edsu opened a new issue, #72352:
URL: https://github.com/apache/airflow/issues/72352
### Under which category would you file this issue?
Providers
### Apache Airflow version
3.3.1
### What happened and how to reproduce it?
On Airflow 3.3+, a token obtained from POST /auth/token no longer
authenticates when presented as Authorization: Bearer <token>. The endpoint
still returns a token; the token just no longer resolves to a user.
Only browser sessions work, because only the cookie path supplies the
Keycloak access token. There appears to be no documented way for a non-browser
client to obtain the `_access_token` cookie value: `POST /auth/token` returns
the Airflow JWT alone.
§§§ Reproduction
Here is a test for
`providers/keycloak/tests/unit/keycloak/auth_manager/test_keycloak_auth_manager.py`.
It
round-trips through the auth manager's own serializer, which is what
`generate_jwt()` does
when `POST /auth/token` mints a token, and then resolves it the way the
bearer path does,
with no cookies:
```python
@pytest.mark.asyncio
async def test_get_user_from_token_round_trip_without_cookies(self,
auth_manager):
"""A token minted by ``POST /auth/token`` must authenticate a bearer
request.
The bearer path calls ``get_user_from_token()`` with the token alone --
no cookies --
so the user has to be reconstructible from the claims the auth manager
itself wrote.
"""
access_token = keycloak_token("user_id")
minted_claims = auth_manager.serialize_user(
KeycloakAuthManagerUser(
user_id="user_id",
name="name",
access_token=access_token,
refresh_token="refresh_token",
)
)
mock_token_validator = Mock()
mock_token_validator.avalidated_claims =
AsyncMock(return_value=minted_claims)
with patch.object(
KeycloakAuthManager, "_get_token_validator",
Mock(return_value=mock_token_validator)
):
user = await auth_manager.get_user_from_token("token")
assert user is not None, (
"a token from POST /auth/token no longer authenticates a bearer
request"
)
assert user.get_id() == "user_id"
assert user.access_token == access_token
```
This should work on v0.8.2 and fail under v0.9.0.
### Observed end to end
Against a running 3.3.1 api-server with provider 0.9.0 and the Keycloak auth
manager:
```
$ curl -X POST http://airflow-apiserver:8080/auth/token \
-H 'Content-Type: application/json' \
-d '{"username":"developer","password":"123456"}'
HTTP 201
{"access_token":"eyJhbGciOiJIUzUxMiIs..."}
```
Its payload decodes to `user_id`, `name`, `jti`, `aud`, `nbf`, `exp`, `iat`
— no
`access_token` or `refresh_token`. Presenting it:
| request | result |
|---|---|
| `GET /api/v2/dags` + `Authorization: Bearer` | **500** |
| `GET /ui/auth/me` + `Authorization: Bearer` | **500** |
| `GET /api/v2/monitor/health` (unauthenticated) | 200 |
The failure is a **500, not a 401** — the `None` propagates into the
authorization layer:
```
AttributeError: 'NoneType' object has no attribute 'get_id'
```
### What you think should happen instead?
A token from `POST /auth/token` authenticates an API request via
`Authorization: Bearer`, as it does on 0.8.x and as both the provider docs and
core's API description describe.
### Operating System
macOS 26.6.2
### Deployment
Docker-Compose
### Apache Airflow Provider(s)
keycloak
### Versions of Apache Airflow Providers
You should be able to see our providers (including keycloak) in our
`uv.lock`:
https://github.com/blue-core-lod/bluecore-workflows/blob/upgrade-airflow-3.3.1/uv.lock
### Official Helm Chart version
Not Applicable
### Kubernetes Version
_No response_
### Helm Chart configuration
_No response_
### Docker Image customizations
https://github.com/blue-core-lod/bluecore-workflows/blob/upgrade-airflow-3.3.1/Dockerfile
### Anything else?
_No response_
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
