Impossible to use SSO with EntraID
- Dominant language
- Python
- Stars
- 46.9k
- Forks
- 17.8k
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 472
Description
### Under which category would you file this issue?
Providers
### Apache Airflow version
3.3.0
### What happened and how to reproduce it?
Hello everyone,
Hope you doing well.
We currently have an issue on setting up SSO with EntraID and airflow using FAB manager.
AADSTS50011: The redirect URI 'http://.fr/auth/oauth-authorized/azure' specified in the request does not match the redirect URIs configured for the application 'application-id'. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal. Navigate to https://aka.ms/redirectUriMismatchError to learn more about how to fix this.
We are using Airflow 3.3.0
Accordingly to the previous issues discussed on github, we tried to do those :
enable_proxy_fix = True
Reviewing our Reverse Proxy configuration.
After those actions, we still have a redirect_uri http only so it cannot match the set up in EntraID ('http://.fr/auth/oauth-authorized/azure')
Do you know a way to force HTTPS configuration ?
Greetings
### What you think should happen instead?
_No response_
### Operating System
_No response_
### Deployment
None
### Apache Airflow Provider(s)
fab
### Versions of Apache Airflow Providers
apache-airflow-providers-fab : 3.6.5
### Official Helm Chart version
Not Applicable
### Kubernetes Version
_No response_
### Helm Chart configuration
_No response_
### Docker Image customizations
_No response_
### Anything else?
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
Contributor guide
Research direction
No file or test is named. Start by reproducing the FAB OAuth flow at /auth/oauth-authorized/azure and inspect how the reverse proxy and enable_proxy_fix setting determine the callback scheme. Done means the generated redirect URI uses HTTPS and matches the URI configured for the EntraID application.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100