robertpofuk commented on code in PR #72262:
URL: https://github.com/apache/airflow/pull/72262#discussion_r3958250738
##########
providers/edge3/src/airflow/providers/edge3/worker_api/auth.py:
##########
@@ -30,21 +31,64 @@
InvalidSignatureError,
)
-from airflow.api_fastapi.auth.tokens import JWTValidator
+from airflow.api_fastapi.auth.tokens import JWKS, JWTValidator
from airflow.providers.common.compat.sdk import conf
log = logging.getLogger(__name__)
-@cache
-def jwt_validator() -> JWTValidator:
+def _trusted_jwks_url() -> str:
+ """Return the configured trusted JWKS URL, or an empty string when
unset."""
+ return conf.get("edge", "trusted_jwks_url", fallback="") or ""
+
+
+def _jwt_algorithms() -> list[str]:
+ """Return the accepted signing algorithms for OIDC worker tokens."""
+ configured = conf.get("edge", "jwt_algorithm", fallback="RS256") or "RS256"
+ return [algorithm.strip() for algorithm in configured.split(",") if
algorithm.strip()]
+
+
+def _jwt_audience() -> str | None:
+ """Return the expected token audience, or None to skip audience
verification."""
+ return conf.get("edge", "jwt_audience", fallback="") or None
+
+
+def _shared_secret_validator() -> JWTValidator:
+ """Build a validator for worker tokens signed with the shared ``[api_auth]
jwt_secret``."""
return JWTValidator(
secret_key=conf.get("api_auth", "jwt_secret"),
leeway=conf.getint("api_auth", "jwt_leeway", fallback=30),
audience="api",
)
+def _oidc_validator(jwks_url: str) -> JWTValidator:
+ """
+ Build a validator for worker tokens issued by a trusted OIDC provider.
+
+ Verifies the token signature against the provider JWKS and checks the
+ ``iss`` and (optionally) ``aud`` claims. Used when ``[edge]
trusted_jwks_url``
+ is configured, so workers can authenticate with tokens minted by an
+ external identity provider instead of the shared secret.
+ """
+ return JWTValidator(
+ jwks=JWKS(url=jwks_url),
+ issuer=conf.get("edge", "jwt_issuer", fallback=None),
+ audience=cast("str", _jwt_audience()),
+ algorithm=_jwt_algorithms(),
+ required_claims=frozenset({"iat", "exp"}),
+ leeway=conf.getint("api_auth", "jwt_leeway", fallback=30),
Review Comment:
If we do edge3.jwt_leeway then i would not fallback. Its is then
configuration cross reference. This one would be worst one. I think if I open
edge3 config and I see there jwt_leeway and other JWT settings in one place it
is fine and clear. So current impl with edge3.jwt_leeway would i think fit the
best and be clean and isolated and most fleksible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
