baptistegh opened a new pull request, #75938: URL: https://github.com/apache/airflow/pull/75938
Users who sign in to Airflow through SSO or with a second factor have no password to give airflowctl. This adds `airflowctl auth login --sso` (and `auth token --sso`), which logs in through the browser when the API server's auth manager offers it through the CLI login discovery route from #75672. airflowctl only follows the contract documented in core, so it doesn't know or care which auth manager serves it. The Keycloak auth manager is the first to offer browser login, in #75913. The two PRs are independent and can be merged in either order. related: #75560 ### Changes - `auth login --sso` / `auth token --sso` read `GET /api/v2/auth/cli/metadata`. They need `authorization_code` with `S256` and both endpoints, otherwise they fail at once with "does not offer browser login (--sso)". A 404 (an API server without discovery) counts as offering nothing. - The browser flow is authorization code + PKCE (`S256`, RFC 7636) over a loopback redirect (RFC 8252): a one-shot HTTP server on `127.0.0.1` with a random port, a random `state` checked on return, and no request logging, so the code never reaches stderr. - `--no-browser` only prints the login URL (for example over `ssh -L`). It is not the device code flow, which comes in a later PR. - `--timeout` (default 300 seconds) bounds the wait for the browser. - `--sso` refuses `--api-token`, `--username`, `--password` and `--skip-keyring`. - Docs: `start.rst` describes the new login, and the `auth login` help image is regenerated. Not included: refreshing the CLI token with the `refresh_token` grant, and the device code flow. Both follow in separate PRs. ### Trying it With #75913 and `[keycloak_auth_manager] cli_authorization_code_enabled = True`: ```bash airflowctl auth login --sso --api-url http://localhost:8080 --env sso airflowctl dags list --env sso ``` --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
