baptistegh commented on PR #75913: URL: https://github.com/apache/airflow/pull/75913#issuecomment-6481001122
The CLI never talks to Keycloak's token endpoint and never gets Keycloak tokens. Keycloak sends the authorization code to the CLI's loopback callback. The CLI passes the code and its PKCE `code_verifier` to Airflow. Airflow then exchanges the code with Keycloak using the client secret, the same way the web login does, and returns an Airflow CLI token. So the existing confidential client is enough. Airflow enforces PKCE (S256) and loopback-only redirect URIs itself. An intercepted code is useless without the client secret and the `code_verifier`. A separate public client would need its own config option, an audience mapper so its tokens still pass authorization against the `airflow` client, and separate refresh handling. That's possible as a follow-up if there's a need, but it isn't required for this flow. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
