Update refresh token flow #55506
Merged
Update refresh token flow #55506
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
boring-cyborg
bot
added
area:API
vincbeck
force-pushed
the
vincbeck/auth
branch
from
5c0cfe3 to
20126d1
Compare
bugraoz93
reviewed
Sep 11, 2025
Contributor
bugraoz93
left a comment
bugraoz93
left a comment
There was a problem hiding this comment.
Overall, I like the approach. It is simple and extensible. It won't bring any complexity to create new auth managers. Thanks, Vincent!
providers/keycloak/src/airflow/providers/keycloak/auth_manager/keycloak_auth_manager.py
Show resolved
Hide resolved
LipuFei
reviewed
Sep 15, 2025
Member
pierrejeambrun
left a comment
pierrejeambrun
left a comment
There was a problem hiding this comment.
Nice, I like this approach too. 👍
vincbeck
force-pushed
the
vincbeck/auth
branch
from
20126d1 to
ce67f86
Compare
vincbeck
requested review from
bbovenzi,
eladkal,
ephraimbuddy,
jason810496,
jscheffl,
o-nikolas,
rawwar,
ryanahamilton and
shubhamraj-git
as code owners
jason810496
reviewed
Sep 28, 2025
airflow-core/src/airflow/api_fastapi/auth/middlewares/refresh_token.py
Outdated
Show resolved
Hide resolved
vincbeck
force-pushed
the
vincbeck/auth
branch
2 times, most recently
from
b9ed97b to
fc13ede
Compare
jason810496
approved these changes
Sep 30, 2025
vincbeck
force-pushed
the
vincbeck/auth
branch
from
fc13ede to
e8aff0c
Compare
Member
pierrejeambrun
left a comment
pierrejeambrun
left a comment
There was a problem hiding this comment.
Looks good to me, just one remark
vincbeck
requested review from
amoghrajesh,
gopidesupavan and
jedcunningham
as code owners
vincbeck
force-pushed
the
vincbeck/auth
branch
from
8503714 to
22cba85
Compare
Contributor
Author
|
#56633 was merged so I rebased this PR to only include the refresh token change. |
bugraoz93
approved these changes
Oct 15, 2025
abdulrahman305 bot
pushed a commit
to abdulrahman305/airflow
that referenced
this pull request
Oct 17, 2025
abdulrahman305 bot
pushed a commit
to abdulrahman305/airflow
that referenced
this pull request
Oct 19, 2025
69 tasks
TyrellHaywood
pushed a commit
to TyrellHaywood/airflow
that referenced
this pull request
Oct 22, 2025
2 tasks
vincbeck
added a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
Nov 24, 2025
vincbeck
added a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
Nov 24, 2025
potiuk
pushed a commit
that referenced
this pull request
Nov 25, 2025
ephraimbuddy
pushed a commit
that referenced
this pull request
Dec 3, 2025
78 tasks
ephraimbuddy
added a commit
that referenced
this pull request
Dec 8, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The refresh token flow gets updated to make it simpler. Auth managers that need to refresh token periodically (e.g. Keycloak), need to implement the method
refresh_token. This method is called before every request and check whether the token needs to be refreshed. If so, the token gets refreshed, is passed to the route implementation and saved as part of the response as cookie. This happens silently without the user noticing. Hence, we no longer need to have a refresh token public API.^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named
{pr_number}.significant.rstor{issue_number}.significant.rst, in airflow-core/newsfragments.