baptistegh commented on code in PR #75913:
URL: https://github.com/apache/airflow/pull/75913#discussion_r4413716757
##########
providers/keycloak/src/airflow/providers/keycloak/auth_manager/services/token.py:
##########
@@ -37,6 +42,48 @@
from airflow.providers.keycloak.auth_manager.keycloak_auth_manager import
KeycloakAuthManager
from airflow.providers.keycloak.auth_manager.user import
KeycloakAuthManagerUser
+# RFC 8252 section 7.3 loopback redirects. ``localhost`` is left out because
it can resolve
+# to a non-loopback interface.
+CLI_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "::1"})
+CLI_CALLBACK_PATH = "/callback"
+
+
+def is_cli_authorization_code_enabled() -> bool:
+ return conf.getboolean(CONF_SECTION_NAME,
CONF_CLI_AUTHORIZATION_CODE_ENABLED_KEY, fallback=False)
+
+
+def is_cli_loopback_redirect_uri(redirect_uri: str) -> bool:
+ """Return whether ``redirect_uri`` is a loopback callback a command-line
client listens on."""
+ try:
+ parts = urlsplit(redirect_uri)
+ port = parts.port
+ except ValueError:
+ return False
+ return (
+ parts.scheme == "http"
+ and parts.hostname in CLI_LOOPBACK_HOSTS
+ and port is not None
+ and parts.username is None
+ and parts.path == CLI_CALLBACK_PATH
+ and not parts.query
+ and not parts.fragment
+ )
+
+
+def _create_api_jwt_from_keycloak_tokens(
Review Comment:
`create_token_for` does the password-grant exchange first, and
`create_client_credentials_token` had its own near-copy with a different `name`
fallback
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
