This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 2ece6fd2928 Fix Airflow JWT getting cleared in /login_callback (#71077)
2ece6fd2928 is described below
commit 2ece6fd2928146f12c59be97a21812a2c29b8633
Author: stephen-bracken <[email protected]>
AuthorDate: Mon Aug 10 14:55:51 2026 +0100
Fix Airflow JWT getting cleared in /login_callback (#71077)
---
.../airflow/providers/keycloak/auth_manager/middleware.py | 14 ++++++++------
.../tests/unit/keycloak/auth_manager/test_middleware.py | 3 ++-
2 files changed, 10 insertions(+), 7 deletions(-)
diff --git
a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/middleware.py
b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/middleware.py
index fcbfc56f044..1ad6f1eafa9 100644
---
a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/middleware.py
+++
b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/middleware.py
@@ -78,8 +78,6 @@ class KeycloakJWTMiddleware(BaseHTTPMiddleware):
user = new_user or current_user
except (
AuthManagerRefreshTokenExpiredException,
- ExpiredSignatureError,
- InvalidTokenError,
HTTPException,
):
new_token = ""
@@ -234,13 +232,17 @@ class KeycloakJWTMiddleware(BaseHTTPMiddleware):
access_token = request.cookies.get(COOKIE_NAME_ACCESS_TOKEN)
refresh_token = request.cookies.get(COOKIE_NAME_REFRESH_TOKEN)
if not jwt_token:
- raise HTTPException(
- status_code=status.HTTP_401_UNAUTHORIZED, detail="User is not
logged into Airflow."
- )
+ # User is not logged into Airflow
+ return None, None
if not access_token:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED, detail="User is not
logged into Keycloak."
)
auth_manager = cast("KeycloakAuthManager", get_auth_manager())
- user = await auth_manager.get_user_from_token(jwt_token, access_token,
refresh_token)
+ try:
+ user = await auth_manager.get_user_from_token(jwt_token,
access_token, refresh_token)
+ except ExpiredSignatureError:
+ raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED,
detail="Token Expired")
+ except InvalidTokenError:
+ raise HTTPException(status_code=status.HTTP_403_FORBIDDEN,
detail="Invalid JWT token")
return get_auth_manager().refresh_user(user=user), user
diff --git
a/providers/keycloak/tests/unit/keycloak/auth_manager/test_middleware.py
b/providers/keycloak/tests/unit/keycloak/auth_manager/test_middleware.py
index 29a72988823..66f610ae308 100644
--- a/providers/keycloak/tests/unit/keycloak/auth_manager/test_middleware.py
+++ b/providers/keycloak/tests/unit/keycloak/auth_manager/test_middleware.py
@@ -239,7 +239,7 @@ class TestKeycloakJWTMiddleware:
COOKIE_NAME_REFRESH_TOKEN: "refresh_token",
}
- await middleware.dispatch(mock_request, call_next)
+ response = await middleware.dispatch(mock_request, call_next)
auth_manager.get_user_from_token.assert_not_called()
auth_manager.refresh_user.assert_not_called()
@@ -258,6 +258,7 @@ class TestKeycloakJWTMiddleware:
assert not hasattr(mock_request.state, "user_authenticated_via")
call_next.assert_awaited_once_with(mock_request)
+ response.set_cookie.assert_not_called()
@patch("airflow.providers.keycloak.auth_manager.middleware.get_auth_manager")
@pytest.mark.asyncio
