Can't create users from the web UI

[gongomgra]

Apache Airflow version

3.0.2

If "Other Airflow 2 version" selected, which one?

No response

What happened?

I have installed the Helm chart (from main branch) with default values and the Airflow 3.0.2 version image. When completing the form to add a new user (/security/users/add URI), an "unsupported hash type scrypt" error is returned and the new user is not created.

Is there any workaround for this error? Am I missing any configuration option?

What you think should happen instead?

This workflow has worked in all previous versions of Airflow. I don't see much related information in the api-server pod logs

INFO:     127.0.0.1:38264 - "POST /auth/users/add HTTP/1.1" 302 Found
INFO:     127.0.0.1:38264 - "GET /auth/users/list/ HTTP/1.1" 200 OK
INFO:     127.0.0.1:38264 - "GET /auth/static/appbuilder/css/bootstrap.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38270 - "GET /auth/static/appbuilder/css/fontawesome/fontawesome.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38304 - "GET /auth/static/appbuilder/css/fontawesome/regular.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38292 - "GET /auth/static/appbuilder/css/fontawesome/brands.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38252 - "GET /auth/static/appbuilder/css/fontawesome/v4-shims.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38278 - "GET /auth/static/appbuilder/css/fontawesome/solid.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38270 - "GET /auth/static/appbuilder/css/select2/select2.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38264 - "GET /auth/static/appbuilder/css/bootstrap-datepicker/bootstrap-datepicker3.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38270 - "GET /auth/static/dist/materialIcons.4fd835641d53f81af3d3.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38304 - "GET /auth/static/appbuilder/css/select2/select2-bootstrap.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38252 - "GET /auth/static/appbuilder/css/flags/flags16.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38264 - "GET /auth/static/dist/main.49c4d5787ef1f247f004.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38292 - "GET /auth/static/appbuilder/css/ab.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38270 - "GET /auth/static/dist/loadingDots.96221bc8b6345c7d65b3.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38278 - "GET /auth/static/dist/airflowDefaultTheme.48540e25fb1e474cef20.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38304 - "GET /auth/static/dist/jquery-ui.min.css HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:38252 - "GET /auth/static/dist/flash.02dea0c2ac20820e8d1b.css HTTP/1.1" 304 Not Modified

How to reproduce

Install the Helm chart with default values and try to create a new user from the web UI.

Operating System

Debian 12

Versions of Apache Airflow Providers

airflow@airflow-api-server-6449f95df8-rfcw6:/opt/airflow$ pip freeze | grep apache-airflow-providers
apache-airflow-providers-amazon==9.8.0
apache-airflow-providers-celery==3.11.0
apache-airflow-providers-cncf-kubernetes==10.5.0
apache-airflow-providers-common-compat==1.7.0
apache-airflow-providers-common-io==1.6.0
apache-airflow-providers-common-messaging==1.0.2
apache-airflow-providers-common-sql==1.27.1
apache-airflow-providers-docker==4.4.0
apache-airflow-providers-elasticsearch==6.3.0
apache-airflow-providers-fab==2.2.0
apache-airflow-providers-ftp==3.13.0
apache-airflow-providers-git==0.0.2
apache-airflow-providers-google==15.1.0
apache-airflow-providers-grpc==3.8.0
apache-airflow-providers-hashicorp==4.2.0
apache-airflow-providers-http==5.3.0
apache-airflow-providers-microsoft-azure==12.4.0
apache-airflow-providers-mysql==6.3.0
apache-airflow-providers-odbc==4.10.0
apache-airflow-providers-openlineage==2.3.0
apache-airflow-providers-postgres==6.2.0
apache-airflow-providers-redis==4.1.0
apache-airflow-providers-sendgrid==4.1.0
apache-airflow-providers-sftp==5.3.0
apache-airflow-providers-slack==9.1.0
apache-airflow-providers-smtp==2.1.0
apache-airflow-providers-snowflake==6.3.1
apache-airflow-providers-ssh==4.1.0
apache-airflow-providers-standard==1.2.0

Deployment

Official Apache Airflow Helm Chart

Deployment details

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[potiuk]

Yes. Apparently you are using very old system which does not support newer openssl. You should upgrade your base operating system to something way newer. Look at similar discussions and issues in history for details (and query google).

[gongomgra]

Hi @potiuk

Thanks for your response. I'm facing this error with your official images. This is the information I have been able to collect regarding the OS and the OpenSSL version

$ k -n airflow describe po airflow-api-server-6449f95df8-hnj8b | grep -i image | head -n 2
    Image:         apache/airflow:3.0.2
    Image ID:      docker-pullable://apache/airflow@sha256:27665dff7bc6c0d7584e64427467e997a6644260b99efe3e807078d1620b37ff

$ k -n airflow exec -it airflow-api-server-6449f95df8-hnj8b -- bash
airflow@airflow-api-server-6449f95df8-hnj8b:/opt/airflow$ dpkg -l openssl
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version          Architecture Description
+++-==============-================-============-====================================================
ii  openssl        3.0.16-1~deb12u1 arm64        Secure Sockets Layer toolkit - cryptographic utility

airflow@airflow-api-server-6449f95df8-hnj8b:/opt/airflow$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

I have been able to reproduce the error message from within the Python console directly. It seems there is an incompatibility between the OpenSSL version and the Werkzeug module. It works for the pbkdf2 method (which seems to be the default method for Werkzeug 2.2.3 according to their GitHub repo), but not for scrypt:

airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ pip list | grep -i werk
Werkzeug                                  2.2.3

airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ python
>>> import werkzeug.security
>>> werkzeug.security.generate_password_hash('test1234')
'pbkdf2:sha256:260000$pn0MkVydoxkqpo7W$56daa9162e8b881e52be6467ff8dd819e46371c1ecaad0838cbbdefc53448a9b'

>>> werkzeug.security.generate_password_hash(password='test1234', method='scrypt')
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/hmac.py", line 60, in __init__
    self._init_hmac(key, msg, digestmod)
  File "/usr/local/lib/python3.12/hmac.py", line 67, in _init_hmac
    self._hmac = _hashopenssl.hmac_new(key, msg, digestmod=digestmod)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.12/hashlib.py", line 160, in __hash_new
    return _hashlib.new(name, data, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/airflow/.local/lib/python3.12/site-packages/werkzeug/security.py", line 88, in generate_password_hash
    h, actual_method = _hash_internal(method, salt, password)
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/werkzeug/security.py", line 55, in _hash_internal
    return hmac.new(salt, password, method).hexdigest(), method
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/hmac.py", line 184, in new
    return HMAC(key, msg, digestmod)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/hmac.py", line 62, in __init__
    self._init_old(key, msg, digestmod)
  File "/usr/local/lib/python3.12/hmac.py", line 80, in _init_old
    self._outer = digest_cons()
                  ^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/hmac.py", line 75, in <lambda>
    digest_cons = lambda d=b'': _hashlib.new(digestmod, d)
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/hashlib.py", line 166, in __hash_new
    return __get_builtin_constructor(name)(data)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/hashlib.py", line 123, in __get_builtin_constructor
    raise ValueError('unsupported hash type ' + name)
ValueError: unsupported hash type scrypt

I have also given a try to the next available version for Werkzeug (2.3.0), and the scrypt hashing method works, but it looks like Airflow does not work with it (I get an infinite redirect after login into the web UI). I'm aware that using a newer Werkzeug version does break the defined constraints, but I've simply updated it for testing purposes:

airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ pip install Werkzeug==2.3.0
Collecting Werkzeug==2.3.0
  Downloading Werkzeug-2.3.0-py3-none-any.whl.metadata (4.2 kB)
Requirement already satisfied: MarkupSafe>=2.1.1 in /home/airflow/.local/lib/python3.12/site-packages (from Werkzeug==2.3.0) (3.0.2)
Downloading Werkzeug-2.3.0-py3-none-any.whl (233 kB)
Installing collected packages: Werkzeug
  Attempting uninstall: Werkzeug
    Found existing installation: Werkzeug 2.2.3
    Uninstalling Werkzeug-2.2.3:
      Successfully uninstalled Werkzeug-2.2.3
ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
connexion 2.14.2 requires werkzeug<2.3,>=1.0, but you have werkzeug 2.3.0 which is incompatible.
Successfully installed Werkzeug-2.3.0


airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ python
Python 3.12.11 (main, Jun  4 2025, 18:32:16) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import werkzeug.security
>>> werkzeug.security.generate_password_hash('test1234')
'pbkdf2:sha256:600000$3q7rvemNBaqHFEeM$46cddab9295b0979f1b138737943b384d89edbfeeb2bf6c9be284d261918afc1'
>>> werkzeug.security.generate_password_hash(password='test1234', method='scrypt')
'scrypt:32768:8:1$nLlZs8E3ZuYUC9ay$ae903848f37a1cd251fefa57bd1eb2ff71e9171e34d761b5de47bf857173cc836ce12d6efc16b1da741cec3e08e86d26edfc72f60f755b3dcaf1120a973134e3'

Can you please take a look at this? Thanks in advance

[opeida]

@potiuk I faced the same issue with the official apache/airflow:slim-3.0.2-python3.12 image deployed with the official Helm chart v1.17.0rc1

[potiuk]

OK. You have not explained what configuration you use for your users. The image works fine when creating users in the "regular" way (i.e. with DB). But likely what you have is that whatever OID provider you use sets the hashing algorithm to scrypt and for reasons explained in #36007 (comment) we cannot upgrade to newer Werkzeug version.

If my guess is right - that the scrypt hashing is something that is set by your provider - find a way to change the hashing algorithm is a way to follow. Currently it's the only way to handle it - and only you can do it.

The good news is that we have - maybe - a way soon to upgrade - by upgrading connexion and working with Flask App Builder - I would really appreciate if you could explain your case and up-vote and express your need to be able to do so. But we need people like you - real users who struggle with those issues and have a need to solve it differently would comment on the issues and put a "pressure" on the developers of the libraries we use to respond to our requests:

Details and links to all the relevant issues are here https://lists.apache.org/thread/r7m6s09h53jvm05zj19g5o7w31phr4t4

But I would particularly appreciate if you could explain your problem and support my request to Connexion maintainers to relax their "flask>=3" requirement.

The relevant comment is here: spec-first/connexion#1992 (comment)

Another comment here: dpgaspar/Flask-AppBuilder#2241 (comment) where I ask Flask Application Builder if they can change the upcoming version of Flask Application Builder (5) to support Flask 3

If either of those two problems is solved, we would be able to upgrade Werkzeug and have support for scrypt. But if none of them will, we are blocked and you need to look for ways how to change "scrypt" to other hashing algorithm.

For now - we are completely blocked to do anything and only users like you who will reiterate their problems in the relevant issues, can help.

Looking forward to your comments @opeida @gongomgra

[potiuk]

But again - I am guessing that the scrypt hashing comes from your OID provider (as in the linked issue) - that's more of a guess than anything else. Maybe there are other reasons? Can you explain what is your authentication configuration ?

[potiuk]

OK. I think I found the issue. If you can confirm to me that you do not have OID provider I can have a workaround for you and fix in the making.

[opeida]

@potiuk wow! Thanks for the detailed response!
I would like to help with feedback from the user perspective. Just need some of your guidance on what information is needed.

Our setup has nothing special: PostgreSQL, FabAuthManager, and no external OID providers (like Google) are used. The extended image based on apache/airflow:slim-3.0.2-python3.12, deployed with Helm chart v1.17.0rc1 on GKE.

Dockerfile:

FROM apache/airflow:slim-3.0.2-python3.12
USER root

RUN apt update \
    && ACCEPT_EULA=Y apt upgrade -y \
    && apt install -y --no-install-recommends \
        git-all \
        neovim \
        libglib2.0-0 \
        libsm6 \
        libxext6 \
        libxrender1 \
        libopencv-dev \
        ffmpeg \
    && apt autoremove -yqq --purge \
    && apt clean \
    && rm -rf /var/lib/apt/lists/*

USER airflow

WORKDIR /opt/airflow
COPY requirements.txt /opt/airflow/requirements.txt
COPY .secrets/adders-automation-5207283d6492.json /opt/airflow/service_account.json

RUN uv pip install --upgrade pip
RUN uv pip install --no-cache-dir "apache-airflow==${AIRFLOW_VERSION}" -r requirements.txt

Packages to extend the image:

aiohttp
apache-airflow-providers-celery
apache-airflow-providers-fab
apache-airflow-providers-google
apache-airflow-providers-http
apache-airflow-providers-postgres
apache-airflow-providers-redis
google-cloud-bigquery-storage
google-cloud-firestore
gspread
opencv-python
pandas
pydantic
pydantic-extra-types
python-telegram-bot
tenacity
throttler
sentry_sdk
validators

And a similar issue has just been created: #51854