You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "shashank-iitbhu (via GitHub)" <gi...@apache.org> on 2026/09/16 06:36:26 UTC
[PR] Return 403 when Keycloak UMA ticket grant returns invalid_grant [airflow]
shashank-iitbhu opened a new pull request, #73234:
URL: https://github.com/apache/airflow/pull/73234
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
Keycloak's UMA `uma-ticket` grant often returns HTTP 400 `invalid_grant` / `Invalid bearer token` when the nested Keycloak access token has expired. `_is_authorized` and `_is_batch_authorized` currently raise `AirflowException` for that 400, which the API server surfaces as HTTP 500.
401 is already treated as unauthorized (#59281). 400 `invalid_resource` on team resources is already treated as deny (#69028). This maps 400 `invalid_grant` onto the same deny path so API clients get 403 instead of 500 and can remint.
`invalid_scope` and other unrecognized 400s still raise.
closes: #73232
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
- [ ] No
Generated-by: Cursor following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Return 403 when Keycloak UMA ticket grant returns invalid_grant [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on code in PR #73234:
URL: https://github.com/apache/airflow/pull/73234#discussion_r4059428938
##########
providers/keycloak/tests/unit/keycloak/auth_manager/test_keycloak_auth_manager.py:
##########
@@ -1102,6 +1112,18 @@ def test_filter_authorized_menu_items_with_failure(self, status_code, auth_manag
token_url, data=payload, headers=headers, timeout=5
)
+ def test_filter_authorized_menu_items_invalid_grant(self, auth_manager, user):
+ resp = Mock()
+ resp.status_code = 400
+ resp.text = '{"error": "invalid_grant", "error_description": "Invalid bearer token"}'
+ auth_manager.http_session.post = Mock(return_value=resp)
+
+ result = auth_manager.filter_authorized_menu_items(
+ [MenuItem.ASSETS, MenuItem.CONNECTIONS], user=user
+ )
Review Comment:
```suggestion
result = auth_manager.filter_authorized_menu_items([MenuItem.ASSETS, MenuItem.CONNECTIONS], user=user)
```
Fix static checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Return 403 when Keycloak UMA ticket grant returns invalid_grant [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #73234:
URL: https://github.com/apache/airflow/pull/73234#issuecomment-5761306168
Awesome work, congrats on your first merged pull request! You are invited to check our [Issue Tracker](https://github.com/apache/airflow/issues) for additional contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Return 403 when Keycloak UMA ticket grant returns invalid_grant [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #73234:
URL: https://github.com/apache/airflow/pull/73234
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Return 403 when Keycloak UMA ticket grant returns invalid_grant [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #73234:
URL: https://github.com/apache/airflow/pull/73234#issuecomment-5693128917
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our [Contributors' Guide](https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:
- Pay attention to the quality of your code (ruff, mypy and type annotations). Our [prek-hooks]( https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst#prerequisites-for-prek-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/airflow-core/docs/howto/custom-operator.rst) Consider adding an example Dag that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#coding-style-and-best-practices).
- Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org