Error returning OAuth user info: missing_token

[troyharvey]

Describe the bug

After upgrading to airflow=2.2.5 and authlib=1.0.0 we are seeing a missing_token error in flask_appbuilder.security.views. As a workaround, we downgraded authlib and it's working again, but Airflow constraints are pegged at 1.0.0 so the downgrade is a temporary hack.

Error Stacks

Error returning OAuth user info: missing_token: 

To Reproduce

Reproducing this requires Airflow 2.2.5, authlib 1.0.0, and an oauth setup (we are using Okta)

Expected behavior

Airflow authentication using Okta oauth.

Environment:

• OS: Alpine Linux Kubernetes
• Python Version: 3.8
• Authlib Version: 1.0.0

Additional context

This problem was also reported in superset issues here: apache/superset#19255

[lepture]

It is very hard to review the code in a super big project. Can you provide a minimal reproducible example?

[lepture]

This may be fixed by the given commit. Can you verify it with the master code? I'll make a new release in 2 days.

[lepture]

v1.0.1 was released.

[troyharvey]

Thank you for the quick work! This solves our issue in Airflow. 🙇

[cloneluke]

Thank you for the quick work! This solves our issue in Airflow. 🙇

@troyharvey how did you get around this?
#403

(happens after upgrading authlib)

[troyharvey]

@cloneluke We made two changes.

1. Upgrade to authlib==1.0.1
2. In Airflow webserver_config.py, we added remote_app.jwks_uri to OAUTH_PROVIDERS.

OAUTH_PROVIDERS = [
    {
        'name': 'okta',
        'icon': 'fa-circle-o',
        'token_key': 'access_token',
        'remote_app': {
            ...
            'jwks_uri': 'https://derp.okta.com/oauth2/v1/keys'
        }
    }
]

[cloneluke]

@cloneluke We made two changes.

1. Upgrade to authlib==1.0.1
2. In Airflow webserver_config.py, we added remote_app.jwks_uri to OAUTH_PROVIDERS.

OAUTH_PROVIDERS = [
    {
        'name': 'okta',
        'icon': 'fa-circle-o',
        'token_key': 'access_token',
        'remote_app': {
            ...
            'jwks_uri': 'https://derp.okta.com/oauth2/v1/keys'
        }
    }
]

ah thanks @troyharvey , that makes sense now.