apache-airflow-providers-keycloak==0.3.0|0.4.0 redirects to 127.0.0.1:8080 after a successfull login

[gbonazzoli]

Apache Airflow version

3.1.3

If "Other Airflow 2/3 version" selected, which one?

No response

What happened?

I configure Airflow 3.1.3 to authenticate to an existing (and working) Keycloak.

The module version is: apache-airflow-providers-keycloak==0.3.0

After a successful login, keycloak redirects to 127.0.0.1:8080 after a successfull login and precisely to:

http://127.0.0.1:8080/auth/login_callback?state=&session_state=30ad9dfa-be2c-161b-8ca4-457160323188&iss=https%3A%2F%2Fkeycloak-prod.colombinigroup.com%2Frealms%2Fcolombini&code=cae7d5a5-17a0-4b35-8eaf-af65892e4b07.30ad9dfa-be2c-161b-8ca4-457160323188.90b317e0-38bd-4349-8d57-135adf4cdbf2

My configuration in airflow.cfg is:

...
auth_manager = airflow.providers.keycloak.auth_manager.keycloak_auth_manager.KeycloakAuthManager
...
[keycloak_auth_manager]
client_id = airflow-test
client_secret = xxxxxxxxxxxxxxxxxxxxxxxxxxxx

<img width="722" height="866" alt="Image" src="https://github.com/user-attachments/assets/c866b981-4423-4a35-9636-81a252ca53ea" />

<img width="722" height="866" alt="Image" src="https://github.com/user-attachments/assets/f8c00f73-2381-403f-9cbb-4ee7f2d39181" />

realm = colombini
server_url = https://keycloak-prod.colombinigroup.com
# server_url = http://192.168.99.11:30026

and here is how is configure the OIDC Client in Keycloak:

What you think should happen instead?

It should instead put me through the Airflow 3.1.3 User interface.

How to reproduce

Configure a vanilla airflow with the 4 parameters

Operating System

Ubuntu 24.04.3 LTS

Versions of Apache Airflow Providers

apache-airflow                           3.1.3
apache-airflow-core                      3.1.3
apache-airflow-providers-celery          3.13.1
apache-airflow-providers-common-compat   1.8.0
apache-airflow-providers-common-io       1.6.4
apache-airflow-providers-common-sql      1.28.2
apache-airflow-providers-keycloak        0.3.0
apache-airflow-providers-postgres        6.4.0
apache-airflow-providers-smtp            2.3.1
apache-airflow-providers-standard        1.9.1
apache-airflow-task-sdk                  1.1.3

Deployment

Virtualenv installation

Deployment details

Nothing special.

Anything else?

No

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[bugraoz93]

Could you please try setting the values according to here? We can make this document accurate and better. This settings works in my local integration
#58605

[bugraoz93]

I think in your case you should add below domain and follow the document approach to check if the field needs /* wildcard at the end of value.
Could you please check with the new values?
Please also ensure they are either one of these

http://172.16.80.246:8080/
or
http://172.16.80.246:8080/*

[bugraoz93]

   * - Field 
     - Production Value 
   * - Root URL 
     - https://yourcompany.airflow.com 
   * - Home URL 
     - https://yourcompany.airflow.com 
   * - Valid Redirect URIs 
     - https://yourcompany.airflow.com/* 
   * - Valid Post Logout Redirect URIs 
     - https://yourcompany.airflow.com/* 
   * - Web Origins 
     - https://yourcompany.airflow.com

[gbonazzoli]

@bugraoz93

I tried but the problem still exists and by the way it seems that the best solution is to have * as Valid Redirect URI, at least this configuration will display the login window.

In my tests I tried both chains:

• all "https with domain names, eg https://keycloak-prod.colombinigroup.com"
• all "http with IP Addresses, eg. http://192.168.99.11:30026".

What I think is that if you have an Airlfow on a Virtual Machine (in my case 172.16.80.246) and Keycloak on a different Virtual Machine (in my case on a Kubernetes cluster, eg. http://192.168.99.11:30026 on the configuration) you have somewhere written on the code (or computed on the code) to return control to 127.0.0.1:8080 and not to 172.16.80.246:8080.

Probably some networking mechanism (NAT ???) will confuse the code ?

If Airflow and Keycloak are both on same machine (for example linked together with docker-compose) probably you can have a configuration that works.

It is only an hypothesis.