This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new c246ba8748c Fix FAB SSO guide's non-working OAuth configuration
instructions (#71852)
c246ba8748c is described below
commit c246ba8748c327a186195298cb434425a1d9d5a6
Author: Parman Mohammadalizadeh <[email protected]>
AuthorDate: Thu Aug 20 00:47:24 2026 +0330
Fix FAB SSO guide's non-working OAuth configuration instructions (#71852)
Followed literally, the guide cannot produce a working SSO setup. Airflow
reads
auth_manager from [core], and that key has no deprecation mapping from
[webserver], so the documented setting is silently ignored and the
deployment
stays on SimpleAuthManager. OAUTH_PROVIDERS is a Flask AppBuilder setting
read
from webserver_config.py, and the provider exposes no oauth_providers
option, so
the airflow.cfg and AIRFLOW__FAB__ forms the guide gives configure nothing
and
the API server refuses to start with KeyError: 'OAUTH_PROVIDERS'.
---
providers/fab/docs/auth-manager/sso.rst | 163 ++++++++++++++------------------
1 file changed, 72 insertions(+), 91 deletions(-)
diff --git a/providers/fab/docs/auth-manager/sso.rst
b/providers/fab/docs/auth-manager/sso.rst
index f83df2559b0..6c7192bff6f 100644
--- a/providers/fab/docs/auth-manager/sso.rst
+++ b/providers/fab/docs/auth-manager/sso.rst
@@ -54,7 +54,7 @@ Configuration Steps
.. code-block:: ini
- [webserver]
+ [core]
auth_manager =
airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager
This replaces the default ``SimpleAuthManager``.
@@ -99,48 +99,27 @@ Configuration Steps
4. **Configure OAuth2 Provider**
- FAB Auth Manager reads provider configuration from the ``[fab]`` section
- of ``airflow.cfg`` or from environment variables.
+ Define ``OAUTH_PROVIDERS`` in the same ``webserver_config.py`` file as
``AUTH_TYPE``.
+ This is a Flask AppBuilder setting read from that file, not an Airflow
configuration
+ option, so it cannot be set in ``airflow.cfg`` or through an
``AIRFLOW__FAB__``
+ environment variable.
- **Option A: Environment Variables (Recommended)**
-
- .. code-block:: bash
-
- export AIRFLOW__FAB__OAUTH_PROVIDERS='[{
- "name": "generic",
- "icon": "fa-circle",
- "token_key": "access_token",
- "remote_app": {
- "client_id": "your-client-id",
- "client_secret": "your-client-secret",
- "api_base_url": "https://provider.com/oauth/";,
- "request_token_url": null,
- "access_token_url": "https://provider.com/oauth/token";,
- "authorize_url": "https://provider.com/oauth/authorize";
- }
- }]'
-
- **Option B: Configuration File**
-
- Add to your ``airflow.cfg``:
-
- .. code-block:: ini
+ .. code-block:: python
- [fab]
- oauth_providers = [
- {
- "name": "generic",
- "icon": "fa-circle",
- "token_key": "access_token",
- "remote_app": {
- "client_id": "your-client-id",
- "client_secret": "your-client-secret",
- "api_base_url": "https://provider.com/oauth/";,
- "request_token_url": null,
- "access_token_url": "https://provider.com/oauth/token";,
- "authorize_url": "https://provider.com/oauth/authorize";
+ OAUTH_PROVIDERS = [
+ {
+ "name": "generic",
+ "icon": "fa-circle",
+ "token_key": "access_token",
+ "remote_app": {
+ "client_id": "your-client-id",
+ "client_secret": "your-client-secret",
+ "api_base_url": "https://provider.com/oauth/";,
+ "request_token_url": None,
+ "access_token_url": "https://provider.com/oauth/token";,
+ "authorize_url": "https://provider.com/oauth/authorize";,
+ },
}
- }
]
Adjust these values according to your provider's documentation.
@@ -160,45 +139,47 @@ Provider Examples
**Okta**
-.. code-block:: bash
-
- export AIRFLOW__FAB__OAUTH_PROVIDERS='[{
- "name": "okta",
- "icon": "fa-circle",
- "token_key": "access_token",
- "remote_app": {
- "client_id": "your-client-id",
- "client_secret": "your-client-secret",
- "api_base_url": "https://your-org.okta.com/oauth2/default";,
- "request_token_url": null,
- "access_token_url":
"https://your-org.okta.com/oauth2/default/v1/token";,
- "authorize_url":
"https://your-org.okta.com/oauth2/default/v1/authorize";
- }
- }]'
+.. code-block:: python
+
+ OAUTH_PROVIDERS = [
+ {
+ "name": "okta",
+ "icon": "fa-circle",
+ "token_key": "access_token",
+ "remote_app": {
+ "client_id": "your-client-id",
+ "client_secret": "your-client-secret",
+ "api_base_url": "https://your-org.okta.com/oauth2/default";,
+ "request_token_url": None,
+ "access_token_url":
"https://your-org.okta.com/oauth2/default/v1/token";,
+ "authorize_url":
"https://your-org.okta.com/oauth2/default/v1/authorize";,
+ },
+ }
+ ]
.. seealso::
For detailed Okta setup instructions, see the `Okta OAuth2 documentation
<https://developer.okta.com/docs/guides/implement-oauth/>`_.
**Azure Entra ID (Azure AD)**
-.. code-block:: bash
-
- export AIRFLOW__FAB__OAUTH_PROVIDERS='[{
- "name": "azure",
- "icon": "fa-circle",
- "token_key": "access_token",
- "remote_app": {
- "client_id": "your-client-id",
- "client_secret": "your-client-secret",
- "api_base_url":
"https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/",
- "request_token_url": null,
- "access_token_url":
"https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token",
- "authorize_url":
"https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize",
- "client_kwargs": {
- "scope": "openid email profile"
- }
- }
- }]'
+.. code-block:: python
+
+ OAUTH_PROVIDERS = [
+ {
+ "name": "azure",
+ "icon": "fa-circle",
+ "token_key": "access_token",
+ "remote_app": {
+ "client_id": "your-client-id",
+ "client_secret": "your-client-secret",
+ "api_base_url":
"https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/",
+ "request_token_url": None,
+ "access_token_url":
"https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token",
+ "authorize_url":
"https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize",
+ "client_kwargs": {"scope": "openid email profile"},
+ },
+ }
+ ]
.. seealso::
For Azure app registration and OAuth setup, see
:doc:`apache-airflow-providers-microsoft-azure:connections/azure`
@@ -265,24 +246,24 @@ Provider Examples
**Google OAuth2**
-.. code-block:: bash
-
- export AIRFLOW__FAB__OAUTH_PROVIDERS='[{
- "name": "google",
- "icon": "fa-google",
- "token_key": "access_token",
- "remote_app": {
- "client_id": "your-client-id.googleusercontent.com",
- "client_secret": "your-client-secret",
- "api_base_url": "https://www.googleapis.com/oauth2/v2/";,
- "request_token_url": null,
- "access_token_url": "https://oauth2.googleapis.com/token";,
- "authorize_url": "https://accounts.google.com/o/oauth2/auth";,
- "client_kwargs": {
- "scope": "openid email profile"
- }
- }
- }]'
+.. code-block:: python
+
+ OAUTH_PROVIDERS = [
+ {
+ "name": "google",
+ "icon": "fa-google",
+ "token_key": "access_token",
+ "remote_app": {
+ "client_id": "your-client-id.googleusercontent.com",
+ "client_secret": "your-client-secret",
+ "api_base_url": "https://www.googleapis.com/oauth2/v2/";,
+ "request_token_url": None,
+ "access_token_url": "https://oauth2.googleapis.com/token";,
+ "authorize_url": "https://accounts.google.com/o/oauth2/auth";,
+ "client_kwargs": {"scope": "openid email profile"},
+ },
+ }
+ ]
.. seealso::
For Google OAuth setup and credential configuration, see
:doc:`apache-airflow-providers-google:connections/gcp`
