You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "bugraoz93 (via GitHub)" <gi...@apache.org> on 2025/08/06 20:22:57 UTC
[PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
bugraoz93 opened a new pull request, #54196:
URL: https://github.com/apache/airflow/pull/54196
follow up docs
relates: #51657
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
<!-- Please keep an empty line above the dashes. -->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2616308904
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -170,8 +170,76 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
return response
.. note::
- Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+ Ensure that the cookie parameter ``httponly`` is set to ``True``. UI no longer manages the token.
Review Comment:
Updated as it `does not manage`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 merged PR #54196:
URL: https://github.com/apache/airflow/pull/54196
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2611839251
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -170,8 +170,76 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
return response
.. note::
- Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+ Ensure that the cookie parameter ``httponly`` is set to ``True``. UI no longer manages the token.
+Refreshing JWT Token
+''''''''''''''''''''
+Refreshing token is optional feature and its availability depends on the specific implementation of the auth manager.
+The auth manager is responsible for refreshing the JWT token when it expires.
+The Airflow API uses middleware that intercepts every request and checks the validity of the JWT token.
+Token communication is handled through ``httponly`` cookies to improve security.
+When the token expires, the middleware calls the auth manager's ``refresh_token`` method to obtain a new token.
+
+To support token refresh operations, the auth manager must implement the ``refresh_token`` method.
Review Comment:
```suggestion
To support token refresh operations, the auth manager must implement the ``refresh_user`` method.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #54196:
URL: https://github.com/apache/airflow/pull/54196#issuecomment-3604482752
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2611858757
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -170,8 +170,76 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
return response
.. note::
- Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+ Ensure that the cookie parameter ``httponly`` is set to ``True``. UI no longer manages the token.
+Refreshing JWT Token
+''''''''''''''''''''
+Refreshing token is optional feature and its availability depends on the specific implementation of the auth manager.
+The auth manager is responsible for refreshing the JWT token when it expires.
+The Airflow API uses middleware that intercepts every request and checks the validity of the JWT token.
+Token communication is handled through ``httponly`` cookies to improve security.
+When the token expires, the middleware calls the auth manager's ``refresh_token`` method to obtain a new token.
+
+To support token refresh operations, the auth manager must implement the ``refresh_token`` method.
+This method receives an expired token and must return a new valid token.
+User information is extracted from the expired token and used to generate a fresh token.
+
+An example implementation of ``refresh_user`` could be:
+
+.. code-block:: python
+
+ def refresh_user(self, *, user: KeycloakAuthManagerUser) -> KeycloakAuthManagerUser | None:
+ if self._token_expired(user.access_token):
+ log.debug("Refreshing the token")
+ client = self.get_keycloak_client()
+ tokens = client.refresh_token(user.refresh_token)
+ user.refresh_token = tokens["refresh_token"]
+ user.access_token = tokens["access_token"]
+ return user
+
+ return None
+
+User information is derived from the ``BaseUser`` instance. It is important that the user object contains all the fields required to refresh the token. An example user class that includes all necessary fields is shown below:
+
+.. code-block:: python
+
+ class KeycloakAuthManagerUser(BaseUser):
Review Comment:
Same here
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -170,8 +170,76 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
return response
.. note::
- Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+ Ensure that the cookie parameter ``httponly`` is set to ``True``. UI no longer manages the token.
+Refreshing JWT Token
+''''''''''''''''''''
+Refreshing token is optional feature and its availability depends on the specific implementation of the auth manager.
+The auth manager is responsible for refreshing the JWT token when it expires.
+The Airflow API uses middleware that intercepts every request and checks the validity of the JWT token.
+Token communication is handled through ``httponly`` cookies to improve security.
+When the token expires, the middleware calls the auth manager's ``refresh_token`` method to obtain a new token.
+
+To support token refresh operations, the auth manager must implement the ``refresh_token`` method.
+This method receives an expired token and must return a new valid token.
+User information is extracted from the expired token and used to generate a fresh token.
+
+An example implementation of ``refresh_user`` could be:
Review Comment:
To avoid having out of date code, maybe link to the keycloak auth manager implementation of `refresh_user`?
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -170,8 +170,76 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
return response
.. note::
- Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+ Ensure that the cookie parameter ``httponly`` is set to ``True``. UI no longer manages the token.
Review Comment:
I am not sure we should have "no longer" in the doc. We always try to avoid comparing version in docs, just mention how the state is
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -170,8 +170,76 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
return response
.. note::
- Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+ Ensure that the cookie parameter ``httponly`` is set to ``True``. UI no longer manages the token.
+Refreshing JWT Token
+''''''''''''''''''''
+Refreshing token is optional feature and its availability depends on the specific implementation of the auth manager.
+The auth manager is responsible for refreshing the JWT token when it expires.
+The Airflow API uses middleware that intercepts every request and checks the validity of the JWT token.
+Token communication is handled through ``httponly`` cookies to improve security.
+When the token expires, the middleware calls the auth manager's ``refresh_token`` method to obtain a new token.
+
+To support token refresh operations, the auth manager must implement the ``refresh_token`` method.
+This method receives an expired token and must return a new valid token.
+User information is extracted from the expired token and used to generate a fresh token.
+
+An example implementation of ``refresh_user`` could be:
+
+.. code-block:: python
+
+ def refresh_user(self, *, user: KeycloakAuthManagerUser) -> KeycloakAuthManagerUser | None:
+ if self._token_expired(user.access_token):
+ log.debug("Refreshing the token")
+ client = self.get_keycloak_client()
+ tokens = client.refresh_token(user.refresh_token)
+ user.refresh_token = tokens["refresh_token"]
+ user.access_token = tokens["access_token"]
+ return user
+
+ return None
+
+User information is derived from the ``BaseUser`` instance. It is important that the user object contains all the fields required to refresh the token. An example user class that includes all necessary fields is shown below:
+
+.. code-block:: python
+
+ class KeycloakAuthManagerUser(BaseUser):
+ """User model for users managed by the Keycloak auth manager."""
+
+ def __init__(self, *, user_id: str, name: str, access_token: str, refresh_token: str) -> None:
+ self.user_id = user_id
+ self.name = name
+ self.access_token = access_token
+ self.refresh_token = refresh_token
+
+ def get_id(self) -> str:
+ return self.user_id
+
+ def get_name(self) -> str:
+ return self.name
+
+The refresh token endpoint must implement the refresh logic required by the auth manager. An example ``refresh_token`` implementation is shown below:
+
+.. code-block:: python
+
+ def refresh_token(self, expired_token: str) -> str:
Review Comment:
Same here. If you really want to have snippet code in the doc, maybe we can use tags, the same way we do it in system tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2258279911
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -172,6 +172,39 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
.. note::
Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+Refreshing JWT Token
+''''''''''''''''''''
+The refresh token endpoint is ``POST /auth/token/refresh`` with the current JWT token in the cookie or acquired from the API.
Review Comment:
Not sure I understand this sentence
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on PR #54196:
URL: https://github.com/apache/airflow/pull/54196#issuecomment-3607638543
Okay it is already time. I will update the doc in a day or two. Finishing some CI work to lose dependency on v3 test branches on integration tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2262946655
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -172,6 +172,40 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
.. note::
Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+Refreshing JWT Token
+''''''''''''''''''''
+The refresh token ``<METHOD> <PATH>`` is ``POST /auth/token/refresh``. It returns a new JWT token in the cookie where updated token is stored.
+It requires the user to be authenticated, and it is usually called by the Airflow UI/API when the JWT token is about to expire.
+This endpoint is used to refresh the JWT token when it is about to expire.
+The auth manager should implement this endpoint to allow the Airflow UI/API to refresh the JWT token.
Review Comment:
We should also mention why an auth manager should override this method. If the auth manager does not use any underlying token underneath, there is no value implementing this method. An auth manager should override this method if it uses a token which expires and need to be refreshed (like Keycloak)
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -172,6 +172,40 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
.. note::
Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+Refreshing JWT Token
+''''''''''''''''''''
+The refresh token ``<METHOD> <PATH>`` is ``POST /auth/token/refresh``. It returns a new JWT token in the cookie where updated token is stored.
Review Comment:
I do not think it is needed to mention the path, each auth manager can come up with their own path. It does not really matter because Airflow can get this path with `get_url_refresh`. By the way, it would be great to mention this method in the doc, saying that if the auth manager provide an endpoint to refresh the token, it should be returned with `get_url_refresh`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add Refresh Token logic to auth manager docs [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #54196:
URL: https://github.com/apache/airflow/pull/54196#issuecomment-3657598395
### Backport successfully created: v3-1-test
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>✅</td>
<td>v3-1-test</td>
<td><a href="https://github.com/apache/airflow/pull/59482"><img src="https://img.shields.io/badge/PR-59482-blue" alt="PR Link"></a></td>
</tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2616310373
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -170,8 +170,76 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
return response
.. note::
- Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+ Ensure that the cookie parameter ``httponly`` is set to ``True``. UI no longer manages the token.
+Refreshing JWT Token
+''''''''''''''''''''
+Refreshing token is optional feature and its availability depends on the specific implementation of the auth manager.
+The auth manager is responsible for refreshing the JWT token when it expires.
+The Airflow API uses middleware that intercepts every request and checks the validity of the JWT token.
+Token communication is handled through ``httponly`` cookies to improve security.
+When the token expires, the middleware calls the auth manager's ``refresh_token`` method to obtain a new token.
+
+To support token refresh operations, the auth manager must implement the ``refresh_token`` method.
+This method receives an expired token and must return a new valid token.
+User information is extracted from the expired token and used to generate a fresh token.
+
+An example implementation of ``refresh_user`` could be:
+
+.. code-block:: python
+
+ def refresh_user(self, *, user: KeycloakAuthManagerUser) -> KeycloakAuthManagerUser | None:
+ if self._token_expired(user.access_token):
+ log.debug("Refreshing the token")
+ client = self.get_keycloak_client()
+ tokens = client.refresh_token(user.refresh_token)
+ user.refresh_token = tokens["refresh_token"]
+ user.access_token = tokens["access_token"]
+ return user
+
+ return None
+
+User information is derived from the ``BaseUser`` instance. It is important that the user object contains all the fields required to refresh the token. An example user class that includes all necessary fields is shown below:
+
+.. code-block:: python
+
+ class KeycloakAuthManagerUser(BaseUser):
+ """User model for users managed by the Keycloak auth manager."""
+
+ def __init__(self, *, user_id: str, name: str, access_token: str, refresh_token: str) -> None:
+ self.user_id = user_id
+ self.name = name
+ self.access_token = access_token
+ self.refresh_token = refresh_token
+
+ def get_id(self) -> str:
+ return self.user_id
+
+ def get_name(self) -> str:
+ return self.name
+
+The refresh token endpoint must implement the refresh logic required by the auth manager. An example ``refresh_token`` implementation is shown below:
+
+.. code-block:: python
+
+ def refresh_token(self, expired_token: str) -> str:
Review Comment:
Thanks, Vincent! That makes sense. I referenced tag 3.1.5, but we could also point to main to get the latest version, even though the lines may change. Alternatively, we can link to the file directly or remove the example and keep only the explanation
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2263614098
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -172,6 +172,40 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
.. note::
Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+Refreshing JWT Token
+''''''''''''''''''''
+The refresh token ``<METHOD> <PATH>`` is ``POST /auth/token/refresh``. It returns a new JWT token in the cookie where updated token is stored.
Review Comment:
Removed the path and included the method. Also included the method in `Authentication related methods` title.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on PR #54196:
URL: https://github.com/apache/airflow/pull/54196#issuecomment-3324895060
Not stale, will update after the solution merged
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on PR #54196:
URL: https://github.com/apache/airflow/pull/54196#issuecomment-3657592644
Docs and spellcheck are currently passing the error. Merging. Thanks for the reviews!
```bash
The image /mnt/ci-image-save-v3-linux_amd64-3.10.tar does not exist.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2611814601
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -172,6 +174,60 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
.. note::
Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+Refreshing JWT Token
+''''''''''''''''''''
+The refresh token logic is to automatically refresh the JWT token when it is about to expire.
+The auth manager should implement ``get_url_refresh`` method to return the URL of the refresh token endpoint.
+
+It requires the user to be authenticated, and it is usually called by the Airflow UI/API when the JWT token is about to expire.
+This endpoint is used to refresh the JWT token when it is about to expire.
+The auth manager should implement this endpoint to allow the Airflow UI/API to refresh the JWT token.
+If the auth manager does not implement this endpoint, the Airflow UI/API will not be able to refresh the JWT token.
+The user will be logged out when the JWT token expires in that case, and they will have to log in again.
+
+This procedure is following the same pattern as the initial token generation endpoints and login/logout logic.
+
+If the auth manager have a token which expires and need to be refreshed, it should override the endpoint.
+
+Example token structure below shows that we need to refresh the token via using the ``refresh_token`` key in the token dict.
+This is example and the names can be different in your auth manager implementation.
+If this is not the case, auth manager don't need to implement the refresh token endpoint.
+
+.. code-block:: python
+
+ token = {
+ "access_token": "ACCESS_TOKEN",
+ "refresh_token": "REFRESH_TOKEN",
+ "param1": "value1",
+ "param2": "value2",
+ "...": "...",
+ }
+
+
+A typical implementation of the refresh token endpoint would look like this:
+
+
+.. code-block:: python
+
+ @router.post("/auth/token/refresh")
+ def refresh_token(
+ request: Request,
+ user: T = Depends(get_current_user),
+ ) -> TokenResponse:
+ """
+ Refresh the JWT token for the current user.
+ """
+ # Generate a new token for the user
+ new_token = auth_manager.generate_token(user) # Or similar with calling the client from auth manager
+
+ # Set the new token in the cookie
+ secure = request.base_url.scheme == "https" or bool(conf.get("api", "ssl_cert", fallback=""))
+ response = RedirectResponse(url="/")
+ response.set_cookie(COOKIE_NAME_JWT_TOKEN, new_token, secure=secure)
+
+ return response
+.. note::
+ Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
Review Comment:
Updated the doc :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2611820468
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -170,8 +170,76 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
return response
.. note::
- Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+ Ensure that the cookie parameter ``httponly`` is set to ``True``. UI no longer manages the token.
Review Comment:
I think this also needs to change. I initially considered a separate PR without backporting, but since this is after 3.1.1 and v-3-1-test is already past 3.1.4, it should be fine.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2610970544
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -172,6 +174,60 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
.. note::
Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+Refreshing JWT Token
+''''''''''''''''''''
+The refresh token logic is to automatically refresh the JWT token when it is about to expire.
+The auth manager should implement ``get_url_refresh`` method to return the URL of the refresh token endpoint.
+
+It requires the user to be authenticated, and it is usually called by the Airflow UI/API when the JWT token is about to expire.
+This endpoint is used to refresh the JWT token when it is about to expire.
+The auth manager should implement this endpoint to allow the Airflow UI/API to refresh the JWT token.
+If the auth manager does not implement this endpoint, the Airflow UI/API will not be able to refresh the JWT token.
+The user will be logged out when the JWT token expires in that case, and they will have to log in again.
+
+This procedure is following the same pattern as the initial token generation endpoints and login/logout logic.
+
+If the auth manager have a token which expires and need to be refreshed, it should override the endpoint.
+
+Example token structure below shows that we need to refresh the token via using the ``refresh_token`` key in the token dict.
+This is example and the names can be different in your auth manager implementation.
+If this is not the case, auth manager don't need to implement the refresh token endpoint.
+
+.. code-block:: python
+
+ token = {
+ "access_token": "ACCESS_TOKEN",
+ "refresh_token": "REFRESH_TOKEN",
+ "param1": "value1",
+ "param2": "value2",
+ "...": "...",
+ }
+
+
+A typical implementation of the refresh token endpoint would look like this:
+
+
+.. code-block:: python
+
+ @router.post("/auth/token/refresh")
+ def refresh_token(
+ request: Request,
+ user: T = Depends(get_current_user),
+ ) -> TokenResponse:
+ """
+ Refresh the JWT token for the current user.
+ """
+ # Generate a new token for the user
+ new_token = auth_manager.generate_token(user) # Or similar with calling the client from auth manager
+
+ # Set the new token in the cookie
+ secure = request.base_url.scheme == "https" or bool(conf.get("api", "ssl_cert", fallback=""))
+ response = RedirectResponse(url="/")
+ response.set_cookie(COOKIE_NAME_JWT_TOKEN, new_token, secure=secure)
+
+ return response
+.. note::
+ Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
Review Comment:
we need to update that part, it's not accurate anymore
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2263615409
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -172,6 +172,40 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
.. note::
Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+Refreshing JWT Token
+''''''''''''''''''''
+The refresh token ``<METHOD> <PATH>`` is ``POST /auth/token/refresh``. It returns a new JWT token in the cookie where updated token is stored.
+It requires the user to be authenticated, and it is usually called by the Airflow UI/API when the JWT token is about to expire.
+This endpoint is used to refresh the JWT token when it is about to expire.
+The auth manager should implement this endpoint to allow the Airflow UI/API to refresh the JWT token.
Review Comment:
Make sense! added example and mentioned that this is not needed in case the logic is not there and gave the example for the keys similar to Keycloak, but mentioned that they are tentative and can be different
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2261662432
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -172,6 +172,39 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
.. note::
Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+Refreshing JWT Token
+''''''''''''''''''''
+The refresh token endpoint is ``POST /auth/token/refresh`` with the current JWT token in the cookie or acquired from the API.
Review Comment:
I split the sentence into multiple pieces. I beleive this is more understanable
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -172,6 +172,39 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
.. note::
Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+Refreshing JWT Token
+''''''''''''''''''''
+The refresh token endpoint is ``POST /auth/token/refresh`` with the current JWT token in the cookie or acquired from the API.
Review Comment:
I split the sentence into multiple pieces. I believe this is more understandable
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #54196:
URL: https://github.com/apache/airflow/pull/54196#issuecomment-3321960261
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add Refresh Token logic to auth manager docs [airflow]
Posted by "bugraoz93 (via GitHub)" <gi...@apache.org>.
bugraoz93 commented on code in PR #54196:
URL: https://github.com/apache/airflow/pull/54196#discussion_r2616308904
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -170,8 +170,76 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil
return response
.. note::
- Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie.
+ Ensure that the cookie parameter ``httponly`` is set to ``True``. UI no longer manages the token.
Review Comment:
Updated as the UI `does not manage`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(doc): Add Refresh Token logic to auth manager docs [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on PR #54196:
URL: https://github.com/apache/airflow/pull/54196#issuecomment-3613101848
I removed my request for change. Things have been discussed, implemented and stabilized, we're ready for a doc update :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org