zach-overflow commented on code in PR #53397:
URL: https://github.com/apache/airflow/pull/53397#discussion_r2208921571
##########
airflow-core/docs/core-concepts/auth-manager/index.rst:
##########
@@ -145,25 +146,27 @@ These authorization methods are:
* ``is_authorized_custom_view``: Return whether the user is authorized to
access a specific view not defined in Airflow. This view can be provided by the
auth manager itself or a plugin defined by the user.
* ``filter_authorized_menu_items``: Given the list of menu items in the UI,
return the list of menu items the user has access to.
+It should be noted that the API ``methods`` listed above may only have
relevance for a specific subset of the auth manager's authorization methods.
+For example, the ``configuration`` resource is by definition read-only, so
only the ``GET`` API method is relevant in the context of
``is_authorized_configuration``.
+
JWT token management by auth managers
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The auth manager is responsible for creating the JWT token needed to interact
with Airflow public API.
To achieve this, the auth manager **must** provide an endpoint to create this
JWT token. This endpoint is usually
available at ``POST /auth/token``.
Please double check the auth manager documentation to find the accurate token
generation endpoint.
-The auth manager is also responsible of passing the JWT token to Airflow UI.
The protocol to exchange the JWT
+The auth manager is also responsible for passing the JWT token to Airflow UI.
The protocol to exchange the JWT
token between the auth manager and Airflow UI is using cookies. The auth
manager needs to save the JWT token in a
-cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI
will then read the cookie, save it and
-delete the cookie.
+cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI
will then read the cookie, save it, and delete it.
.. code-block:: python
from airflow.api_fastapi.auth.managers.base_auth_manager import
COOKIE_NAME_JWT_TOKEN
response = RedirectResponse(url="/")
- secure = bool(conf.get("api", "ssl_cert", fallback=""))
+ secure = request.base_url.scheme == "https" or bool(conf.get("api",
"ssl_cert", fallback=""))
Review Comment:
Let me know if this is no longer the case, but judging by the source code in
the various auth managers, I think this is the proper way to determine the
`secure` value for the JWT cookie. I was thinking of putting up a separate PR
to abstract this repeat logic into a common util function.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
