[v3-1-test] Fix race condition in auth manager initialization (#62214) by jason810496 · Pull Request #62326 · apache/airflow

jason810496 · 2026-02-22T15:34:49Z

Fix race condition in auth manager initialization

Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously.

Closes: #61108

Handle auth manager class change in singleton cache

The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade).

Avoid calling get_auth_manager_cls on every create_auth_manager call

Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs.

Reset auth manager singleton in get_application_builder

Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION).

Clear auth manager singleton in test fixtures using create_app

Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride.

Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a)

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

…#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: apache#61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

bugraoz93 · 2026-02-23T21:24:21Z

CI not related

#62326) * [v3-1-test] Fix race condition in auth manager initialization (#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: #61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com> * Fix CI error --------- Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

jason810496 · 2026-02-22T15:34:49Z

Fix race condition in auth manager initialization

Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously.

Closes: #61108

Handle auth manager class change in singleton cache

The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade).

Avoid calling get_auth_manager_cls on every create_auth_manager call

Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs.

Reset auth manager singleton in get_application_builder

Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION).

Clear auth manager singleton in test fixtures using create_app

Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride.

Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a)

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

…#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: apache#61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

bugraoz93 · 2026-02-23T21:24:21Z

CI not related

#62326) * [v3-1-test] Fix race condition in auth manager initialization (#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: #61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com> * Fix CI error --------- Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

jason810496 · 2026-02-22T15:34:49Z

Fix race condition in auth manager initialization

Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously.

Closes: #61108

Handle auth manager class change in singleton cache

The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade).

Avoid calling get_auth_manager_cls on every create_auth_manager call

Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs.

Reset auth manager singleton in get_application_builder

Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION).

Clear auth manager singleton in test fixtures using create_app

Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride.

Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a)

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

…#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: apache#61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

bugraoz93 · 2026-02-23T21:24:21Z

CI not related

#62326) * [v3-1-test] Fix race condition in auth manager initialization (#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: #61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com> * Fix CI error --------- Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

jason810496 · 2026-02-22T15:34:49Z

Fix race condition in auth manager initialization

Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously.

Closes: #61108

Handle auth manager class change in singleton cache

The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade).

Avoid calling get_auth_manager_cls on every create_auth_manager call

Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs.

Reset auth manager singleton in get_application_builder

Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION).

Clear auth manager singleton in test fixtures using create_app

Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride.

Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a)

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

…#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: apache#61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

bugraoz93 · 2026-02-23T21:24:21Z

CI not related

#62326) * [v3-1-test] Fix race condition in auth manager initialization (#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: #61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com> * Fix CI error --------- Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

jason810496 · 2026-02-22T15:34:49Z

Fix race condition in auth manager initialization

Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously.

Closes: #61108

Handle auth manager class change in singleton cache

The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade).

Avoid calling get_auth_manager_cls on every create_auth_manager call

Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs.

Reset auth manager singleton in get_application_builder

Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION).

Clear auth manager singleton in test fixtures using create_app

Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride.

Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a)

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

…#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: apache#61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

bugraoz93 · 2026-02-23T21:24:21Z

CI not related

#62326) * [v3-1-test] Fix race condition in auth manager initialization (#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: #61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com> * Fix CI error --------- Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

jason810496 · 2026-02-22T15:34:49Z

Fix race condition in auth manager initialization

Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously.

Closes: #61108

Handle auth manager class change in singleton cache

The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade).

Avoid calling get_auth_manager_cls on every create_auth_manager call

Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs.

Reset auth manager singleton in get_application_builder

Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION).

Clear auth manager singleton in test fixtures using create_app

Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride.

Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a)

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

…#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: apache#61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

bugraoz93 · 2026-02-23T21:24:21Z

CI not related

#62326) * [v3-1-test] Fix race condition in auth manager initialization (#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: #61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com> * Fix CI error --------- Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

jason810496 · 2026-02-22T15:34:49Z

Fix race condition in auth manager initialization

Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously.

Closes: #61108

Handle auth manager class change in singleton cache

The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade).

Avoid calling get_auth_manager_cls on every create_auth_manager call

Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs.

Reset auth manager singleton in get_application_builder

Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION).

Clear auth manager singleton in test fixtures using create_app

Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride.

Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a)

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

…#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: apache#61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

bugraoz93 · 2026-02-23T21:24:21Z

CI not related

#62326) * [v3-1-test] Fix race condition in auth manager initialization (#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: #61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com> * Fix CI error --------- Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

jason810496 · 2026-02-22T15:34:49Z

Fix race condition in auth manager initialization

Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously.

Closes: #61108

Handle auth manager class change in singleton cache

The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade).

Avoid calling get_auth_manager_cls on every create_auth_manager call

Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs.

Reset auth manager singleton in get_application_builder

Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION).

Clear auth manager singleton in test fixtures using create_app

Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride.

Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a)

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

…#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: apache#61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

bugraoz93 · 2026-02-23T21:24:21Z

CI not related

#62326) * [v3-1-test] Fix race condition in auth manager initialization (#62214) * Fix race condition in auth manager initialization Make create_auth_manager() thread-safe using double-checked locking to prevent concurrent requests from creating multiple auth manager instances. This fixes intermittent 500 errors on /auth/token when multiple requests arrive simultaneously. Closes: #61108 * Handle auth manager class change in singleton cache The singleton check now also verifies the cached instance matches the currently configured auth manager class. This prevents stale instances when the config changes (e.g. switching between SimpleAuthManager and FabAuthManager during db upgrade). * Avoid calling get_auth_manager_cls on every create_auth_manager call Move get_auth_manager_cls() inside the lock so the fast path is just a None check. Add purge_cached_app() in test_upgradedb to ensure clean state between parametrized cases with different auth manager configs. * Reset auth manager singleton in get_application_builder Since get_application_builder creates a fresh Flask app each time, the cached auth manager singleton from a previous app context must be cleared to avoid stale state (e.g. KeyError on AUTH_USER_REGISTRATION). * Clear auth manager singleton in test fixtures using create_app Test fixtures that call application.create_app() or get_application_builder() can receive a stale auth manager singleton from a previous test, causing AirflowSecurityManagerV2 to be used instead of FabAirflowSecurityManagerOverride. Add purge_cached_app() calls to test fixtures across fab, google, and keycloak providers to ensure each test gets a fresh auth manager instance. (cherry picked from commit 5c9171a) Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com> * Fix CI error --------- Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

boring-cyborgBot added area:API Airflow's REST/HTTP API area:providers provider:fab provider:google Google (including GCP) related issues provider:keycloak labels Feb 22, 2026

jason810496 mentioned this pull request Feb 22, 2026
Fix race condition in auth manager initialization #62214
Merged

Fix CI error
ca85fd9

jason810496 marked this pull request as ready for review February 23, 2026 09:38

jason810496 requested review from bugraoz93, ephraimbuddy, pierrejeambrun, rawwar, shubhamraj-git and vincbeck as code owners February 23, 2026 09:38

vincbeck approved these changes Feb 23, 2026
View reviewed changes

bugraoz93 approved these changes Feb 23, 2026
View reviewed changes

jason810496 merged commit 5605d32 into apache:v3-1-testFeb 24, 2026
320 of 324 checks passed

jason810496 added this to the Airflow 3.1.8 milestone Feb 24, 2026

pierrejeambrun mentioned this pull request Feb 24, 2026
Revert "[v3-1-test] Fix race condition in auth manager initialization (#62214)" #62407
Merged

vatsrahul1001 added the changelog:skip Changes that should be skipped from the changelog (CI, tests, etc..) label Feb 28, 2026