FrankYang0529 opened a new pull request, #74529:
URL: https://github.com/apache/airflow/pull/74529
### Why
- #73698 records each login in the `_awsam_login_state` cookie, and by
default `/auth/login_callback` only accepts a SAML response that matches an
entry in that cookie. The cookie is set with `SameSite=Lax`.
- After sign-in, the IdP sends the SAML response back with an auto-submitted
form POST to `/auth/login_callback`. IAM Identity Center is on a different site
than Airflow, so this POST is cross-site. Browsers do not send `SameSite=Lax`
cookies on cross-site POST requests.
- As a result, every login started from Airflow fails with 401 "No login in
progress for this browser. Start the login from Airflow and try again." Users
cannot log in to the UI. Turning on `allow_idp_initiated_login` does not help.
Without the login state cookie, the callback handles the SAML response as an
IdP-initiated login. It then rejects the response with 401 "Invalid SAML
response", because the response carries `InResponseTo`.
### How
- Over https, set the login state cookie with `SameSite=None`. Browsers
require `Secure` for `SameSite=None`, and the cookie already gets `Secure` over
https.
- Over plain http, keep `SameSite=Lax`. Browsers reject a `SameSite=None`
cookie without `Secure`, so `SameSite=None` would break every login over plain
http that starts from Airflow. This PR does not fix logins over plain http that
start from Airflow and use IAM Identity Center, because Identity Center is on a
different site than Airflow. Over plain http, a login that starts from Airflow
completes only with an IdP on the same site as Airflow, for example a local
test IdP.
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
<!--
Thank you for contributing!
Please provide above a brief description of the changes made in this pull
request.
Write a good git commit message following this guide:
https://chris.beams.io/posts/git-commit/
Please make sure that your code changes are covered with tests.
And in case of new features or big changes remember to adjust the
documentation.
For user-facing UI changes, please attach before/after screenshots (or a
short
screen recording) so reviewers can assess the visual impact.
Feel free to ping (in general) for the review if you do not see reaction for
a few days
(72 Hours is the minimum reaction time you can expect from volunteers) - we
sometimes miss notifications.
In case of an existing issue, reference it using one of the following:
* closes: #ISSUE
* related: #ISSUE
-->
---
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR,
please
change below checkbox to `[X]` followed by the name of the tool, uncomment
the "Generated-by".
-->
- [X] Yes - Claude Code
<!--
Generated-by: [Tool Name] following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
-->
---
* Read the **[Pull Request
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)**
for more information. Note: commit author/co-author name and email in commits
become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License
Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment:
`{pr_number}.significant.rst`, in
[airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
You can add this file in a follow-up commit after the PR is created so you
know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
