Fix DAG-level RBAC by using claim_token per UMA spec (#61137) by y-sudharshan · Pull Request #61283 · apache/airflow

y-sudharshan · 2026-01-31T07:52:26Z

Fix DAG-level RBAC by using claim_token per UMA specification

Description

This PR fixes a bug in the Keycloak Auth Manager where context attributes (such as dag_id) were not being properly transmitted to Keycloak during authorization requests, preventing DAG-level RBAC policies from functioning.

Problem

When attempting to configure DAG-level authorization policies in Keycloak, the dag_id and other context attributes were not available to JavaScript-based policies. Network traces showed that instead of sending the actual attribute values, the literal string context=attributes was being transmitted in the authorization request.

Root Cause:
The original implementation used a non-standard context parameter with a nested dictionary:

payload["context"] = {"attributes": attributes}

This approach failed because:

It is not compliant with the UMA (User-Managed Access) specification
Nested dictionaries in form-urlencoded requests cannot be properly serialized by the requests library
Keycloak does not recognize the context parameter for authorization requests

Solution

Implemented the correct UMA specification for pushing claims to Keycloak by using the claim_token parameter:

claims = {key: [value] for key, value in attributes.items()}
claim_json = json.dumps(claims)
claim_token = base64.b64encode(claim_json.encode()).decode()
payload["claim_token"] = claim_token
payload["claim_token_format"] = "urn:ietf:params:oauth:token-type:jwt"

Key changes:

Use claim_token parameter instead of context (per UMA spec)
Base64-encode the JSON data
Format claim values as arrays of strings (required by Keycloak)
Add claim_token_format parameter

Reference: Keycloak Authorization Services - Pushing Claims

Impact

After this fix:

✅ DAG-level RBAC policies will work correctly
✅ dag_id and other context attributes are accessible in Keycloak policies
✅ Fine-grained authorization per DAG is now possible

Example Keycloak policy that now works:

const context = $evaluation.getContext();
const attributes = context.getAttributes();
const dagId = attributes.getValue('resource_id').asString(0);

if (dagId === 'sensitive_dag') {
    // Apply specific permissions
    $evaluation.grant();
}

Testing

Code passes ruff format and ruff check validation
Tested claim_token encoding/decoding with validation script
Verified form-urlencoded transmission preserves data correctly
Confirmed backwards compatibility (no impact when attributes are not provided)

Changes Made

Modified files:

providers/keycloak/src/airflow/providers/keycloak/auth_manager/keycloak_auth_manager.py
- Added import base64
- Updated _get_payload() method to use claim_token parameter
providers/keycloak/docs/changelog.rst
- Added bug fix entry for version 0.5.2

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

Generated-by: GitHub Copilot

n-badtke-cg

lgtm

EDIT: Is a bump of the version number already needed with this PR? https://github.com/apache/airflow/blob/main/providers/keycloak/src/airflow/providers/keycloak/__init__.py#L32

providers/keycloak/src/airflow/providers/keycloak/auth_manager/keycloak_auth_manager.py

ddroessler-ext · 2026-02-02T09:51:20Z

I tested the changes locally and can confirm that it works as expected - thanks a lot for the quick implementation.
The dag id is correctly sent to Keycloak and also available in JavaScript policies.

Small nit on your example in the PR, the id of the requested dag is in key resource_id instead of dag_id.

vincbeck

Thanks for fixing that issue. I added some comments, also, can you update/create test to cover that?

providers/keycloak/docs/changelog.rst

providers/keycloak/src/airflow/providers/keycloak/auth_manager/keycloak_auth_manager.py

Ensure consistent JSON key ordering by using sort_keys=True in json.dumps() when generating claim_token for UMA ticket requests. This fixes test failures caused by non-deterministic dictionary ordering in Python. The claim_token is base64-encoded JSON, so consistent key ordering is required for test assertions and predictable behavior.

- Fix documentation URL anchor from #_service_authorization_pushing_claims to #_service_pushing_claims - Remove changelog entry as requested by release manager - Add comprehensive parametrized tests for _get_payload method covering claim_token functionality

bugraoz93

Still a quite bit of CI failing. Could you please check?

n-badtke-cg · 2026-02-06T09:35:30Z

🥳

* Fix DAG-level RBAC by using claim_token per UMA spec (apache#61137) * Fix claim_token ordering in Keycloak auth manager Ensure consistent JSON key ordering by using sort_keys=True in json.dumps() when generating claim_token for UMA ticket requests. This fixes test failures caused by non-deterministic dictionary ordering in Python. The claim_token is base64-encoded JSON, so consistent key ordering is required for test assertions and predictable behavior. * Address review comments: fix doc URL, remove changelog, add tests - Fix documentation URL anchor from #_service_authorization_pushing_claims to #_service_pushing_claims - Remove changelog entry as requested by release manager - Add comprehensive parametrized tests for _get_payload method covering claim_token functionality

y-sudharshan · 2026-02-09T06:31:42Z

🥳

Thanks!
Thanks for your relevant and quick review

* Fix DAG-level RBAC by using claim_token per UMA spec (apache#61137) * Fix claim_token ordering in Keycloak auth manager Ensure consistent JSON key ordering by using sort_keys=True in json.dumps() when generating claim_token for UMA ticket requests. This fixes test failures caused by non-deterministic dictionary ordering in Python. The claim_token is base64-encoded JSON, so consistent key ordering is required for test assertions and predictable behavior. * Address review comments: fix doc URL, remove changelog, add tests - Fix documentation URL anchor from #_service_authorization_pushing_claims to #_service_pushing_claims - Remove changelog entry as requested by release manager - Add comprehensive parametrized tests for _get_payload method covering claim_token functionality

y-sudharshan requested review from bugraoz93 and vincbeck as code owners January 31, 2026 07:52

boring-cyborg bot added area:providers kind:documentation provider:keycloak labels Jan 31, 2026

n-badtke-cg reviewed Feb 2, 2026

View reviewed changes

n-badtke-cg approved these changes Feb 2, 2026

View reviewed changes

providers/keycloak/src/airflow/providers/keycloak/auth_manager/keycloak_auth_manager.py Outdated Show resolved Hide resolved

vincbeck reviewed Feb 2, 2026

View reviewed changes

providers/keycloak/docs/changelog.rst Outdated Show resolved Hide resolved

providers/keycloak/src/airflow/providers/keycloak/auth_manager/keycloak_auth_manager.py Outdated Show resolved Hide resolved

y-sudharshan added 3 commits February 2, 2026 22:01

Fix DAG-level RBAC by using claim_token per UMA spec (apache#61137)

29c2107

y-sudharshan force-pushed the fix-keycloak-dag-rbac-61137 branch from 3ce9b7c to 522ef10 Compare February 2, 2026 16:31

bugraoz93 reviewed Feb 2, 2026

View reviewed changes

Fix merge conflict: add missing test_get_token_url_normalization test

d71e45e

y-sudharshan force-pushed the fix-keycloak-dag-rbac-61137 branch from 8c7cb34 to d71e45e Compare February 3, 2026 01:55

Merge branch 'main' into fix-keycloak-dag-rbac-61137

bead146

ddroessler-ext approved these changes Feb 3, 2026

View reviewed changes

y-sudharshan requested a review from vincbeck February 5, 2026 05:07

vincbeck approved these changes Feb 5, 2026

View reviewed changes

vincbeck requested a review from bugraoz93 February 5, 2026 15:14

bugraoz93 approved these changes Feb 5, 2026

View reviewed changes

bugraoz93 merged commit 598eff4 into apache:main Feb 5, 2026
86 checks passed

shahar1 mentioned this pull request Feb 11, 2026

Status of testing Providers that were prepared on February 10, 2026 #61766

Closed

81 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix DAG-level RBAC by using claim_token per UMA spec (#61137)#61283

Fix DAG-level RBAC by using claim_token per UMA spec (#61137)#61283
bugraoz93 merged 5 commits intoapache:mainfrom
y-sudharshan:fix-keycloak-dag-rbac-61137

y-sudharshan commented Jan 31, 2026 •

edited

Loading

Uh oh!

n-badtke-cg left a comment •

edited

Loading

Uh oh!

Uh oh!

ddroessler-ext commented Feb 2, 2026

Uh oh!

vincbeck left a comment

Uh oh!

Uh oh!

Uh oh!

bugraoz93 left a comment

Uh oh!

Uh oh!

n-badtke-cg commented Feb 6, 2026

Uh oh!

y-sudharshan commented Feb 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

y-sudharshan commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fix DAG-level RBAC by using claim_token per UMA specification

Description

Problem

Solution

Impact

Testing

Changes Made

Was generative AI tooling used to co-author this PR?

Uh oh!

n-badtke-cg left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ddroessler-ext commented Feb 2, 2026

Uh oh!

vincbeck left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bugraoz93 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

n-badtke-cg commented Feb 6, 2026

Uh oh!

y-sudharshan commented Feb 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

y-sudharshan commented Jan 31, 2026 •

edited

Loading

n-badtke-cg left a comment •

edited

Loading