Add read config permission to viewer role in FabAuthManager

[vincbeck]

Related #49495.

One of the first thing the UI does is fetching the config. If the user does not have permission to read config, the UI logs out the user. Adding read config as part of viewer role in FabAuthManager.

---

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[pierrejeambrun]

Thanks Vincent

[Tpona]

When will the 3.0.1 release be released ?

[pierrejeambrun]

When will the 3.0.1 release be released ?

We are targeting 2 weeks from now. Unless we find a reason to do a patch release earlier.

[sachin27sharma]

Am using 3.0.3 and still seeing below error -
Running airflow in container, external port used is 8081, internal is 8080. Backend db is mysql.

Have set base url to use my linux server name too
base_url = http://:8081
auth_manager = airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager

Event tried setting export AIRFLOW__API__WEB_SERVER_PORT=8081
api auth_back is - auth_backend = airflow.api.auth.backend.basic_auth

10.0.2.100:33622 - "GET / HTTP/1.1" 200 OK
INFO: 10.0.2.100:33622 - "GET /ui/config HTTP/1.1" 401 Unauthorized
INFO: 10.0.2.100:33622 - "GET /api/v2/auth/login?next=http%3A%2F%2Feun041515%3A8081%2F HTTP/1.1" 307 Temporary Redirect
INFO: 10.0.2.100:33622 - "GET /ui/config HTTP/1.1" 401 Unauthorized
INFO: 10.0.2.100:33622 - "GET /api/v2/auth/login?next=http%3A%2F%2Feun041515%3A8081%2F HTTP/1.1" 307 Temporary Redirect
INFO: 10.0.2.100:33622 - "GET /ui/auth/menus HTTP/1.1" 401 Unauthorized
INFO: 10.0.2.100:33636 - "GET /ui/config HTTP/1.1" 401 Unauthorized
INFO: 10.0.2.100:33634 - "GET /api/v2/plugins HTTP/1.1" 401 Unauthorized
INFO: 10.0.2.100:33648 - "GET /api/v2/version HTTP/1.1" 200 OK

Let me know asap.

Thanks

[vincbeck]

Which Airflow version are you using? Because now, you only need to be authenticated to access /ui/config. It has been released in 3.0.2

[sachin27sharma]

Am using 3.0.3. I've created an admin user which I want to use to login to api-server. But on launching it is going in to redirection loop.

[pierrejeambrun]

What version of fab provider are you using ? Maybe you're behind on that? (also make sure to clear your browser data, for instance try in incognito mode to confirm that's not due to local remnant of cached data)

[sachin27sharma]

I noticed am using apache-airflow-providers-fab==2.0.1 with Flask-AppBuilder==4.5.2.
https://raw.githubusercontent.com/apache/airflow/constraints-3.0.3/constraints-3.11.txt

Believe airflow 3.0.3 requires - Flask-AppBuilder==4.6.3 & apache-airflow-providers-fab==2.3.0

Can you confirm if this could the root cause?

[vincbeck]

I noticed am using apache-airflow-providers-fab==2.0.1 with Flask-AppBuilder==4.5.2. https://raw.githubusercontent.com/apache/airflow/constraints-3.0.3/constraints-3.11.txt

Believe airflow 3.0.3 requires - Flask-AppBuilder==4.6.3 & apache-airflow-providers-fab==2.3.0

Can you confirm if this could the root cause?

I recommend you to use both the latest versions. Some work has been done in both core Airflow and FAB provider so you might have ended up in a very special situation. I am fairly certain that upgrading to both latest version would resolve your issue