[PR] Validate id_token issuer and audience in the FAB Authentik provider [airflow]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #72645:
URL: https://github.com/apache/airflow/pull/72645

   The `authentik` OAuth path in the FAB auth manager decoded the `id_token`
   without any `claims_options`, so authlib validated only the time-based
   claims. Neither the issuer nor the audience was checked.
   
   A provider signs the tokens of every application registered with it using a
   single key set, so a valid signature only establishes that the provider
   minted the token — not that it was minted for Airflow. A token issued for a
   different application registered with the same provider was accepted and
   authenticated its subject as an Airflow user.
   
   This pins:
   
   * `aud` to the configured `client_id`
   * `iss` to the issuer advertised in the provider's OpenID metadata
   
   If no issuer can be resolved, verification now fails with an actionable
   error rather than falling back to an audience-only check — the configured
   key set may sign for more than one issuer, so an audience-only check would
   still accept a token from an untrusted one. Deployments whose metadata does
   not publish an `issuer` can set it explicitly in the provider's
   `client_kwargs`; this is documented.
   
   This mirrors the `claims_options` already applied on the `azure` path in the
   same file.
   
   ### Tests
   
   Six tests covering a correctly addressed token, a token for another
   application, a token from another issuer, the fail-closed path (asserted
   with a *correct* audience and a *wrong* issuer, which is the shape an
   audience-only fallback would let through), and the configured-issuer
   override both accepting a valid token and rejecting a foreign issuer.
   
   The three rejection tests fail without the source change.
   
   ---
   
   ##### Was generative AI tooling used to co-author this PR?
   
   - [X] Yes (please specify the tool below)
   
   Generated-by: Claude Code following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Validate id_token issuer and audience in the FAB Authentik provider [airflow]

["vincbeck (via GitHub)" <gi...@apache.org>]

vincbeck merged PR #72645:
URL: https://github.com/apache/airflow/pull/72645


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org