rjgoyln commented on issue #70798:
URL: https://github.com/apache/airflow/issues/70798#issuecomment-5142413610
I tried to reproduce the three paths on current `main` and I may be missing
something, so let me share what I'm seeing.
In `_get_authentik_token_info` (`override.py` L418-L436), neither error
branch returns — a missing `jwks_uri` and an empty JWKS both just `log.error`
and fall through to `raise FabException("OAuth signature verify failed")` at
L436. And `_get_authentik_jwks` (L401-L407) has no try/except, so a network
error propagates rather than being swallowed. From there FAB's oauth_authorized
catches it, sets `user = None`, and redirects to login without calling
`login_user()`.
One thought on where the difference might come from: upstream
Flask-AppBuilder's version of this function does end in `return me` with the
claims decoded unverified. Airflow's copy is vendored and diverges here, so an
analysis based on the upstream code would land on exactly this finding.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
