tomakita opened a new pull request, #75024: URL: https://github.com/apache/airflow/pull/75024
`airflowctl auth login` takes a token or a username and password, but there is currently no way to run `airflowctl auth login`, have it initiate OIDC in your browser, and then pass the resulting OAuth token back to the terminal. This adds `airflowctl auth login --web`, which is a loopback-redirect flow terminals can use for OAuth, with Airflow as its own authorization server. airflowctl listens on a random loopback port and opens an approval page in the Airflow UI. A user without a session goes through the auth manager's normal login first, via the UI's existing `next` redirect, so no auth manager needed changes for this PR. When the user approves authorization in the UI, Airflow mints the CLI token, wraps it encrypted in a one-time code and redirects the browser to `http://127.0.0.1:<port>/callback`; airflowctl redeems the code, together with a PKCE verifier only it knows, and saves the token as `--api-token` would. **Example usage** ``` $ airflowctl auth login --api-url https://airflow.example.com --web Opening https://airflow.example.com/cli/authorize?port=61996&state=…&code_challenge=…&code_challenge_method=S256 in your browser. Confirmation code: Z2sOIEjL Waiting for you to approve the login in the browser (Ctrl-C to cancel)... Login successful! Welcome to airflowctl! The token expires at 2026-10-18 12:13 PDT. Run this command again to log in after that. ``` **What the new page looks like** <img width="1280" height="720" alt="simple-approval-page" src="https://github.com/user-attachments/assets/21ed4a53-6a47-454c-8a76-564d5be0d030"; /> **What is added** - airflow-core: - the approval page at `/cli/authorize` - `POST /ui/auth/cli/authorize`, which needs a session, is audited through `action_logging()` like Generate Token, mints the token and returns the code - `POST /api/v2/auth/cli/token`, unauthenticated like an OAuth token endpoint, which redeems the code and returns the token in the shape of `GenerateTokenResponse` - airflow-ctl: - the `--web` flag with a loopback listener and PKCE, standard library only. - Docs for both distributions and the FAB permission reference, with tests for every piece. **Compatibility** In airflowctl, only `--web` depends on the new server endpoint. The existing token and username/password login paths are unchanged, so current airflowctl usage keeps working against any server. Before starting the browser flow, airflowctl probes for the new endpoint by behaviour rather than version: it POSTs an empty body to /api/v2/auth/cli/token, which a compatible server rejects with 422 while an older, incompatible server's catch-all route answers 405, so development builds and backports are detected correctly. On an older server, `--web` stops with a message pointing the user at Generate Token in the UI and `--api-token`, and the probe is sent without any saved token, so no credential is forwarded to a server that lacks the feature. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Fable 5.1) Generated-by: Claude Code (Fable 5.1) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
