LDAP Giving 500 Error

[litesh1998]

Under which category would you file this issue?

Providers

Apache Airflow version

3.2.2

What happened and how to reproduce it?

When configuring LDAP authentication in Airflow 3, login attempts failed with an exception indicating that the ldap.filter module could not be found. The LDAP provider code imports and uses ldap.filter.escape_filter_chars(), but the ldap.filter submodule is not automatically imported by the python-ldap package in some environments.

As a result, LDAP authentication fails even though the python-ldap package is installed and functional.

Additionally, it was working on 3.6.2 but not working for 3.6.5

How to reproduce it?

1. Install Airflow 3 with LDAP authentication enabled.
2. Install python-ldap (e.g. version 3.4.7).
3. Configure LDAP authentication according to the Airflow documentation.
4. Start the Airflow webserver.
5. Attempt to log in using an LDAP user.
6. Observe that authentication fails with:
   AttributeError: module 'ldap' has no attribute 'filter'

The issue is resolved by explicitly importing ldap.filter before LDAP authentication code is executed. This suggests the provider should explicitly import ldap.filter rather than assuming it is available as an attribute of the ldap module.

What you think should happen instead?

LDAP authentication should work successfully when the supported python-ldap package is installed and configured correctly.

The LDAP provider should explicitly import any required submodules (such as ldap.filter) instead of assuming they are automatically available as attributes of the top-level ldap package.

If a required dependency is missing, Airflow should fail gracefully with a clear error message indicating the missing module, rather than raising:

AttributeError: module 'ldap' has no attribute 'filter'

Users should be able to configure and use LDAP authentication following the documented setup steps without needing to manually modify provider code or add additional imports.

Operating System

Rocky linux

Deployment

Virtualenv installation

Apache Airflow Provider(s)

fab

Versions of Apache Airflow Providers

3.6.5

Official Helm Chart version

Not Applicable

Kubernetes Version

No response

Helm Chart configuration

No response

Docker Image customizations

No response

Anything else?

webserver.py (redacted)

from airflow.providers.fab.auth_manager.auth_manager import FabAuthManager

AUTH_TYPE = AUTH_LDAP

AUTH_LDAP_SERVER = "ldaps://ldap.example.com"
AUTH_LDAP_SEARCH = "OU=Users,DC=example,DC=com"
AUTH_LDAP_BIND_USER = "svc.airflow"
AUTH_LDAP_BIND_PASSWORD = "REDACTED"

SECURITY_MANAGER_CLASS = "CustomSecurityManager"

Login fails with:

AttributeError: module 'ldap' has no attribute 'filter'

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[destitech-com]

I confirm this bug, airflow 3.2.1 works fine, the bug is due to the addition of the ldap filter in this commit

but the ldap module is loaded just once in the function "auth_user_ldap" despite being used in multiple functions of the override.py file

I can do a PR, but not sure of the right way to handle it, either import the ldap module at the beginning of this module (protected with catch except ?) or import it in each function which expect it ?

[destitech-com]

Proposed fix

[litesh1998]

@destitech-com, it will not work, I figured out a way to do this local, preparing pr, we are already importing ldap at [line 1931], what we need to do is add import of ldap.filters (

airflow/providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py

Line 1931 in 9c5843e

import ldap

)

[destitech-com]

@litesh1998 good work, sorry I made a wrong assumption that we were not going through current import before and that filter was made available by root import, should have tested before proposing.

[dheerajturaga]

Workaround: Force-load the submodule once at startup by adding this line to webserver_config.py:

  import ldap.filter

Since webserver_config.py is imported into the same process as the FAB security manager, this registers ldap.filter on the ldap module for the whole process and the 500 goes away. No rebuild needed just restart the API server / webserver.

[dheerajturaga]

cc: @shubhamraj-git