Support for OAuth client_credentials grant with client_assertion parameter #70934
Unanswered
syedkhadeer-cmd
asked this question in
Connector Builder
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Problem Description
The Airbyte connector builder's OAuthAuthenticator doesn't support Okta's specific OAuth flow that uses grant_type=client_credentials with a client_assertion parameter. Currently, when using use_profile_assertion: true, the CDK hardcodes:
Grant type to "urn:ietf:params:oauth:grant-type:jwt-bearer" oauth.py:126-131
Parameter name to "assertion" oauth.py:161
But Okta expects:
grant_type=client_credentials
client_assertion parameter
Current Limitation
The OAuthAuthenticator class in the CDK doesn't provide a way to configure these parameters when using JWT profile assertions. This forces users to generate JWTs externally and manually construct the request body, which defeats the purpose of the declarative builder.
Proposed Solution
Add configuration options to OAuthAuthenticator to support custom:
Grant type when using profile assertions (instead of hardcoding to JWT bearer)
Assertion parameter name (instead of hardcoding to "assertion")
Implementation Suggestion
Extend the OAuthAuthenticator class with new optional fields:
profile_assertion_grant_type - Override grant type when using profile assertions
profile_assertion_param_name - Override the assertion parameter name
Example Desired Configuration
authenticator:
type: OAuthAuthenticator
client_id: "{{ config['client_id'] }}"
token_refresh_endpoint: https://{{ config['base_url'] }}/oauth2/v1/token
use_profile_assertion: true
profile_assertion_grant_type: client_credentials # New field
profile_assertion_param_name: client_assertion # New field
profile_assertion:
type: JwtAuthenticator
# ... JWT configuration
Impact
This would enable proper support for Okta and potentially other OAuth providers that use variations of the JWT bearer assertion flow, making the connector builder more flexible and reducing the need for custom Python implementations.
References
Current implementation: airbyte_cdk/sources/declarative/auth/oauth.py oauth.py:76-81
Similar implementations in Google connectors that use JWT assertions manifest.yaml:158-166
Beta Was this translation helpful? Give feedback.
All reactions