Here's the pertinent portions of webserver_config.py.

from flask_appbuilder.security.manager import AUTH_LDAP
AUTH_TYPE = AUTH_LDAP
AUTH_ROLE_ADMIN = 'Admin'
{{ with secret "secretlocation/ldap" }}
AUTH_LDAP_SERVER = "ldaps://{{- .Data.data.server -}}"
AUTH_LDAP_SEARCH = '{{- .Data.data.ldap_search -}}'
AUTH_LDAP_BIND_USER = '{{- .Data.data.bind_user -}}'
AUTH_LDAP_BIND_PASSWORD = '{{- .Data.data.bind_password -}}'
AUTH_LDAP_UID_FIELD = 'uid'
AUTH_LDAP_USE_TLS = True
AUTH_LDAP_ALLOW_SELF_SIGNED = True
AUTH_LDAP_TLS_CACERTFILE = '/vault/secrets/ca.crt'
AUTH_ROLES_MAPPING = {
    "{{- .Data.data.admin_group_dn -}}": ["Admin"],
}
AUTH_LDAP_GROUP_FIELD = "memberOf"
AUTH_ROLES_SYNC_AT_LOGIN = True
PERMANENT_SESSION_LIFETIME = 1800
{{- end -}}

We are using Vault Agent to render the webserver_config.py, so the secret values are actually in the file when the container process runs. I also have set

AIRFLOW__WEBSERVER__RBAC=true

in the .env file. Am I missing anything else? Any way to get debug output for the LDAP calls that the web server should be making during login? Nothing shows in the logs except:

[2021-10-31 00:26:09,891] {_internal.py:113} INFO - someip - - [31/Oct/2021 00:26:09] "POST /login/ HTTP/1.1" 302 -
[2021-10-31 00:26:10,324] {_internal.py:113} INFO - someip - - [31/Oct/2021 00:26:10] "GET /login/ HTTP/1.1" 200 -

I'm trying:

AIRFLOW__LOGGING__LOGGING_LEVEL=DEBUG
AIRFLOW__LOGGING__FAB_LOGGING_LEVEL=DEBUG

to see what that gets me.