Verify Azure AD OAuth id_token signatures by default in FAB auth manager - #69374
Merged
potiuk merged 3 commits intoJul 7, 2026
Merged
Conversation
potiuk
force-pushed
the
fix-fab-azure-oauth-verify-signature-default
branch
from
July 4, 2026 12:30
d95dabf to
210081b
Compare
vincbeck
approved these changes
Jul 6, 2026
Contributor
|
Some spelling errors |
The FAB auth manager's Azure AD OAuth provider decoded the incoming id_token with verify_signature defaulting to False, so the token payload was accepted without verifying its signature unless a deployment explicitly set the option. The Authentik OAuth provider in the same security manager already defaults verify_signature to True. Default verify_signature to True for the Azure AD provider, so id_token signatures are verified against the Microsoft JWKS by default, consistent with the Authentik provider, and log a warning when signature verification is skipped. Deployments that intentionally relied on the previous default must set verify_signature: False explicitly in the Azure provider client_kwargs to keep the old behaviour. Generated-by: Claude Opus 4.8 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
potiuk
force-pushed
the
fix-fab-azure-oauth-verify-signature-default
branch
from
July 7, 2026 01:02
210081b to
196acae
Compare
Generated-by: Claude Opus 4.8 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
The FAB changelog note references the Authentik OAuth provider by name, which the spellchecker rejects as an unknown word. Authentik is a proper product name, so add it to the shared wordlist. Generated-by: Claude Opus 4.8 (1M context)
potiuk
force-pushed
the
fix-fab-azure-oauth-verify-signature-default
branch
from
July 7, 2026 01:05
196acae to
d15ac85
Compare
Member
Author
|
fixed - maybe not too late to include it |
Contributor
Too late :) Will be part of the next one |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The FAB auth manager's Azure AD OAuth provider decoded the incoming
id_tokenwith
verify_signaturedefaulting toFalse, so the token payload was acceptedwithout verifying its signature unless a deployment explicitly set the option.
The Authentik OAuth provider in the same security manager already defaults
verify_signaturetoTrue.This change:
verify_signaturetoTruefor the Azure AD provider, soid_tokensignatures are verified against the Microsoft JWKS by default, consistent with
the Authentik provider;
code path.
Behaviour change / migration: deployments that intentionally relied on the
previous default must now set
verify_signature: Falseexplicitly in the Azureprovider
client_kwargsto keep the old behaviour.Tests
test_decode_and_validate_azure_jwt_verifies_signature_by_defaulttest_decode_and_validate_azure_jwt_skips_verification_when_opted_outWas generative AI tooling used to co-author this PR?
Generated-by: Claude Opus 4.8 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions