<p dir="auto"><strong>Apache Airflow version</strong>: 1.10.12</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>: Google Cloud Composer (tweaked environment running Airflow RBAC UI)</li>
</ul>
<p dir="auto"><strong>What happened</strong>:</p>
<p dir="auto">In Airflow RBAC UI, when switching between pages, 'Access is Denied' error message actually indicates missing permissions on the previously visited page.</p>
<p dir="auto">I understand the basic scenario for which this behavior has been designed:</p>
<ul dir="auto">
<li>I try to go to a page to which I don't have access, I am redirected to the home page, which shows 'Access is Denied', so I conclude that I don't have access to the page that I tried to open.</li>
</ul>
<p dir="auto">But the interactions which end up in showing 'Access is Denied' are not always that simple, and this is where it gets confusing to show the message on a different page than the one to which the user had no access:</p>
<ul dir="auto">
<li>When I'm an Admin and go to List Users, click Edit record on my user, change my role from Admin to Viewer, click Save, I am redirected to the home page, which shows a green 'Changed Row' message and a red 'Access is Denied'.
<ul dir="auto">
<li>This is a confusing signal. Did the role assignment succeed or not? Which access was denied if I didn't try to open any page? (I know the messages come from successful user record update and unsuccessful load of List Users page to which I'm redirected after clicking Save - but not every user may realize this.)</li>
</ul>
</li>
</ul>
<p dir="auto"><a target="_blank" rel="noopener noreferrer nofollow" href="https://user-images.githubusercontent.com/12511618/98655992-6e47a400-2340-11eb-9eae-a903e4f1a8c0.png"><img src="https://user-images.githubusercontent.com/12511618/98655992-6e47a400-2340-11eb-9eae-a903e4f1a8c0.png" alt="Changed Row - Access is Denied" style="max-width: 100%;"></a></p>
<ul dir="auto">
<li>
<p dir="auto">When I don't have <code class="notranslate">can varimport on VariableModelView</code> permission and go to Variables page, choose a file, click Import Variables, I am redirected to the home page, which shows 'Access is Denied'.</p>
<ul dir="auto">
<li>How do I know which permissions I was missing? I might think that I didn't have permission to the file, which is not the case.</li>
</ul>
</li>
<li>
<p dir="auto">In Airflow 1.10.10 we've also observed a situation in which removing some permissions (from the current user's role) required for asynchronous work on the homepage, loading the homepage, and going to an unrelated page (like List Roles) resulted in showing a completely unexpected 'Access is Denied' message in that unrelated page.</p>
<ul dir="auto">
<li>This was the most confusing behavior but I'm not able to reproduce it in Airflow 1.10.12. Here, the asynchronous work on one page resulted in accumulating 'Access is Denied' message in the background, and showing it on the next page visited, no matter what the next page was.</li>
</ul>
</li>
</ul>
<p dir="auto">I guess this behavior may be built deeply into Flask-AppBuilder and hard to change. But it's still a UX concern for Airflow.</p>
<p dir="auto"><strong>What you expected to happen</strong>:</p>
<p dir="auto">'Access is Denied' error should clearly indicate which page or its fragment it refers to.</p>
<p dir="auto"><strong>How to reproduce it</strong>:</p>
<p dir="auto">Follow the setup and steps described in 'What happened' section.</p>
<p dir="auto">+cc <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/ryanahamilton/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/ryanahamilton">@ryanahamilton</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/k-jakub/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/k-jakub">@k-jakub</a></p>
<p dir="auto"><strong>Apache Airflow version</strong>: 2.0.1</p>
<p dir="auto"><strong>Kubernetes version (if you are using kubernetes)</strong> (use <code class="notranslate">kubectl version</code>): 1.19</p>
<p dir="auto"><strong>Environment</strong>: Kubernetes Executor, Okta OIDC</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>: EKS 1.19, RDS Postrgres DB</li>
<li><strong>OS</strong> (e.g. from /etc/os-release): Centos inside docker</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>):</li>
<li><strong>Install tools</strong>: helm</li>
<li><strong>Others</strong>: using official docker image apache/airflow:2.0.1-python3.7,  flask-oidc, fab-oidc2</li>
</ul>
<p dir="auto"><strong>What happened</strong>:<br>
We have integrated airflow 2 with Okta OIDC authentication/authorization using flask-oidc and fab-oidc2. When user login to Airflow console, user will be redirected to Okta login. Once user successful login to Okta, it will redirect back to airflow. On the airflow home page, there is an alert "Access is denied". If you refresh the page, the Alert will disappear. Even though the alert says access is denied, but the user can do everything. Self registration is enabled, all users have admin privileges. I've checked the user table and role table, both looks right to me and user should have admin privilege. The alert is just a false alarm and it only appears at user login.</p>

<p dir="auto"><strong>What you expected to happen</strong>: User login successful without alert</p>

<p dir="auto"><strong>How to reproduce it</strong>: Airflow 2.0.1 Integrate with Okta OIDC, login to airflow console. After user successfully login to airflow, the landing page will have "Access is denied".</p>

<p dir="auto"><strong>Anything else we need to know</strong>:</p>