You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2020/11/20 06:22:40 UTC
[GitHub] [airflow] Silpa-Suresh opened a new issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Silpa-Suresh opened a new issue #12499:
URL: https://github.com/apache/airflow/issues/12499
Airflow Helm chart is deployed in Azure Kubernetes Service. And using Nginx Ingress Controller accessing the webserver UI in a URL: https://xyz.com/admin/
Configmap (airflow-webserver-config) is created as how mentioned here[](https://github.com/helm/charts/issues/23594#issuecomment-694763470)
Mounting through airflow.extraConfigmapMounts authentication could be established.
Provided the URL "https://xyz.com" as Redirect URI in Azure App registration getting the following error:
AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application:
**Question:**
- [ ] What is the Redirect URI to be provided in the Azure AD App registration?
- [ ] Do we need any API permissions to be added in Azure AD?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
potiuk commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-886668090
Check if the user is properly configured after the oauth flow in your database, and check if the Role it has is enough for the user to be able to login to the UI of Airflow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] barmanand commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
barmanand commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-797392997
I am also getting the same issue. Anyone can please help here, what needs to be provided in redirect URI
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] maneeshmenon edited a comment on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
maneeshmenon edited a comment on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-886659226
Hi, Based on the redirect urls I have provided, after auth from AAD, the code is passed to https://ip address/oauth-authorized/azure and the from there it goes to https://ip address/home and then to https://ip address/login/?next=https%3A%2F%2F10.83.210.52%2Fhome and it just comes back to home and then to login again.
The application should be able to take the code and pass it to get an Access/ID token using which the app should be able to create a session for the user. This is not happening!
I am getting too many redirect error.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] boring-cyborg[bot] commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
boring-cyborg[bot] commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-730880141
Thanks for opening your first issue here! Be sure to follow the issue template!
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] barmanand removed a comment on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
barmanand removed a comment on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-797392997
I am also getting the same issue. Anyone can please help here, what needs to be provided in redirect URI
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] luis-serra-ki commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
luis-serra-ki commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-808928030
Hello guys,
I'm having a similar problem. I'm running airflow on a kubernetes cluster, and I'm using NGINX as my ingress controller, so all my certificates are being provided/managed by it, and I saw that because of this, airflow are making the auth request with the field redirect_uri using HTTP, but on Azure side, on Authentication App settings there is no way to add an HTTP redirect uri.
Is there any way to override the redirect_uri parameter? I tried like this but isn't working:
```
OAUTH_PROVIDERS = [
{
"name": "azure",
"icon": "fa-windows",
"token_key": "access_token",
"remote_app": {
"client_id": os.environ.get("AZURE_APP_ID"),
"client_secret": os.environ.get("AZURE_CLIENT_SECRET"),
"redirect_uri" : "https://airflow.my-domain.com/oauth-authorized/azure",
"base_url": "https://graph.microsoft.com/v1.0/",
"request_token_params": {
"scope": "User.read email profile",
"resource": os.environ.get("AZURE_APPLICATION_ID"),
},
"request_token_url": None,
"access_token_url": azure_authority + "/token",
"authorize_url": azure_authority + "/authorize",
},
},
]
```
There is any workaround for this problem?
Thanks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] luis-serra-ki commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
luis-serra-ki commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-808367005
I'm using version 2.0.1-python3.8 and I'm, having the same problem
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] hussainsaify commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
hussainsaify commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-814131876
I was able to get it working by configuring tbis environment variable. More details on the issue in below link
https://stackoverflow.com/questions/61958403/airflow-1-10-10-behind-nginx-proxy-oauth-redirect-url-http-instead-of-https
Hope it helps
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] alsterman commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
alsterman commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-731145705
Hi @Silpa-Suresh
I'm using this for airflow 1.10.10
**Api-permissions:** `graph.microsoft.com/openid`
**Token configuration:** Add the following optional claims: email, family_name, given_name, upn
**Redirect URIs:** I'm using the following, not sure if all are needed. /login, /admin, /oauth-authorized, /oauth-authorized/azure, /home, /
My `webserver_config.py` looks like this:
```
OAUTH_PROVIDERS = [{
'name':'azure',
'token_key':'access_token',
'icon':'fa-windows',
'remote_app': {
'base_url': 'https://graph.microsoft.com/v1.0/',
'request_token_params' :{'scope': 'openid'},
'access_token_url':'https://login.microsoftonline.com/common/oauth2/token',
'authorize_url':'https://login.microsoftonline.com/common/oauth2/authorize',
'request_token_url': None,
'consumer_key': os.environ.get("OAUTH_SP_AZURE_APPLICATION_ID"),
'consumer_secret': os.environ.get("OAUTH_SP_AZURE_SECRET"),
}
}]
```
You have to add the first user using the airflow cli.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] barmanand commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
barmanand commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-806632415
I have specified only /oauth-authorized/azure and it is working for me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] maneeshmenon commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
maneeshmenon commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-887277692
Hi ... Thanks. I got it working.
I have one basic question. Since I have enabled "AUTH_USER_REGISTRATION = True", the "Register" button appears in the home page. Is it possible to enable OAuth, self register and not have the 'register' button in the home page?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk closed issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
potiuk closed issue #12499:
URL: https://github.com/apache/airflow/issues/12499
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] alsterman edited a comment on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
alsterman edited a comment on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-731145705
Hi @Silpa-Suresh
I'm using this for airflow 1.10.10. It might give you some hints/point you in the right direction.
**Api-permissions:** `graph.microsoft.com/openid`
**Token configuration:** Add the following optional claims: email, family_name, given_name, upn
**Redirect URIs:** I'm using the following, not sure if all are needed. /login, /admin, /oauth-authorized, /oauth-authorized/azure, /home, /
**Authentication:**: Enable Implicit grant -> ID tokens
My `webserver_config.py` looks like this:
```
OAUTH_PROVIDERS = [{
'name':'azure',
'token_key':'access_token',
'icon':'fa-windows',
'remote_app': {
'base_url': 'https://graph.microsoft.com/v1.0/',
'request_token_params' :{'scope': 'openid'},
'access_token_url':'https://login.microsoftonline.com/common/oauth2/token',
'authorize_url':'https://login.microsoftonline.com/common/oauth2/authorize',
'request_token_url': None,
'consumer_key': os.environ.get("OAUTH_SP_AZURE_APPLICATION_ID"),
'consumer_secret': os.environ.get("OAUTH_SP_AZURE_SECRET"),
}
}]
```
You have to add the first user using the airflow cli.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] sshah90 commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
sshah90 commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-788269195
@alsterman what did you put in the redirect URL?
I am using Airflow v1.10.14 and getting the same error as @Silpa-Suresh.
I tried `/login, /admin, /oauth-authorized, /oauth-authorized/azure, /home, /` endpoints but no luck!
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] luis-serra-ki edited a comment on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
luis-serra-ki edited a comment on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-808928030
Hello guys,
I'm having a similar problem. I'm running airflow on a kubernetes cluster, and I'm using NGINX as my ingress controller, so all my certificates are being provided/managed by it, and I saw that because of this, airflow are making the auth request with the field redirect_uri using HTTP, but on Azure side, on Authentication App settings there is no way to add an HTTP redirect uri and I'm getting always this error: `AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: 'ddb79b88-b450-48d2-bfea-3ea215508dd2'.`
Is there any way to override the redirect_uri parameter? I tried this but isn't working:
```
OAUTH_PROVIDERS = [
{
"name": "azure",
"icon": "fa-windows",
"token_key": "access_token",
"remote_app": {
"client_id": os.environ.get("AZURE_APP_ID"),
"client_secret": os.environ.get("AZURE_CLIENT_SECRET"),
"redirect_uri" : "https://airflow.my-domain.com/oauth-authorized/azure",
"base_url": "https://graph.microsoft.com/v1.0/",
"request_token_params": {
"scope": "User.read email profile",
"resource": os.environ.get("AZURE_APPLICATION_ID"),
},
"request_token_url": None,
"access_token_url": azure_authority + "/token",
"authorize_url": azure_authority + "/authorize",
},
},
]
```
There is any workaround for this problem?
I made another test, using burp suite to intercept the requests and change the values of the parameters which worked from azure side, but then I got an error from airflow side, because the first request was made with HTTP and the reply is using https.
Thanks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] Silpa-Suresh commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
Silpa-Suresh commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-732691263
Hi @alsterman
I have tried the above configuration but I am getting the error: Invalid login. Please try again.
The only change I made in the above configuration file (webserver_config.py) is:
import os
from airflow.configuration import conf
from flask_appbuilder.security.manager import AUTH_OAUTH
basedir = os.path.abspath(os.path.join(os.path.dirname(__file__), os.path.pardir))
SQLALCHEMY_DATABASE_URI = conf.get("core", "SQL_ALCHEMY_CONN")
CSRF_ENABLED = True
AUTH_TYPE = AUTH_OAUTH
AUTH_USER_REGISTRATION_ROLE = "Admin"
OAUTH_PROVIDERS = [{
'name':'azure',
'token_key':'access_token',
'icon':'fa-windows',
'remote_app': {
'base_url': 'https://graph.microsoft.com/v1.0/',
'request_token_params' :{'scope': 'openid'},
'access_token_url':'https://login.microsoftonline.com/<tenantID>/oauth2/token',
'authorize_url':'https://login.microsoftonline.com/<tenantID>/oauth2/authorize',
'request_token_url': None,
'consumer_key': '<clientID>',
'consumer_secret': '<clientSecret>',
}
}]
I have a different Tenant ID so I have to provide them manually.
Any great help would be appreciable.
Thanks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] maneeshmenon commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
maneeshmenon commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-886659226
Hi, Based on the redirect urls I have provided, after auth from AAD, the code is passed to https://<ip address>/oauth-authorized/azure and the from there it goes to https://<ip address>/home and then to https://<ip address>/login/?next=https%3A%2F%2F10.83.210.52%2Fhome and it just comes back to home and then to login again.
The application should be able to take the code and pass it to get an Access/ID token using which the app should be able to create a session for the user. This is not happening!
I am getting too many redirect error.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
potiuk commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-886667359
I had similar issues when my oauth configuration was wrong.
Probably you simply do not have properly configured auto-registering of the user, likely the role you have for that is not properly configured. See https://airflow.apache.org/docs/apache-airflow/stable/security/webserver.html#other-methods
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] hussainsaify commented on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
hussainsaify commented on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-814098983
@luis-serra-ki Were you able to get this working? I am facing the same issue
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] maneeshmenon edited a comment on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
maneeshmenon edited a comment on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-887277692
Hi ... Thanks. I got it working. Apache Airflow with OAuth is working fine.
I have two basic questions.
Since I have enabled "AUTH_USER_REGISTRATION = True", the "Register" button appears in the home page. Is it possible to enable OAuth and not have the 'register' button in the home page?
Also, is saving password mandatory?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] alsterman edited a comment on issue #12499: Redirect URI for Airflow to authenticate using Azure AD
Posted by GitBox <gi...@apache.org>.
alsterman edited a comment on issue #12499:
URL: https://github.com/apache/airflow/issues/12499#issuecomment-731145705
Hi @Silpa-Suresh
I'm using this for airflow 1.10.10. It might give you some hints/point you in the right direction.
**Api-permissions:** `graph.microsoft.com/openid`
**Token configuration:** Add the following optional claims: email, family_name, given_name, upn
**Redirect URIs:** I'm using the following, not sure if all are needed. /login, /admin, /oauth-authorized, /oauth-authorized/azure, /home, /
My `webserver_config.py` looks like this:
```
OAUTH_PROVIDERS = [{
'name':'azure',
'token_key':'access_token',
'icon':'fa-windows',
'remote_app': {
'base_url': 'https://graph.microsoft.com/v1.0/',
'request_token_params' :{'scope': 'openid'},
'access_token_url':'https://login.microsoftonline.com/common/oauth2/token',
'authorize_url':'https://login.microsoftonline.com/common/oauth2/authorize',
'request_token_url': None,
'consumer_key': os.environ.get("OAUTH_SP_AZURE_APPLICATION_ID"),
'consumer_secret': os.environ.get("OAUTH_SP_AZURE_SECRET"),
}
}]
```
You have to add the first user using the airflow cli.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org