stegololz commented on issue #75560: URL: https://github.com/apache/airflow/issues/75560#issuecomment-6418786147
Before anything gets implemented, though, I'd like @vincbeck to weigh in on the overall architecture. It adds a new BaseAuthManager hook and a core route, plus new public grants on /auth/token/cli. For what it's worth, here's how I'd lean on each: Refresh contract: agreed. From a user's point of view, I'd expect refreshing to keep you logged in for the rest of the session you started, never longer. The session should still end when the original CLI token would have expired, however often it's refreshed. A revoked token shouldn't be refreshable either. Refresh token in claims: probably acceptable. Anyone holding the CLI token can already use the refresh grant until it expires, and the Keycloak refresh token can't be used without the client secret. Discovery route: GET /api/v2/auth/cli/metadata, next to /api/v2/auth/login and unauthenticated like it, seems natural. Older cores: I'd treat a 404 and an empty method list the same in airflowctl. I don't think the provider needs any gating, because an older core never calls the hook. python-keycloak>=6.0: I'd put it in the browser-flow PR, since only PKCE needs it. Config names: they look fine to me. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
