[Bug] 500 Internal Server Error on /auth/fab/v1/users API due to Pydantic Timezone Validation (Airflow 3.1.6 + FAB 3.3.0)

[anyeole]

Apache Airflow Provider(s)

fab

Versions of Apache Airflow Providers

Apache Airflow version: 3.1.6 Provider version: apache-airflow-providers-fab==3.3.0 Database backend: MySQL (RDS)

Apache Airflow version

3.1.6

Operating System

Debian GNU/Linux 11 (bullseye)

Deployment

Other Docker-based deployment

Deployment details

No response

What happened

Description
When hitting the new FastAPI endpoint GET /auth/fab/v1/users to retrieve the list of users, the server crashes with a 500 Internal Server Error.

The root cause is a mismatch between the legacy FAB database models and the new FastAPI Pydantic response schemas regarding timezone awareness.

Logs / Exception Trace
log
INFO: 127.0.0.1:49162 - "GET /auth/fab/v1/users HTTP/1.1" 500 Internal Server Error ERROR: Exception in ASGI application ... File "/usr/local/lib/python3.10/site-packages/airflow/providers/fab/auth_manager/api_fastapi/services/users.py", line 91, in get_users users=[UserResponse.model_validate(u) for u in users], ... pydantic_core._pydantic_core.ValidationError: 3 validation errors for UserResponse last_login Input should have timezone info [type=timezone_aware, input_value=datetime.datetime(2026, 2, 22, 10, 13, 13), input_type=datetime] For further information visit https://errors.pydantic.dev/2.12/v/timezone_aware created_on Input should have timezone info [type=timezone_aware, input_value=datetime.datetime(2026, 1, 21, 17, 0, 38), input_type=datetime] For further information visit https://errors.pydantic.dev/2.12/v/timezone_aware changed_on Input should have timezone info [type=timezone_aware, input_value=datetime.datetime(2026, 1, 21, 17, 0, 38), input_type=datetime] For further information visit https://errors.pydantic.dev/2.12/v/timezone_aware

Root Cause Analysis

1. The Pydantic Model (UserResponse) completely enforces UTC timezone-aware datetimes. It defines last_login, created_on, and changed_on as UtcDateTime (from airflow.api_fastapi.common.types).
2. The SQLAlchemy Model (User) defines these properties using standard sqlalchemy.DateTime
   The Clash: When using MySQL or Postgres, SQLAlchemy returns naive Python datetime.datetime objects. When UserResponse.model_validate(u) executes, Pydantic immediately rejects these naive datetimes and throws a 500 error.

What you think should happen instead

No response

How to reproduce

1. Run Airflow 3.1.6 with apache-airflow-providers-fab==3.3.0 backed by MySQL.
2. Authenticate to obtain a valid JWT/Session.
3. Call GET /auth/fab/v1/users.
   Observe the 500 Internal Server Error in the API server logs.

Anything else

Suggested Fix:

1. Update the FAB UserResponse model to use standard datetime instead of UtcDateTime
   to allow for the naive dates returned by the legacy Flask-AppBuilder SQLAlchemy models.

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.