Under which category would you file this issue?
Providers
Apache Airflow version
3.3.0
What happened and how to reproduce it?
When using the Keycloak Auth Manager with multi-team support, the Op-{team} permission created by create-team does not include the DAG resource for the team.
The issue was noticed while investigating #70251 and #70906.
The Op-{team} permission includes team-scoped resources such as Connection, Pool, and Variable, but Dag:{team} is missing.
For example:
Enable multi-team support with the Keycloak Auth Manager.
Create a team:
airflow keycloak-auth-manager create-team team-analytics
Inspect the generated Op-team-analytics permission in Keycloak.
Check the resources attached to the permission.
Dag:team-analytics is not included.
As a result, a user with the team Op role does not receive the expected permission for the team's DAG resource.
This is separate from the UNANIMOUS decision strategy issue addressed by #70906.
What you think should happen instead?
The Op-{team} permission should include the corresponding Dag:{team} resource.
For example, when creating team-analytics, the Op-team-analytics permission should include:
Dag:team-analytics
along with the other team-scoped resources.
Operating System
No response
Deployment
None
Apache Airflow Provider(s)
keycloak
Versions of Apache Airflow Providers
apache-airflow-providers-keycloak==0.8.1
Official Helm Chart version
Not Applicable
Kubernetes Version
No response
Helm Chart configuration
No response
Docker Image customizations
No response
Anything else?
This issue is being created separately based on the discussion in #70251 and the review of #70906.
The missing team DAG resource is independent of the UNANIMOUS versus AFFIRMATIVE decision strategy issue fixed by #70906.
Are you willing to submit PR?
Code of Conduct
Under which category would you file this issue?
Providers
Apache Airflow version
3.3.0
What happened and how to reproduce it?
When using the Keycloak Auth Manager with multi-team support, the Op-{team} permission created by create-team does not include the DAG resource for the team.
The issue was noticed while investigating #70251 and #70906.
The Op-{team} permission includes team-scoped resources such as Connection, Pool, and Variable, but Dag:{team} is missing.
For example:
Enable multi-team support with the Keycloak Auth Manager.
Create a team:
airflow keycloak-auth-manager create-team team-analytics
Inspect the generated Op-team-analytics permission in Keycloak.
Check the resources attached to the permission.
Dag:team-analytics is not included.
As a result, a user with the team Op role does not receive the expected permission for the team's DAG resource.
This is separate from the UNANIMOUS decision strategy issue addressed by #70906.
What you think should happen instead?
The Op-{team} permission should include the corresponding Dag:{team} resource.
For example, when creating team-analytics, the Op-team-analytics permission should include:
Dag:team-analytics
along with the other team-scoped resources.
Operating System
No response
Deployment
None
Apache Airflow Provider(s)
keycloak
Versions of Apache Airflow Providers
apache-airflow-providers-keycloak==0.8.1
Official Helm Chart version
Not Applicable
Kubernetes Version
No response
Helm Chart configuration
No response
Docker Image customizations
No response
Anything else?
This issue is being created separately based on the discussion in #70251 and the review of #70906.
The missing team DAG resource is independent of the UNANIMOUS versus AFFIRMATIVE decision strategy issue fixed by #70906.
Are you willing to submit PR?
Code of Conduct