Apply configuration defined in webserver_config.py to Flask config

[vincbeck]

In AF2 you can extend the Flask application configuration in $AIRFLOW_HOME/webserver_config.py. We must keep this mechanism in FAB provider in AF3 because many users rely on it (and some features as well). The documentation refers to this file as well. This is an issue reported by @zachliu on Slack.

---

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[potiuk]

nice!

[zachliu]

Here’s a summary of the issue (Slack messages only have a 90-day lifespan):

• Airflow version: 3.0.0rc1.post2, providers-fab version: 2.0.0rc3

• airflow.cfg contains:

  [core]
  auth_manager = airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager
  
  [fab]
  auth_backends = airflow.providers.fab.auth_manager.api.auth.backend.basic_auth,airflow.providers.fab.auth_manager.api.auth.backend.session

• symptom: the OAuth login page does not load
  

• webserver_config.py is set up following FAB documentation:

  from __future__ import annotations
  
  import os
  
  from airflow.providers.fab.auth_manager.security_manager.override import (
      FabAirflowSecurityManagerOverride,
  )
  from flask_appbuilder.const import AUTH_OAUTH
  
  # Flask-WTF flag for CSRF
  WTF_CSRF_ENABLED = True
  WTF_CSRF_TIME_LIMIT = None
  
  AUTH_TYPE = AUTH_OAUTH
  AUTH_USER_REGISTRATION = True
  AUTH_USER_REGISTRATION_ROLE = None
  AUTH_ROLES_SYNC_AT_LOGIN = True
  
  OAUTH_PROVIDERS = [
      {
          'name': 'auth0',
          ...
      },
  ]
  
  class CustomSecurityManager(FabAirflowSecurityManagerOverride):
      """Custom Security Manager"""
  
  SECURITY_MANAGER_CLASS = CustomSecurityManager

• Confusing log entry observed:

  webserver-1  | [2025-04-07T20:07:23.995+0000] {override.py:824} DEBUG - OAuth providers init auth0
  

Solution:

• Fixed in this PR - thanks to @vincbeck 🎉
• That log entry showed up because we had all run airflow users create ... at some point, which invokes

  airflow/providers/fab/src/airflow/providers/fab/auth_manager/cli_commands/utils.py

  Line 57 in adbb062

  flask_app.config.from_pyfile(webserver_config, silent=True)

  
  but it doesn’t actually use the "flask_app" object in the ways that matter for OAuth.