basantjamwal opened a new pull request, #75871:
URL: https://github.com/apache/airflow/pull/75871
closes: #75857
## Summary
When Keycloak is configured without refresh tokens ("Use Refresh Tokens"
disabled on the client), the token response has no `refresh_token` key. Both
login flows read it with `tokens["refresh_token"]` and crashed with `KeyError:
'refresh_token'`.
## Changes
- `routes/login.py` (browser login): use `tokens.get("refresh_token")` and
only set the refresh token cookie when a refresh token exists, so `None` is
never stored in a cookie.
- `services/token.py` (API token endpoint): use
`tokens.get("refresh_token")`.
## Why this is safe
- `KeycloakAuthManagerUser.refresh_token` is already typed `str | None`.
- `refresh_user` / `refresh_tokens` already return early when there is no
refresh token.
- Behaviour is unchanged when Keycloak does return a refresh token.
With no refresh token, sessions cannot be silently renewed, so the user logs
in again once the access token expires. This is expected for that configuration.
This PR makes the "refresh tokens disabled" setup work. It does not address
the Keycloak 26.8 deprecation warning mentioned in the issue.
## Tests
- `test_login_callback_without_refresh_token`: token response without
`refresh_token`. Asserts `user.refresh_token is None`, the response is a 303
redirect, and no `_refresh_token` cookie is set.
- `test_create_token_without_refresh_token`: same scenario for the API token
endpoint. Asserts `user.refresh_token is None`.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (Claude)
Generated-by: Claude (Anthropic) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
