apache / apache/airflow

Impossible to use SSO with EntraID

Open
#70,023 2 comments 1 reaction 0 assignees View on GitHub
area:providers kind:bug needs-triage provider:fab
Dominant language
Python
Stars
46.9k
Forks
17.8k
Avg merge
2d 9h
Merged PRs (30d)
472

Description

### Under which category would you file this issue?

Providers

### Apache Airflow version

3.3.0

### What happened and how to reproduce it?

Hello everyone,
Hope you doing well.

We currently have an issue on setting up SSO with EntraID and airflow using FAB manager.
AADSTS50011: The redirect URI 'http://.fr/auth/oauth-authorized/azure' specified in the request does not match the redirect URIs configured for the application 'application-id'. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal. Navigate to https://aka.ms/redirectUriMismatchError to learn more about how to fix this.

We are using Airflow 3.3.0

Accordingly to the previous issues discussed on github, we tried to do those :
enable_proxy_fix = True
Reviewing our Reverse Proxy configuration.

After those actions, we still have a redirect_uri http only so it cannot match the set up in EntraID ('http://.fr/auth/oauth-authorized/azure')

Do you know a way to force HTTPS configuration ?

Greetings

### What you think should happen instead?

_No response_

### Operating System

_No response_

### Deployment

None

### Apache Airflow Provider(s)

fab

### Versions of Apache Airflow Providers

apache-airflow-providers-fab : 3.6.5

### Official Helm Chart version

Not Applicable

### Kubernetes Version

_No response_

### Helm Chart configuration

_No response_

### Docker Image customizations

_No response_

### Anything else?

_No response_

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Contributor guide

Open the contributing guide

Research direction

No file or test is named. Start by reproducing the FAB OAuth flow at /auth/oauth-authorized/azure and inspect how the reverse proxy and enable_proxy_fix setting determine the callback scheme. Done means the generated redirect URI uses HTTPS and matches the URI configured for the EntraID application.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, python
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.