Logout with Keycloak as auth manager throws invalid redirect uri (api.base_url config unset)

[n-badtke-cg]

Under which category would you file this issue?

Providers

Apache Airflow version

3.2.1

What happened and how to reproduce it?

additional info: Keycloak version 26.5.1

When I want to logout, Keycloak tells me that the redirect uri is invalid. The redirect uri is now just "/auth/logout_callback" with missing hostname.

api.base_url was yet unset with 3.1.8 and it worked, the redirect uri included the hostname. I saw changes with commit 7a19002 in PR #62795

is api.base_url a mandatory config now?

What you think should happen instead?

probably just work with the same config as with Airflow 3.1.8?

Operating System

Debian GNU/Linux 12 (bookworm)

Deployment

Official Apache Airflow Helm Chart

Apache Airflow Provider(s)

keycloak

Versions of Apache Airflow Providers

apache-airflow-providers-keycloak==0.7.1
python-keycloak==7.1.1

Official Helm Chart version

1.21.0 (latest released)

Kubernetes Version

1.33

Helm Chart configuration

config:
  core:
    auth_manager: airflow.providers.keycloak.auth_manager.keycloak_auth_manager.KeycloakAuthManager
  keycloak_auth_manager:
    realm: airflow
    requests_pool_size: 20
    server_url: <redacted>

Docker Image customizations

ARG AIRFLOW_CONTAINER_VERSION=3.2.1-python3.12

FROM apache/airflow:${AIRFLOW_CONTAINER_VERSION}

RUN pip install apache-airflow[keycloak]==${AIRFLOW_VERSION} --constraint /home/airflow/constraints.txt
RUN pip install apache-airflow==${AIRFLOW_VERSION}

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[vincbeck]

I guess yes you are right, if you use Keycloak auth manager, then this config became mandatory. Do you think we should anything to make it more explicit this is mandatory?