You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "KKIEEK (via GitHub)" <gi...@apache.org> on 2025/05/21 17:51:06 UTC
[PR] Add support for unknown OIDC providers [airflow]
KKIEEK opened a new pull request, #50921:
URL: https://github.com/apache/airflow/pull/50921
While setting up RBAC with [dex](https://github.com/dexidp/dex) in a k8s cluster, I found that support for OIDC providers in Airflow is hardcoded. So I just added simple fallback mechanism to handle unregistered ones.
### References:
- [`OpenIDMixin.userinfo`](https://github.com/authlib/authlib/blob/036a0b71532ada9371f0fc41f6bcd2287666bb20/authlib/integrations/base_client/sync_openid.py#L28)
- [`UserInfo`](https://github.com/authlib/authlib/blob/036a0b71532ada9371f0fc41f6bcd2287666bb20/authlib/oidc/core/claims.py#L222)
### Example w/ dex:
```yaml
webserverConfig: |
from flask_appbuilder.security.manager import AUTH_OAUTH
AUTH_TYPE = AUTH_OAUTH
AUTH_USER_REGISTRATION = True
AUTH_USER_REGISTRATION_ROLE = "User"
OAUTH_PROVIDERS = [
{
"name": "dex",
"icon": "fa-circle",
"token_key": "access_token",
"remote_app": {
"client_id": "airflow",
"client_secret": "...",
"client_kwargs": {
"scope": "openid profile email groups"
},
"api_base_url": "https://www.domain.com",
"access_token_url": "https://www.domain.com/token",
"authorize_url": "https://www.domain.com/auth",
"userinfo_endpoint": "https://www.domain.com/userinfo",
"server_metadata_url": "https://www.domain.com/.well-known/openid-configuration",
},
},
]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add support for unknown OIDC providers [airflow]
Posted by "jason810496 (via GitHub)" <gi...@apache.org>.
jason810496 commented on code in PR #50921:
URL: https://github.com/apache/airflow/pull/50921#discussion_r2110729083
##########
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py:
##########
@@ -75,3 +75,22 @@ def test_check_password_not_match(self, check_password):
sm.find_user = Mock(return_value=mock_user)
check_password.return_value = False
assert not sm.check_password("test_user", "test_password")
+
+ def test_get_oauth_user_info(self):
Review Comment:
Thanks for adding the tests! LGTM.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add support for unknown OIDC providers [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #50921:
URL: https://github.com/apache/airflow/pull/50921#issuecomment-2916433453
Awesome work, congrats on your first merged pull request! You are invited to check our [Issue Tracker](https://github.com/apache/airflow/issues) for additional contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add support for unknown OIDC providers [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #50921:
URL: https://github.com/apache/airflow/pull/50921
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add support for unknown OIDC providers [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #50921:
URL: https://github.com/apache/airflow/pull/50921#issuecomment-2898772183
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:
- Pay attention to the quality of your code (ruff, mypy and type annotations). Our [pre-commits]( https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst#prerequisites-for-pre-commit-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/airflow-core/docs/howto/custom-operator.rst) Consider adding an example DAG that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#coding-style-and-best-practices).
- Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add support for unknown OIDC providers [airflow]
Posted by "jason810496 (via GitHub)" <gi...@apache.org>.
jason810496 commented on code in PR #50921:
URL: https://github.com/apache/airflow/pull/50921#discussion_r2106066571
##########
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py:
##########
@@ -75,3 +75,22 @@ def test_check_password_not_match(self, check_password):
sm.find_user = Mock(return_value=mock_user)
check_password.return_value = False
assert not sm.check_password("test_user", "test_password")
+
+ def test_get_oauth_user_info(self):
Review Comment:
How about having `pytest.parametrize` for specifying different auth providers and the _other_ provider as well.
By verifying `self.oauth_remotes[<provider_name>]` is called in the test should be enough.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add support for unknown OIDC providers [airflow]
Posted by "KKIEEK (via GitHub)" <gi...@apache.org>.
KKIEEK commented on PR #50921:
URL: https://github.com/apache/airflow/pull/50921#issuecomment-2903693198
@jason810496 Thanks for the review!
I noticed that there are no existing test cases for the `get_oauth_user_info` method in `providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py`. Would you like me to add a new test case for it from scratch (including the already supported providers)? If so, I'll be on it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add support for unknown OIDC providers [airflow]
Posted by "KKIEEK (via GitHub)" <gi...@apache.org>.
KKIEEK commented on code in PR #50921:
URL: https://github.com/apache/airflow/pull/50921#discussion_r2106121064
##########
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py:
##########
@@ -75,3 +75,22 @@ def test_check_password_not_match(self, check_password):
sm.find_user = Mock(return_value=mock_user)
check_password.return_value = False
assert not sm.check_password("test_user", "test_password")
+
+ def test_get_oauth_user_info(self):
Review Comment:
I’ve accepted your suggestion. Could you please check this out again?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add support for unknown OIDC providers [airflow]
Posted by "KKIEEK (via GitHub)" <gi...@apache.org>.
KKIEEK commented on code in PR #50921:
URL: https://github.com/apache/airflow/pull/50921#discussion_r2106121064
##########
providers/fab/tests/unit/fab/auth_manager/security_manager/test_override.py:
##########
@@ -75,3 +75,22 @@ def test_check_password_not_match(self, check_password):
sm.find_user = Mock(return_value=mock_user)
check_password.return_value = False
assert not sm.check_password("test_user", "test_password")
+
+ def test_get_oauth_user_info(self):
Review Comment:
I’ve applied your suggestion. Could you please check this out again?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org