Command airflow users reset-password dont work anymore in version 2.11.2

[florian-meyrueis-al]

Apache Airflow version

2.11.X

If "Other Airflow 3 version" selected, which one?

No response

What happened?

Hi,

When deploying airflow 2.11.2 on our k8s cluster we faced an issue with the command :

airflow users reset-password --username demo_admin --password 'ResetPass456!'

stacktrace is :

Traceback (most recent call last):
  File "/home/airflow/.local/lib/python3.12/site-packages/sqlalchemy/util/_collections.py", line 1008, in __call__
    return self.registry[key]
           ~~~~~~~~~~~~~^^^^^
KeyError: <greenlet.greenlet object at 0x7f4891889f40 (otid=0x7f4891879b30) current active started main>

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/airflow/.local/bin/airflow", line 6, in <module>
    sys.exit(main())
             ^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/__main__.py", line 62, in main
    args.func(args)
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/cli/cli_config.py", line 49, in command
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/utils/cli.py", line 116, in wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/utils/providers_configuration_loader.py", line 55, in wrapped_function
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/cli_commands/user_command.py", line 108, in user_reset_password
    if appbuilder.sm.reset_password(user.id, password):
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/security_manager/override.py", line 554, in reset_password
    self.reset_user_sessions(user)
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/security_manager/override.py", line 562, in reset_user_sessions
    num_sessions = session.query(user_session_model).count()
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<string>", line 2, in query
  File "/home/airflow/.local/lib/python3.12/site-packages/sqlalchemy/orm/scoping.py", line 24, in _proxied
    return self.registry()
           ^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/sqlalchemy/util/_collections.py", line 1010, in __call__
    return self.registry.setdefault(key, self.createfunc())
                                         ^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/sqlalchemy/orm/session.py", line 4279, in __call__
    return self.class_(**local_kw)
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/flask_sqlalchemy/__init__.py", line 176, in __init__
    bind = options.pop('bind', None) or db.engine
                                        ^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/flask_sqlalchemy/__init__.py", line 998, in engine
    return self.get_engine()
           ^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/flask_sqlalchemy/__init__.py", line 1008, in get_engine
    state = get_state(app)
            ^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/flask_sqlalchemy/__init__.py", line 625, in get_state
    assert 'sqlalchemy' in app.extensions, \
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: The sqlalchemy extension was not registered to the current application.  Please make sure to call init_app() first.

I was thinking an issue bertween airflow 2.11.2 and our version of helm chart(1.16.0), so i tried with standalone :

set -e
IMAGE="apache/airflow:2.11.2-python3.12"
NAME="airflow-standalone-2112"
docker pull "$IMAGE"
(docker rm -f "$NAME" >/dev/null 2>&1 || true)
docker run -d --name "$NAME" -p 8080:8080 -e AIRFLOW__CORE__LOAD_EXAMPLES=False "$IMAGE" standalone

docker ps --filter name=airflow-standalone-2112 --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

docker exec airflow-standalone-2112 airflow users create --role Admin --username demo_admin --firstname Demo --lastname Admin --email demo_admin@example.com --password 'TempPass123!'

result is :

INFO - Added user demo_admin
User "demo_admin" created with role "Admin"

Finally:
docker exec airflow-standalone-2112 airflow users reset-password --username demo_admin --password 'ResetPass456!'

Fails with the same error message as above.

What you think should happen instead?

User password reset should work as expected and on later version.

How to reproduce

See above with standalone test

Operating System

debian

Versions of Apache Airflow Providers

No response

Deployment

Official Apache Airflow Helm Chart

Deployment details

No response

Anything else?

Apparently, the same also fails in 2.11.1

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[florian-meyrueis-al]

After some investigation it appears that the problem comes from the following facts :

• we store _session_interface which is a global variable.
• In the user_reset_password, we first do a find_user() (first flask app), which stores the AirflowDatabaseSessionInterface in the global.
• then we try to perform the reset_password through security manager (2nd flask app).
• As the session interface is already stored in the global, we try to use it.

as a result we never call the db.init_app, for the second app, so the sqlalchemy extension is never registered for the second flask app, resulting in the error.

Interestingly, unit tests works well with this bug. It looks like it's because we have a session_interface already set as a fixture and it's used by all subsequent call.