baptistegh opened a new pull request, #75804: URL: https://github.com/apache/airflow/pull/75804
**Draft. Not for merge.** Stacked on #75672: the first commit here is #75672 itself. Review only the second commit. This shows how an auth manager builds on the CLI login discovery contract from #75672. Keycloak is the only auth manager that implements it. airflowctl reads `GET /api/v2/auth/cli/metadata` and never checks which auth manager is running. Once the contract is agreed, this will be split into separate PRs: the provider token body and refresh, the provider browser login, and airflowctl `--sso`. related: #75560 ### Keycloak provider - `get_cli_login_methods()` always advertises `password` and `refresh_token`. It adds `authorization_code` with `S256` only when `[keycloak_auth_manager] cli_authorization_code_enabled` is on (default `False`). - `/auth/token/cli` gets its own body: `password` (the default), `refresh_token` or `authorization_code`. `client_credentials` and `jwt-bearer` stay on `/auth/token` only. - `GET /auth/login/cli` requires a loopback `redirect_uri` (`http://127.0.0.1` or `[::1]`, any port, `/callback`) and an `S256` challenge, then forwards both to Keycloak. Airflow requires PKCE here rather than on the Keycloak client, because the web login doesn't use it. - **Refresh:** the new token keeps the expiry of the old one. Expired and revoked tokens are refused, using the auth manager's own `get_user_from_token`. - Bumps `python-keycloak>=6.0.0` for PKCE support. ### airflowctl - `auth login --sso` and `auth token --sso`, with `--no-browser` and `--timeout`. - airflowctl starts a one-shot callback server on `127.0.0.1`, checks `state`, and swaps the code and verifier for a CLI token at the advertised `token_endpoint`. - A 404 from the metadata route counts as "nothing offered". airflowctl never tries a flow the server doesn't advertise. ### Not in this preview - The device code flow (`--device-code`). It plugs into the same metadata the same way. - Automatic refresh in airflowctl when a request returns 401. The provider side of refresh is included. - Provider changelog entry. ### Note on #75672 Endpoints in the metadata are absolute paths such as `/auth/token/cli`. When `[api] base_url` has a path, they include it (`/prefix/auth/token/cli`), and clients resolve them against the API server URL. The #75672 docs say "relative to the API server root URL". I'd reword that there to "absolute paths, resolved against the API server URL". --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
