shashank-iitbhu opened a new pull request, #73234:
URL: https://github.com/apache/airflow/pull/73234
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
Keycloak's UMA `uma-ticket` grant often returns HTTP 400 `invalid_grant` /
`Invalid bearer token` when the nested Keycloak access token has expired.
`_is_authorized` and `_is_batch_authorized` currently raise `AirflowException`
for that 400, which the API server surfaces as HTTP 500.
401 is already treated as unauthorized (#59281). 400 `invalid_resource` on
team resources is already treated as deny (#69028). This maps 400
`invalid_grant` onto the same deny path so API clients get 403 instead of 500
and can remint.
`invalid_scope` and other unrecognized 400s still raise.
closes: #73232
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
- [ ] No
Generated-by: Cursor following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
