.0
apache-airflow-providers-standard==1.2.0
```
### Deployment
Official Apache Airflow Helm Chart
### Deployment details
_No response_
### Anything else?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2981732041
Fix in https://github.com/apache/airflow/pull/51858, I think we will release rc2 of FAB provider 2.2.1 soon after we complete current wave of providers and I will update both constraints and image with the 2.2.1 provider so that others do not have that problem.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2981415901
OK. I think I found the issue. If you can confirm to me that you do not have OID provider I can have a workaround for you and fix in the making.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "opeida (via GitHub)" <gi...@apache.org>.
opeida commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2981420942
@potiuk wow! Thanks for the detailed response!
I would like to help with feedback from the user perspective. Just need some of your guidance on what information is needed.
Our setup has nothing special: PostgreSQL with `FabAuthManager`, an extended official image based on `apache/airflow:slim-3.0.2-python3.12`, deployed with Helm chart `v1.17.0rc1` on GKE.
Dockerfile:
```
USER root
RUN apt update \
&& ACCEPT_EULA=Y apt upgrade -y \
&& apt install -y --no-install-recommends \
git-all \
neovim \
libglib2.0-0 \
libsm6 \
libxext6 \
libxrender1 \
libopencv-dev \
ffmpeg \
&& apt autoremove -yqq --purge \
&& apt clean \
&& rm -rf /var/lib/apt/lists/*
USER airflow
WORKDIR /opt/airflow
COPY requirements.txt /opt/airflow/requirements.txt
COPY .secrets/adders-automation-5207283d6492.json /opt/airflow/service_account.json
RUN uv pip install --upgrade pip
RUN uv pip install --no-cache-dir "apache-airflow==${AIRFLOW_VERSION}" -r requirements.txt
```
Installed libraries:
```
aiohttp
apache-airflow-providers-celery
apache-airflow-providers-fab
apache-airflow-providers-google
apache-airflow-providers-http
apache-airflow-providers-postgres
apache-airflow-providers-redis
google-cloud-bigquery-storage
google-cloud-firestore
gspread
opencv-python
pandas
pydantic
pydantic-extra-types
python-telegram-bot
tenacity
throttler
sentry_sdk
validators
```
And a similar issue has just been created: #51854
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "opeida (via GitHub)" <gi...@apache.org>.
opeida commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2981258467
@potiuk I faced the same issue with the official `apache/airflow:slim-3.0.2-python3.12` image deployed with the official Helm chart `v1.17.0rc1`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2981346535
But again - I am guessing that the scrypt hashing comes from your OID provider - that's more of a guess than anything else. Maybe there are other reasons? Can you explain what is your authentication configuration ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "gongomgra (via GitHub)" <gi...@apache.org>.
gongomgra commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2984628941
Hi @potiuk
Thank you for looking into this and for providing us with the workaround. I thought that saying I was installing your official Helm chart with your official images and the default values would give you enough information instead of generating more questions. Sorry for the mistake. I would take it into account for the future.
In my case, I was also using the `PostgreSQL` and `FabAuthManager` .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2981317110
OK. You have not explained what configuration you use for your users. The image works fine when creating users in the "regular" way (i.e. with DB). But likely what you have is that whatever OID provider you use sets the hashing algorithm to scrypt and for reasons explained in https://github.com/apache/airflow/discussions/36007#discussioncomment-7729516 we cannot upgrade to newer Werkzeug version.
If my guess is right - that the scrypt hashing is something that is set by your provider - find a way to change the hashing algorithm is a way to follow. Currently it's the only way to handle it - and only you can do it.
The good news is that we have - maybe - a way soon to upgrade - by upgrading connexion and working with Flask App Builder - I would really appreciate if you could explain your case and up-vote and express your need to be able to do so. But we need people like you - real users who struggle with those issues and have a need to solve it differently would comment on the issues and put a "pressure" on the developers of the libraries we use to respond to our requests:
Details and links to all the relevant issues are here https://lists.apache.org/thread/r7m6s09h53jvm05zj19g5o7w31phr4t4
But I would particularly appreciate if you could explain your problem and support my request to Connexion maintainers to relax their "flask>=3" requirement.
The relevant comment is here: https://github.com/spec-first/connexion/pull/1992#issuecomment-2976706491
Another comment here: https://github.com/dpgaspar/Flask-AppBuilder/pull/2241#issuecomment-2976674169 where I ask Flask Application Builder if they can change the upcoming version of Flask Application Builder (5) to support Flask 3
If either of those two problems is solved, we would be able to upgrade Werkzeug and have support for scrypt. But if none of them will, we are blocked and you need to look for ways how to change "scrypt" to other hashing algorithm.
For now - we are completely blocked to do anything and only users like you who will reiterate their problems in the relevant issues, can help.
Looking forward to your comments @opeida @gongomgra
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed issue #51833: Can't create users from the web UI
URL: https://github.com/apache/airflow/issues/51833
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2981529080
Yeah. Looks like it's a new version of Flask Application Builder (and fab provider) is causing it.
I have a workaround.
Make sure that your webserver_config.py in "${HOME_AIRFLOW}" contains this row:
```
FAB_PASSWORD_HASH_METHOD="pbkdf2:sha256"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2979806145
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2980163745
Yes. Apparently you are using very old system which does not support newer openssl. You should upgrade your base operating system to something way newer. Look at similar discussions and issues in history for details (and query google).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Can't create users from the web UI [airflow]
Posted by "gongomgra (via GitHub)" <gi...@apache.org>.
gongomgra commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2981202494
Hi @potiuk
Thanks for your response. I'm facing this error with your official images. This is the information I have been able to collect regarding the OS and the OpenSSL version
```
$ k -n airflow describe po airflow-api-server-6449f95df8-hnj8b | grep -i image | head -n 2
Image: apache/airflow:3.0.2
Image ID: docker-pullable://apache/airflow@sha256:27665dff7bc6c0d7584e64427467e997a6644260b99efe3e807078d1620b37ff
$ k -n airflow exec -it airflow-api-server-6449f95df8-hnj8b -- bash
airflow@airflow-api-server-6449f95df8-hnj8b:/opt/airflow$ dpkg -l openssl
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-================-============-====================================================
ii openssl 3.0.16-1~deb12u1 arm64 Secure Sockets Layer toolkit - cryptographic utility
airflow@airflow-api-server-6449f95df8-hnj8b:/opt/airflow$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
```
I have been able to reproduce the error message from within the Python console directly. It seems there is an incompatibility between the OpenSSL version and the Werkzeug module. It works for the `pbkdf2` method (which seems to be the default method for Werkzeug 2.2.3 according to [their GitHub repo](https://github.com/pallets/werkzeug/blob/2.2.3/src/werkzeug/security.py#L60)), but not for `scrypt`:
```
airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ pip list | grep -i werk
Werkzeug 2.2.3
airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ python
>>> import werkzeug.security
>>> werkzeug.security.generate_password_hash('test1234')
'pbkdf2:sha256:260000$pn0MkVydoxkqpo7W$56daa9162e8b881e52be6467ff8dd819e46371c1ecaad0838cbbdefc53448a9b'
>>> werkzeug.security.generate_password_hash(password='test1234', method='scrypt')
Traceback (most recent call last):
File "/usr/local/lib/python3.12/hmac.py", line 60, in __init__
self._init_hmac(key, msg, digestmod)
File "/usr/local/lib/python3.12/hmac.py", line 67, in _init_hmac
self._hmac = _hashopenssl.hmac_new(key, msg, digestmod=digestmod)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.12/hashlib.py", line 160, in __hash_new
return _hashlib.new(name, data, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/home/airflow/.local/lib/python3.12/site-packages/werkzeug/security.py", line 88, in generate_password_hash
h, actual_method = _hash_internal(method, salt, password)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/werkzeug/security.py", line 55, in _hash_internal
return hmac.new(salt, password, method).hexdigest(), method
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hmac.py", line 184, in new
return HMAC(key, msg, digestmod)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hmac.py", line 62, in __init__
self._init_old(key, msg, digestmod)
File "/usr/local/lib/python3.12/hmac.py", line 80, in _init_old
self._outer = digest_cons()
^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hmac.py", line 75, in <lambda>
digest_cons = lambda d=b'': _hashlib.new(digestmod, d)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hashlib.py", line 166, in __hash_new
return __get_builtin_constructor(name)(data)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hashlib.py", line 123, in __get_builtin_constructor
raise ValueError('unsupported hash type ' + name)
ValueError: unsupported hash type scrypt
```
I have also given a try to the next available version for Werkzeug (`2.3.0`), and the `scrypt` hashing method works, but it looks like Airflow does not work with it (I get an infinite redirect after login into the web UI). I'm aware that using a newer Werkzeug version does break the defined constraints, but I've simply updated it for testing purposes:
```
airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ pip install Werkzeug==2.3.0
Collecting Werkzeug==2.3.0
Downloading Werkzeug-2.3.0-py3-none-any.whl.metadata (4.2 kB)
Requirement already satisfied: MarkupSafe>=2.1.1 in /home/airflow/.local/lib/python3.12/site-packages (from Werkzeug==2.3.0) (3.0.2)
Downloading Werkzeug-2.3.0-py3-none-any.whl (233 kB)
Installing collected packages: Werkzeug
Attempting uninstall: Werkzeug
Found existing installation: Werkzeug 2.2.3
Uninstalling Werkzeug-2.2.3:
Successfully uninstalled Werkzeug-2.2.3
ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
connexion 2.14.2 requires werkzeug<2.3,>=1.0, but you have werkzeug 2.3.0 which is incompatible.
Successfully installed Werkzeug-2.3.0
airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ python
Python 3.12.11 (main, Jun 4 2025, 18:32:16) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import werkzeug.security
>>> werkzeug.security.generate_password_hash('test1234')
'pbkdf2:sha256:600000$3q7rvemNBaqHFEeM$46cddab9295b0979f1b138737943b384d89edbfeeb2bf6c9be284d261918afc1'
>>> werkzeug.security.generate_password_hash(password='test1234', method='scrypt')
'scrypt:32768:8:1$nLlZs8E3ZuYUC9ay$ae903848f37a1cd251fefa57bd1eb2ff71e9171e34d761b5de47bf857173cc836ce12d6efc16b1da741cec3e08e86d26edfc72f60f755b3dcaf1120a973134e3'
```
Can you please take a look at this? Thanks in advance
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org