Skip to content

Display owner_display_name in Audit Log - #68833

Merged
bbovenzi merged 3 commits into
apache:mainfrom
VladaZakharova:audit-log-change
Jul 27, 2026
Merged

Display owner_display_name in Audit Log#68833
bbovenzi merged 3 commits into
apache:mainfrom
VladaZakharova:audit-log-change

Conversation

@VladaZakharova

@VladaZakharova VladaZakharova commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

In Breeze / community Airflow, there are several types of auth managers that have different sets of fields, which actually leads to different data stored to DB about the user.
The default auth manager is usually SimpleAuthManager. It only knows simple login data like:

  • username
  • role
  • password

For example:
username: admin
role: admin
password: admin

So in default Breeze, the new column will look the same as old one:
User: admin.
User Display Name: admin.

The other one that can be also used is FAB manager. Available fields are:

  • username
  • first_name
  • last_name
  • email
  • password
  • role

The common solution will be for different auth managers like this:


   If first_name and last_name exist:
       show "first_name last_name"

   Else if email exists:
       show "email"

   Else:
       show "username"

Example:
first_name = Jane.
last_name = Smith.
email = jane@example.com.
username = jane.

User = jane.
User Display Name = Jane Smith.

Or:
first_name = empty.
last_name = empty.
email = jane@example.com.
username = jane.

User = jane.
User Display Name = jane@example.com.

This change will make the Audit log more informative for users.
Example how it will look like:
Screenshot 2026-06-17 at 12 53 38

The change is implemented as a new Column in Audit Logs tab, which can be also hidden in side menu by user, if preferred to not be shown.


Was generative AI tooling used to co-author this PR?
  • Yes (please specify the tool below)

  • Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
  • For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
  • When adding dependency, check compliance with the ASF 3rd Party License Policy.
  • For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

Was generative AI tooling used to co-author this PR?
  • Yes (please specify the tool below)

  • Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
  • For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
  • When adding dependency, check compliance with the ASF 3rd Party License Policy.
  • For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

Important

🛠️ Maintainer triage note for @VladaZakharova · by @potiuk · 2026-07-11 14:59 UTC

Helpful heads-up from the maintainers — please address before this PR can be reviewed (see our Pull Request quality criteria):

  • Pre-commit / static checks. See docs.

The ball is in your court — you've been assigned to this PR. Fix the above, then mark it Ready for review.

Automated triage — may be imperfect; a maintainer takes the next look.

@pierrejeambrun pierrejeambrun left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the pull request.

CI need fixing (e2e tests).

Also I'm not sure about this, because there are plenty of other Log creation path and most of them do not populate the owner_display_name field. _add_log, task execution events, task fail/skip/running, scheduler events (scheduler_job_runner.py), buffered task events, asset events.

I'm afraid that showing this will highlight an inconsistent attribute. (None most of the time, unless it's created by the API layer). I wouldn't show this to the UI users unless we fix all the event creation path to properly populate the owner_display_name attribute.

@VladaZakharova

Copy link
Copy Markdown
Contributor Author

Thanks, I agree that showing the raw stored Log.owner_display_name would be inconsistent today.

I’ll adjust the PR so owner_display_name is resolved at read time in the event-log API response instead of relying on every Log(...) creation path to populate it. The API can use Log.owner to look up the matching Airflow user by username/email and return a best-effort display name, falling back to the stored owner_display_name or owner when needed. Like this:

UI column = log.owner_display_name OR user lookup from log.owner OR log.owner

@pierrejeambrun pierrejeambrun left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few things to address below

Comment thread airflow-core/src/airflow/api_fastapi/core_api/routes/public/event_logs.py Outdated
Comment thread airflow-core/src/airflow/api_fastapi/core_api/routes/public/event_logs.py Outdated
Comment thread airflow-core/src/airflow/api_fastapi/core_api/routes/public/event_logs.py Outdated
Comment thread airflow-core/src/airflow/api_fastapi/core_api/routes/public/event_logs.py Outdated
Comment thread airflow-core/src/airflow/api_fastapi/core_api/routes/public/event_logs.py Outdated
@eladkal
eladkal marked this pull request as ready for review July 23, 2026 00:23
@eladkal
eladkal requested a review from henry3260 as a code owner July 23, 2026 00:23
@eladkal
eladkal force-pushed the audit-log-change branch from cdc16c8 to 07333fb Compare July 23, 2026 00:24
@Lee-W
Lee-W force-pushed the audit-log-change branch from 07333fb to 394f1cb Compare July 23, 2026 01:42
@Lee-W

Lee-W commented Jul 23, 2026

Copy link
Copy Markdown
Member

rebased from the main branch for the latest CI fix

@eladkal eladkal modified the milestones: Airflow 3.3.1, Airflow 3.4.0 Jul 23, 2026

@amoghrajesh amoghrajesh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs some more work.

Comment thread airflow-core/src/airflow/api_fastapi/core_api/services/public/event_logs.py Outdated
Comment thread airflow-core/src/airflow/api_fastapi/logging/decorators.py Outdated
Comment thread airflow-core/src/airflow/ui/src/pages/Events/Events.tsx Outdated
Comment thread airflow-core/src/airflow/api_fastapi/core_api/services/public/event_logs.py Outdated
Comment thread airflow-core/src/airflow/ui/src/pages/Events/Events.tsx Outdated
@amoghrajesh

Copy link
Copy Markdown
Contributor

Hello @VladaZakharova, will you be able to take a look at the comments? I have rebased it.

amoghrajesh and others added 2 commits July 27, 2026 11:52
Return the display name recorded when the action was logged and fall back
to the raw owner, rather than recomputing it from the current viewer — an
audit entry's owner should not change depending on who reads it. Keep it in
the existing owner column instead of adding a second one.
@bbovenzi bbovenzi changed the title Displaying first_name+last_name or email in "Audit Log" on DAG details page Display owner_display_name in Audit Log Jul 27, 2026
@bbovenzi
bbovenzi merged commit 48dc012 into apache:main Jul 27, 2026
156 checks passed
@github-actions

Copy link
Copy Markdown
Contributor

Backport failed to create: airflow-ctl/v0-1-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status Branch Result
airflow-ctl/v0-1-test Commit Link

You can attempt to backport this manually by running:

cherry_picker 48dc012 airflow-ctl/v0-1-test

This should apply the commit to the airflow-ctl/v0-1-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.

@amoghrajesh amoghrajesh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

owner and owner_display_name are both set from the same user.get_name() call in https://github.com/apache/airflow/blob/main/airflow-core/src/airflow/api_fastapi/logging/decorators.py#L87-L164. So they will always be identical, no path where they diverge. Been true since owner_display_name was added, so this will not work.

@pierrejeambrun

Copy link
Copy Markdown
Member

I think we need a follow up PR, working on that.

pierrejeambrun added a commit that referenced this pull request Jul 28, 2026
* Show user display name in the audit log via get_display_name

The audit log's owner_display_name always equalled owner because the action
logger stored get_name() in both fields. Add a get_display_name() to the auth
manager user model, defaulting to get_name() so auth managers written before it
keep working unchanged, and have the FAB user return its full name. The action
logger now records get_display_name() as owner_display_name, so the audit log
can show a friendlier name than the raw owner identifier where one exists.

Follow-up to #68833.

* Add an owner display name filter to the audit log

The audit log user column now shows owner_display_name, so its filter should
match that value. Add server-side pattern and prefix-pattern search params on
owner_display_name and point the existing User filter at them, and drop the
redundant UI owner fallback so the displayed value and the filter stay in sync.

* Use spec on the mocked request and session in the decorator test

* Use a real request instead of a mock in the decorator test

A real Request built from a minimal ASGI scope supplies genuine empty
headers/query/path params, so nothing needs stubbing and the test cannot drift
from the real request interface. The session stays a spec'd mock to capture the
logged row.
@VladaZakharova

Copy link
Copy Markdown
Contributor Author

@pierrejeambrun
Wow, thank you for your help here, really :)
I was on sick leave and didn't have time to finish the work, but with your impact it is done, thank you again!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants