`ApprovalOperator(assigned_users=...)` unusable with `SimpleAuthManager` when `simple_auth_manager_all_admins=True` (no one can approve/reject)

[zachliu]

Apache Airflow version

3.1.4

If "Other Airflow 2/3 version" selected, which one?

No response

What happened?

In Airflow 3.1.4, the ApprovalOperator’s assigned_users argument appears to depend on the configured auth manager.

When I use SimpleAuthManager and set simple_auth_manager_all_admins=True, assigned_users becomes effectively unusable: no one can approve or reject in the UI.

I suspect this is because when simple_auth_manager_all_admins=True, SimpleAuthManager does not create/populate the ab_user table, so assigned_users has no user table to resolve against.

What you think should happen instead?

When simple_auth_manager_all_admins=True, ApprovalOperator should ignore assigned_users (or treat it as “everyone”) and allow all logged-in users to approve/reject, since “all admins” mode implies there is no real user directory backing assigned_users.

(Alternatively, Airflow could validate this configuration and raise a clear error explaining that assigned_users requires a real user store, but the current behavior is a silent “nobody can approve.”)

How to reproduce

1. Configure the auth manager to SimpleAuthManager
2. Set simple_auth_manager_all_admins to True
3. Create a DAG that uses ApprovalOperator with assigned_users set to one or more usernames or simple None
4. Trigger the DAG and open the approval UI

Operating System

LM 21.3 with docker python:3.12-slim-bookworm

Versions of Apache Airflow Providers

No response

Deployment

Docker-Compose

Deployment details

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[Lee-W]

When simple_auth_manager_all_admins=True, ApprovalOperator should ignore assigned_users (or treat it as “everyone”) and allow all logged-in users to approve/reject, since “all admins” mode implies there is no real user directory backing assigned_users.

(Alternatively, Airflow could validate this configuration and raise a clear error explaining that assigned_users requires a real user store, but the current behavior is a silent “nobody can approve.”)

According to the config name, I think the SimpleAuthManager should have a way to map all users as admin instead. This is not part of the BaseAuthManger so we shouldn't change HITL for a single AuthManger

[zachliu]

According to the config name, I think the SimpleAuthManager should have a way to map all users as admin instead. This is not part of the BaseAuthManger so we shouldn't change HITL for a single AuthManger

fair enough. this is not an urgent 🐛, we only use SimpleAuthManager with simple_auth_manager_all_admins=True in our staging environment. though it would be nice for people to test out their hitl workflow in the staging env

[potiuk]

Yeah. I think this is just a question of proper "generic" way of handling it by Auth Manager. It should not be if "Simple" - do this.
cc: @vincbeck

[potiuk]

For example auth manager could have a "isAllowed(user_id, assigned_users)" (or isInUserList maybe or more creative name) method that would be implemented by each Auth Manager. And SimpleAuthManager with "all-admin" would simply ignore assigned_users.

BTW. I think current implementation (I looked at the implementation) has a small bug. If I am not mistaken, currently the whole HITLUser is compared with actual user and this comparision includes both - id and name of the user. Which is somewhat prone to error, because if the user name changes (which can happen for example when someone changes legal name - for example by marriage) it might happen that the user will lose access to their HITL workflows.

[TempestShaw]

I'd be happy to contribute a fix for this issue, if it's currently open for new contributer.
My plan is to implement a generic AuthManager hook or method to address the assigned_users evaluation, as discussed.
Please let me know if this approach aligns with expectations and if you can provide any further information to help me get started.