potiuk opened a new pull request, #72645: URL: https://github.com/apache/airflow/pull/72645
The `authentik` OAuth path in the FAB auth manager decoded the `id_token` without any `claims_options`, so authlib validated only the time-based claims. Neither the issuer nor the audience was checked. A provider signs the tokens of every application registered with it using a single key set, so a valid signature only establishes that the provider minted the token — not that it was minted for Airflow. A token issued for a different application registered with the same provider was accepted and authenticated its subject as an Airflow user. This pins: * `aud` to the configured `client_id` * `iss` to the issuer advertised in the provider's OpenID metadata If no issuer can be resolved, verification now fails with an actionable error rather than falling back to an audience-only check — the configured key set may sign for more than one issuer, so an audience-only check would still accept a token from an untrusted one. Deployments whose metadata does not publish an `issuer` can set it explicitly in the provider's `client_kwargs`; this is documented. This mirrors the `claims_options` already applied on the `azure` path in the same file. ### Tests Six tests covering a correctly addressed token, a token for another application, a token from another issuer, the fail-closed path (asserted with a *correct* audience and a *wrong* issuer, which is the shape an audience-only fallback would let through), and the configured-issuer override both accepting a valid token and rejecting a foreign issuer. The three rejection tests fail without the source change. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
