robertpofuk opened a new pull request, #72262:
URL: https://github.com/apache/airflow/pull/72262

   ## Why
   
   The Edge worker API currently only verifies worker tokens signed with the 
shared `[api_auth] jwt_secret` (symmetric HS512). This adds **optional** 
verification against a trusted OpenID Connect provider, so edge workers can 
authenticate with tokens minted by an external identity provider instead of the 
shared secret.
   
   ## What
   
   When `[edge] oidc_jwks_url` is set, worker tokens are verified against the 
provider JWKS using asymmetric signatures, checking the `iss` and (optionally) 
`aud` claims. New `[edge]` options:
   
   - `oidc_jwks_url` — provider JWKS URL; enables OIDC verification when set
   - `oidc_issuer` — expected `iss` claim
   - `oidc_audience` — expected `aud` claim; leave empty to skip audience 
verification (for tokens that carry no `aud`)
   - `oidc_algorithms` — accepted signing algorithms, comma-separated (default 
`RS256`)
   
   When `oidc_jwks_url` is empty (the default), the existing shared-secret 
verification is used unchanged, so existing deployments are unaffected. The 
per-request signed `method` claim check is skipped in OIDC mode because 
externally issued tokens do not carry it.
   
   Uses the existing core `JWKS` / `JWTValidator`; no new dependencies. Adds 
unit tests for validator selection, the config options, and the method-claim 
behavior (the module had no test module before).
   
   ## Known limitation / follow-up
   
   Some identity providers publish JWKS keys without an `alg` field. PyJWT then 
defaults such keys to `RS256` and rejects tokens signed with another algorithm 
even when `algorithms` is passed to `jwt.decode`. That looks like it should be 
addressed in core `JWTValidator` rather than here, so it is intentionally out 
of scope for this PR. Happy to follow up separately if maintainers agree.
   
   ---
   
   ^ Add meaningful description above
   
   Read the [Pull Request 
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)
 for more information.
   In case of fundamental code changes, an Airflow Improvement Proposal 
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
 is needed.
   In case of a new dependency, check compliance with the [ASF 3rd Party 
License Policy](https://www.apache.org/legal/resolved.html#category-x).
   In case of backwards incompatible changes please leave a note in a 
newsfragment file, named `{pr_number}.significant.rst` or 
`{issue_number}.significant.rst`, in 
[airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to