bingqin2 commented on issue #72351: URL: https://github.com/apache/airflow/issues/72351#issuecomment-5651300590
Thanks for checking it on the RC. From the description of #72205, limiting `POST /auth/token` to the configured client is deliberate: the endpoint is unauthenticated, so before the change the credentials of any confidential client in a shared realm were valid Airflow logins. A separate `airflow-bootstrap` client is therefore not meant to work any more, and giving the `airflow` client's service account the roles you list is the supported way to do what the bootstrap client did. The trade-off to be aware of: the `airflow` client secret, which the API server already holds for the login flow, now also mints an admin API token, so it deserves the same handling the bootstrap secret had. @potiuk wrote #72205 and can say whether a dedicated bootstrap client is intended to come back in some form (for example an allow-list of client ids). If not, this issue can be closed once keycloak 0.10.0 is published. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
