Skip to content

Fix Airflow JWT getting cleared in KeycloakAuthManager /login_callback route #71077

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stephen-bracken wants to merge 1 commit into
base: main
Choose a base branch
from
+10 −7
Open

Fix Airflow JWT getting cleared in KeycloakAuthManager /login_callback route #71077

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions providers/keycloak/src/airflow/providers/keycloak/auth_manager/middleware.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,8 +78,6 @@ async def dispatch(self, request: Request, call_next):
user = new_user or current_user
except (
AuthManagerRefreshTokenExpiredException,
ExpiredSignatureError,
InvalidTokenError,
HTTPException,
):
new_token = ""
Expand Down Expand Up @@ -234,13 +232,17 @@ async def _refresh_user(
access_token = request.cookies.get(COOKIE_NAME_ACCESS_TOKEN)
refresh_token = request.cookies.get(COOKIE_NAME_REFRESH_TOKEN)
if not jwt_token:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED, detail="User is not logged into Airflow."
)
# User is not logged into Airflow
return None, None
if not access_token:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED, detail="User is not logged into Keycloak."
)
auth_manager = cast("KeycloakAuthManager", get_auth_manager())
user = await auth_manager.get_user_from_token(jwt_token, access_token, refresh_token)
try:
user = await auth_manager.get_user_from_token(jwt_token, access_token, refresh_token)
except ExpiredSignatureError:
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Token Expired")
except InvalidTokenError:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid JWT token")
return get_auth_manager().refresh_user(user=user), user
3 changes: 2 additions & 1 deletion providers/keycloak/tests/unit/keycloak/auth_manager/test_middleware.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,7 +239,7 @@ async def test_no_airflow_jwt_token(
COOKIE_NAME_REFRESH_TOKEN: "refresh_token",
}

await middleware.dispatch(mock_request, call_next)
response = await middleware.dispatch(mock_request, call_next)

auth_manager.get_user_from_token.assert_not_called()
auth_manager.refresh_user.assert_not_called()
Expand All @@ -258,6 +258,7 @@ async def test_no_airflow_jwt_token(
assert not hasattr(mock_request.state, "user_authenticated_via")

call_next.assert_awaited_once_with(mock_request)
response.set_cookie.assert_not_called()

@patch("airflow.providers.keycloak.auth_manager.middleware.get_auth_manager")
@pytest.mark.asyncio
Expand Down
Loading