robertpofuk opened a new pull request, #72262: URL: https://github.com/apache/airflow/pull/72262
## Why The Edge worker API currently only verifies worker tokens signed with the shared `[api_auth] jwt_secret` (symmetric HS512). This adds **optional** verification against a trusted OpenID Connect provider, so edge workers can authenticate with tokens minted by an external identity provider instead of the shared secret. ## What When `[edge] oidc_jwks_url` is set, worker tokens are verified against the provider JWKS using asymmetric signatures, checking the `iss` and (optionally) `aud` claims. New `[edge]` options: - `oidc_jwks_url` — provider JWKS URL; enables OIDC verification when set - `oidc_issuer` — expected `iss` claim - `oidc_audience` — expected `aud` claim; leave empty to skip audience verification (for tokens that carry no `aud`) - `oidc_algorithms` — accepted signing algorithms, comma-separated (default `RS256`) When `oidc_jwks_url` is empty (the default), the existing shared-secret verification is used unchanged, so existing deployments are unaffected. The per-request signed `method` claim check is skipped in OIDC mode because externally issued tokens do not carry it. Uses the existing core `JWKS` / `JWTValidator`; no new dependencies. Adds unit tests for validator selection, the config options, and the method-claim behavior (the module had no test module before). ## Known limitation / follow-up Some identity providers publish JWKS keys without an `alg` field. PyJWT then defaults such keys to `RS256` and rejects tokens signed with another algorithm even when `algorithms` is passed to `jwt.decode`. That looks like it should be addressed in core `JWTValidator` rather than here, so it is intentionally out of scope for this PR. Happy to follow up separately if maintainers agree. --- ^ Add meaningful description above Read the [Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines) for more information. In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed. In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x). In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
