The GitHub Actions job "Tests (AMD)" on airflow.git/fab-azure-validate-issuer-audience has failed. Run started by GitHub user potiuk (triggered by potiuk).
Head commit for run: 09ff60a9c0dfd64d63251be678d7a56aed1ec8a3 / Jarek Potiuk <[email protected]> Validate issuer and audience of Azure AD id_tokens in FAB auth manager The Azure id_token signature is verified against Microsoft's key set, but the decode call passed no claims_options, so authlib's claims.validate() enforced neither the issuer nor the audience. The key set in use is the multi-tenant one (login.microsoftonline.com/common/discovery/keys), which serves signing keys for every Azure tenant. A correctly-signed token from any tenant therefore satisfied the signature check, and get_oauth_user_info() then read the login identity (oid, email, roles) straight out of it. Pin both claims: * iss must be the configured tenant, accepting the v1.0 (sts.windows.net/<tenant>/) and v2.0 (login.microsoftonline.com/<tenant>/v2.0) issuer forms. * aud must be this application's client_id. The tenant is taken from an explicit tenant_id in client_kwargs when set, and otherwise from the tenant segment of the configured endpoints, which is where the documented configuration already puts it. Deployments that follow the documented setup therefore need no configuration change. A configuration that identifies no single tenant - the common, organizations or consumers endpoints - now raises rather than accepting tokens it cannot attribute to an issuer. That is a behaviour change for those deployments: they need to set tenant_id explicitly. The existing test that asserted the verification branch is reached by default now supplies a tenant-bearing endpoint, since tenant resolution happens before the key set is fetched. Generated-by: Claude Opus 5 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions Report URL: https://github.com/apache/airflow/actions/runs/32067445082 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
