Vamsi-klu commented on PR #68672:
URL: https://github.com/apache/airflow/pull/68672#issuecomment-5014058432
For the async path, the established pattern here is to keep one synchronous
Google-auth implementation and bridge it from the async token dispatcher with
the executor:
```python
async def _a_get_wif_databricks_token(self) -> str:
loop = asyncio.get_running_loop()
return await loop.run_in_executor(None, self._get_wif_databricks_token)
```
Then `_a_get_token()` can mirror the synchronous dispatch branch and `await`
that helper. This avoids blocking the triggerer event loop without requiring an
async Google Auth client.
While rebasing, I think the same patch should also:
- use an explicit `if self.databricks_conn.login` split for service-account
impersonation versus direct default credentials;
- cache the Google ID token in `self.oauth_tokens`, keyed by the normalized
`https://{host}` audience, using its decoded `exp` with `_is_oauth_token_valid`;
- raise `ValueError` for a missing host and remove the
`known_airflow_exceptions` allowance instead of adding a direct `raise
AirflowException(...)`;
- document `roles/iam.serviceAccountTokenCreator` for impersonation, the
`[google]` extra, an empty password so earlier auth branches do not win, and
deferrable support.
I can prepare focused commits and tests for the sync/async,
direct/impersonated, cache/expiry, dependency-error, audience, and precedence
branches if that would help; I will not open a competing Apache PR while this
one is active.
---
Drafted-by: Codex (GPT-5) (no human review before posting)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
