baptistegh opened a new pull request, #75672: URL: https://github.com/apache/airflow/pull/75672
airflowctl can't tell which login flows a server supports before it tries one. An unsupported flow shows up as a 404 or, for a browser login, as a silent timeout, because the browser makes the first request. This PR adds an optional `get_cli_login_methods()` hook to `BaseAuthManager`, and a public `GET /api/v2/auth/cli/metadata` route that returns its result. The field names follow RFC 8414 (`grant_types_supported`, `code_challenge_methods_supported`, `authorization_endpoint`, `device_authorization_endpoint`, `token_endpoint`), but the route isn't served as a `.well-known` document. The hook returns an empty result by default, so the Simple and FAB auth managers advertise nothing and the route returns 200 for every auth manager. Like `/auth/login`, the route needs no authentication, because clients call it before they log in. As requested in the issue, the contract doesn't depend on any one auth manager. The auth manager docs now say what each advertised grant must accept and return on its endpoints: - `password` - `authorization_code`, with an S256 code challenge and a loopback redirect - the device code grant - `refresh_token` So airflowctl can log in through any auth manager that implements the hook. Endpoints are paths relative to the API server root URL rather than absolute URLs, because the auth manager may not know the public URL clients use. For now, only the Keycloak provider will implement the hook. These contract details are proposals, and I'd like reviewers' opinion on them: - The `refresh_token` grant takes the current CLI token in a `token` field. - While the device code is pending, the token endpoint answers `400` with `authorization_pending` or `slow_down` as `detail`. - When the body has no `grant_type`, the token endpoint treats it as `password`, so existing clients keep working. This is the first step of the airflowctl SSO work discussed in the issue. Follow-up PRs will add the Keycloak flows and make airflowctl read this route before it picks a flow. The generated files are updated: the OpenAPI spec, the UI client, airflowctl's `generated.py` and the API permission references. related: #75560 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
