Kunal8954 commented on issue #72903: URL: https://github.com/apache/airflow/issues/72903#issuecomment-5628193984
I investigated the current Keycloak auth-manager implementation and the federated client authentication flow. A possible implementation looks like: add optional client_assertion / client_assertion_type fields to the existing client-credentials token request and forward them to Keycloak; keep Keycloak as the trust anchor for resolving the federated client identity; add an optional [keycloak_auth_manager] valid_clients allowlist, defaulting to empty so existing behavior remains unchanged; enforce the allowlist against the client identity resolved by Keycloak rather than the caller-supplied client_id; keep existing Airflow-signed JWT issuance and UMA authorization unchanged. I’d like to confirm the proposed valid_clients semantics/config key with maintainers before implementing it. I’d also validate the resolved client identity against a real Keycloak 26.6+ instance. If this direction looks appropriate, I’m happy to prepare the implementation and tests. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
