dlactin opened a new issue, #72903: URL: https://github.com/apache/airflow/issues/72903
### Description Today the Keycloak Auth manager supports username/password and client credential authentication to the Airflow API. I would like to support federated client authentication from external identity providers as detailed here: https://www.keycloak.org/2026/01/federated-client-authentication. I would also propose a new configuration option that allows a list of valid clients, so not all the keycloak clients in a realm can generate Airflow tokens. ### Use case/motivation I would like to generate temporary Airflow credentials using Keycloaks built in Kubernetes identity provider and a Kubernetes service account. https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_broker_kubernetes The goal is to allow API authentication from machines without a user account with static credentials or sharing the airflow client credentials. We have several external services that interact with the Airflow API from Kubernetes, EC2 instances and other sources that either use static credentials or an in-house application (along with a custom auth provider) to generate a valid JWT. The keycloak provider looks much more robust and could provide a better machine auth experience. ### Related issues _No response_ ### Are you willing to submit a PR? - [x] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
