apache / apache/airflow

`airflow sync-perm --include-dags` can fail due to a single misconfigured DAG

Open
#71,795 1 comment 0 reactions 0 assignees View on GitHub
area:auth kind:bug needs-triage
Dominant language
Python
Stars
46.9k
Forks
17.8k
Avg merge
2d 9h
Merged PRs (30d)
472

Description

### Under which category would you file this issue?

Providers

### Apache Airflow version

3.2.2

### What happened and how to reproduce it?

To reproduce the issue:
1. Create a dummy dag, and in access control block of the DAG, set a role that doesn't exist in the Airflow
2. This DAG shows up with import errors on Airflow UI, but still in serialized dags table
3. In the same container, or another container connecting to the same Airflow metadata DB, run `airflow sync-perm --include-dags`. It will fail with a FABException saying the role for that bad DAG doesn't exist, and it blocks permission sync for all other good DAGs.

### What you think should happen instead?

Bad/Misconfigured DAGs or non-existing roles should be ignored when running `airflow sync-perm --include-dags`, or at least, it should continue syncing permissions for other DAGs, instead of stopping at the misconfigured DAG.

### Operating System

_No response_

### Deployment

None

### Apache Airflow Provider(s)

fab

### Versions of Apache Airflow Providers

3.6.4

### Official Helm Chart version

Not Applicable

### Kubernetes Version

_No response_

### Helm Chart configuration

_No response_

### Docker Image customizations

Official 3.2.2 docker image

### Anything else?

_No response_

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure with a serialized DAG whose access-control role does not exist, then inspect the permission-sync path used by `airflow sync-perm --include-dags`. The work is done when the command ignores or reports the misconfigured DAG and continues syncing permissions for other valid DAGs.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authorization, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.