apache-airflow-providers-amazon 9.2.0rc2__py3-none-any.whl → 9.3.0__py3-none-any.whl

airflow/providers/amazon/LICENSE

@@ -199,55 +199,3 @@ distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-
-============================================================================
-   APACHE AIRFLOW SUBCOMPONENTS:
-
-   The Apache Airflow project contains subcomponents with separate copyright
-   notices and license terms. Your use of the source code for the these
-   subcomponents is subject to the terms and conditions of the following
-   licenses.
-
-
-========================================================================
-Third party Apache 2.0 licenses
-========================================================================
-
-The following components are provided under the Apache 2.0 License.
-See project link for details. The text of each license is also included
-at 3rd-party-licenses/LICENSE-[project].txt.
-
-    (ALv2 License) hue v4.3.0 (https://github.com/cloudera/hue/)
-    (ALv2 License) jqclock v2.3.0 (https://github.com/JohnRDOrazio/jQuery-Clock-Plugin)
-    (ALv2 License) bootstrap3-typeahead v4.0.2 (https://github.com/bassjobsen/Bootstrap-3-Typeahead)
-    (ALv2 License) connexion v2.7.0 (https://github.com/zalando/connexion)
-
-========================================================================
-MIT licenses
-========================================================================
-
-The following components are provided under the MIT License. See project link for details.
-The text of each license is also included at 3rd-party-licenses/LICENSE-[project].txt.
-
-    (MIT License) jquery v3.5.1 (https://jquery.org/license/)
-    (MIT License) dagre-d3 v0.6.4 (https://github.com/cpettitt/dagre-d3)
-    (MIT License) bootstrap v3.4.1 (https://github.com/twbs/bootstrap/)
-    (MIT License) d3-tip v0.9.1 (https://github.com/Caged/d3-tip)
-    (MIT License) dataTables v1.10.25 (https://datatables.net)
-    (MIT License) normalize.css v3.0.2 (http://necolas.github.io/normalize.css/)
-    (MIT License) ElasticMock v1.3.2 (https://github.com/vrcmarcos/elasticmock)
-    (MIT License) MomentJS v2.24.0 (http://momentjs.com/)
-    (MIT License) eonasdan-bootstrap-datetimepicker v4.17.49 (https://github.com/eonasdan/bootstrap-datetimepicker/)
-
-========================================================================
-BSD 3-Clause licenses
-========================================================================
-The following components are provided under the BSD 3-Clause license. See project links for details.
-The text of each license is also included at 3rd-party-licenses/LICENSE-[project].txt.
-
-    (BSD 3 License) d3 v5.16.0 (https://d3js.org)
-    (BSD 3 License) d3-shape v2.1.0 (https://github.com/d3/d3-shape)
-    (BSD 3 License) cgroupspy 0.2.1 (https://github.com/cloudsigma/cgroupspy)
-
-========================================================================
-See 3rd-party-licenses/LICENSES-ui.txt for packages used in `/airflow/www`

airflow/providers/amazon/__init__.py

@@ -29,7 +29,7 @@ from airflow import __version__ as airflow_version
 
 __all__ = ["__version__"]
 
-__version__ = "9.2.0"
+__version__ = "9.3.0"
 
 if packaging.version.parse(packaging.version.parse(airflow_version).base_version) < packaging.version.parse(
     "2.9.0"

airflow/providers/amazon/aws/auth_manager/avp/facade.py

@@ -78,7 +78,7 @@ class AwsAuthManagerAmazonVerifiedPermissionsFacade(LoggingMixin):
         *,
         method: ResourceMethod | str,
         entity_type: AvpEntities,
-        user: AwsAuthManagerUser | None,
+        user: AwsAuthManagerUser,
         entity_id: str | None = None,
         context: dict | None = None,
     ) -> bool:
@@ -97,9 +97,6 @@ class AwsAuthManagerAmazonVerifiedPermissionsFacade(LoggingMixin):
             considered.
         :param context: optional additional context to pass to Amazon Verified Permissions.
         """
-        if user is None:
-            return False
-
         entity_list = self._get_user_group_entities(user)
 
         self.log.debug(

airflow/providers/amazon/aws/auth_manager/aws_auth_manager.py

@@ -17,16 +17,26 @@
 from __future__ import annotations
 
 import argparse
-import warnings
 from collections import defaultdict
 from collections.abc import Container, Sequence
 from functools import cached_property
-from typing import TYPE_CHECKING, cast
-
-from flask import session, url_for
-
+from typing import TYPE_CHECKING, Any, cast
+
+from fastapi import FastAPI
+from flask import session
+
+from airflow.auth.managers.base_auth_manager import BaseAuthManager
+from airflow.auth.managers.models.resource_details import (
+    AccessView,
+    ConnectionDetails,
+    DagAccessEntity,
+    DagDetails,
+    PoolDetails,
+    VariableDetails,
+)
 from airflow.cli.cli_config import CLICommand, DefaultHelpParser, GroupCommand
-from airflow.exceptions import AirflowOptionalProviderFeatureException, AirflowProviderDeprecationWarning
+from airflow.configuration import conf
+from airflow.exceptions import AirflowOptionalProviderFeatureException
 from airflow.providers.amazon.aws.auth_manager.avp.entities import AvpEntities
 from airflow.providers.amazon.aws.auth_manager.avp.facade import (
     AwsAuthManagerAmazonVerifiedPermissionsFacade,
@@ -35,30 +45,13 @@ from airflow.providers.amazon.aws.auth_manager.avp.facade import (
 from airflow.providers.amazon.aws.auth_manager.cli.definition import (
     AWS_AUTH_MANAGER_COMMANDS,
 )
-from airflow.providers.amazon.aws.auth_manager.security_manager.aws_security_manager_override import (
-    AwsSecurityManagerOverride,
-)
-from airflow.providers.amazon.aws.auth_manager.views.auth import AwsAuthManagerAuthenticationViews
-
-try:
-    from airflow.auth.managers.base_auth_manager import BaseAuthManager, ResourceMethod
-    from airflow.auth.managers.models.resource_details import (
-        AccessView,
-        ConnectionDetails,
-        DagAccessEntity,
-        DagDetails,
-        PoolDetails,
-        VariableDetails,
-    )
-except ImportError:
-    raise AirflowOptionalProviderFeatureException(
-        "Failed to import BaseUser. This feature is only available in Airflow versions >= 2.8.0"
-    )
+from airflow.providers.amazon.aws.auth_manager.user import AwsAuthManagerUser
+from airflow.providers.amazon.version_compat import AIRFLOW_V_3_0_PLUS
 
 if TYPE_CHECKING:
     from flask_appbuilder.menu import MenuItem
 
-    from airflow.auth.managers.models.base_user import BaseUser
+    from airflow.auth.managers.base_auth_manager import ResourceMethod
     from airflow.auth.managers.models.batch_apis import (
         IsAuthorizedConnectionRequest,
         IsAuthorizedDagRequest,
@@ -66,46 +59,62 @@ if TYPE_CHECKING:
         IsAuthorizedVariableRequest,
     )
     from airflow.auth.managers.models.resource_details import AssetDetails, ConfigurationDetails
-    from airflow.providers.amazon.aws.auth_manager.user import AwsAuthManagerUser
-    from airflow.www.extensions.init_appbuilder import AirflowAppBuilder
 
 
-class AwsAuthManager(BaseAuthManager):
+class AwsAuthManager(BaseAuthManager[AwsAuthManagerUser]):
     """
     AWS auth manager.
 
     Leverages AWS services such as Amazon Identity Center and Amazon Verified Permissions to perform
     authentication and authorization in Airflow.
-
-    :param appbuilder: the flask app builder
     """
 
-    def __init__(self, appbuilder: AirflowAppBuilder) -> None:
-        super().__init__(appbuilder)
+    def __init__(self) -> None:
+        if not AIRFLOW_V_3_0_PLUS:
+            raise AirflowOptionalProviderFeatureException(
+                "AWS auth manager is only compatible with Airflow versions >= 3.0.0"
+            )
+
+        super().__init__()
         self._check_avp_schema_version()
 
     @cached_property
     def avp_facade(self):
         return AwsAuthManagerAmazonVerifiedPermissionsFacade()
 
+    @cached_property
+    def fastapi_endpoint(self) -> str:
+        return conf.get("fastapi", "base_url")
+
     def get_user(self) -> AwsAuthManagerUser | None:
         return session["aws_user"] if self.is_logged_in() else None
 
     def is_logged_in(self) -> bool:
         return "aws_user" in session
 
+    def deserialize_user(self, token: dict[str, Any]) -> AwsAuthManagerUser:
+        return AwsAuthManagerUser(**token)
+
+    def serialize_user(self, user: AwsAuthManagerUser) -> dict[str, Any]:
+        return {
+            "user_id": user.get_id(),
+            "groups": user.get_groups(),
+            "username": user.username,
+            "email": user.email,
+        }
+
     def is_authorized_configuration(
         self,
         *,
         method: ResourceMethod,
+        user: AwsAuthManagerUser,
         details: ConfigurationDetails | None = None,
-        user: BaseUser | None = None,
     ) -> bool:
         config_section = details.section if details else None
         return self.avp_facade.is_authorized(
             method=method,
             entity_type=AvpEntities.CONFIGURATION,
-            user=user or self.get_user(),
+            user=user,
             entity_id=config_section,
         )
 
@@ -113,14 +122,14 @@ class AwsAuthManager(BaseAuthManager):
         self,
         *,
         method: ResourceMethod,
+        user: AwsAuthManagerUser,
         details: ConnectionDetails | None = None,
-        user: BaseUser | None = None,
     ) -> bool:
         connection_id = details.conn_id if details else None
         return self.avp_facade.is_authorized(
             method=method,
             entity_type=AvpEntities.CONNECTION,
-            user=user or self.get_user(),
+            user=user,
             entity_id=connection_id,
         )
 
@@ -128,9 +137,9 @@ class AwsAuthManager(BaseAuthManager):
         self,
         *,
         method: ResourceMethod,
+        user: AwsAuthManagerUser,
         access_entity: DagAccessEntity | None = None,
         details: DagDetails | None = None,
-        user: BaseUser | None = None,
     ) -> bool:
         dag_id = details.id if details else None
         context = (
@@ -145,48 +154,38 @@ class AwsAuthManager(BaseAuthManager):
         return self.avp_facade.is_authorized(
             method=method,
             entity_type=AvpEntities.DAG,
-            user=user or self.get_user(),
+            user=user,
             entity_id=dag_id,
             context=context,
         )
 
     def is_authorized_asset(
-        self, *, method: ResourceMethod, details: AssetDetails | None = None, user: BaseUser | None = None
+        self, *, method: ResourceMethod, user: AwsAuthManagerUser, details: AssetDetails | None = None
     ) -> bool:
         asset_uri = details.uri if details else None
         return self.avp_facade.is_authorized(
-            method=method, entity_type=AvpEntities.ASSET, user=user or self.get_user(), entity_id=asset_uri
-        )
-
-    def is_authorized_dataset(
-        self, *, method: ResourceMethod, details: AssetDetails | None = None, user: BaseUser | None = None
-    ) -> bool:
-        warnings.warn(
-            "is_authorized_dataset will be renamed as is_authorized_asset in Airflow 3 and will be removed when the minimum Airflow version is set to 3.0 for the amazon provider",
-            AirflowProviderDeprecationWarning,
-            stacklevel=2,
+            method=method, entity_type=AvpEntities.ASSET, user=user, entity_id=asset_uri
         )
-        return self.is_authorized_asset(method=method, user=user)
 
     def is_authorized_pool(
-        self, *, method: ResourceMethod, details: PoolDetails | None = None, user: BaseUser | None = None
+        self, *, method: ResourceMethod, user: AwsAuthManagerUser, details: PoolDetails | None = None
     ) -> bool:
         pool_name = details.name if details else None
         return self.avp_facade.is_authorized(
             method=method,
             entity_type=AvpEntities.POOL,
-            user=user or self.get_user(),
+            user=user,
             entity_id=pool_name,
         )
 
     def is_authorized_variable(
-        self, *, method: ResourceMethod, details: VariableDetails | None = None, user: BaseUser | None = None
+        self, *, method: ResourceMethod, user: AwsAuthManagerUser, details: VariableDetails | None = None
     ) -> bool:
         variable_key = details.key if details else None
         return self.avp_facade.is_authorized(
             method=method,
             entity_type=AvpEntities.VARIABLE,
-            user=user or self.get_user(),
+            user=user,
             entity_id=variable_key,
         )
 
@@ -194,34 +193,31 @@ class AwsAuthManager(BaseAuthManager):
         self,
         *,
         access_view: AccessView,
-        user: BaseUser | None = None,
+        user: AwsAuthManagerUser,
     ) -> bool:
         return self.avp_facade.is_authorized(
             method="GET",
             entity_type=AvpEntities.VIEW,
-            user=user or self.get_user(),
+            user=user,
             entity_id=access_view.value,
         )
 
     def is_authorized_custom_view(
-        self, *, method: ResourceMethod | str, resource_name: str, user: BaseUser | None = None
+        self, *, method: ResourceMethod | str, resource_name: str, user: AwsAuthManagerUser
     ):
         return self.avp_facade.is_authorized(
             method=method,
             entity_type=AvpEntities.CUSTOM,
-            user=user or self.get_user(),
+            user=user,
             entity_id=resource_name,
         )
 
     def batch_is_authorized_connection(
         self,
         requests: Sequence[IsAuthorizedConnectionRequest],
+        *,
+        user: AwsAuthManagerUser,
     ) -> bool:
-        """
-        Batch version of ``is_authorized_connection``.
-
-        :param requests: a list of requests containing the parameters for ``is_authorized_connection``
-        """
         facade_requests: Sequence[IsAuthorizedRequest] = [
             {
                 "method": request["method"],
@@ -232,17 +228,14 @@ class AwsAuthManager(BaseAuthManager):
             }
             for request in requests
         ]
-        return self.avp_facade.batch_is_authorized(requests=facade_requests, user=self.get_user())
+        return self.avp_facade.batch_is_authorized(requests=facade_requests, user=user)
 
     def batch_is_authorized_dag(
         self,
         requests: Sequence[IsAuthorizedDagRequest],
+        *,
+        user: AwsAuthManagerUser,
     ) -> bool:
-        """
-        Batch version of ``is_authorized_dag``.
-
-        :param requests: a list of requests containing the parameters for ``is_authorized_dag``
-        """
         facade_requests: Sequence[IsAuthorizedRequest] = [
             {
                 "method": request["method"],
@@ -258,17 +251,14 @@ class AwsAuthManager(BaseAuthManager):
             }
             for request in requests
         ]
-        return self.avp_facade.batch_is_authorized(requests=facade_requests, user=self.get_user())
+        return self.avp_facade.batch_is_authorized(requests=facade_requests, user=user)
 
     def batch_is_authorized_pool(
         self,
         requests: Sequence[IsAuthorizedPoolRequest],
+        *,
+        user: AwsAuthManagerUser,
     ) -> bool:
-        """
-        Batch version of ``is_authorized_pool``.
-
-        :param requests: a list of requests containing the parameters for ``is_authorized_pool``
-        """
         facade_requests: Sequence[IsAuthorizedRequest] = [
             {
                 "method": request["method"],
@@ -277,17 +267,14 @@ class AwsAuthManager(BaseAuthManager):
             }
             for request in requests
         ]
-        return self.avp_facade.batch_is_authorized(requests=facade_requests, user=self.get_user())
+        return self.avp_facade.batch_is_authorized(requests=facade_requests, user=user)
 
     def batch_is_authorized_variable(
         self,
         requests: Sequence[IsAuthorizedVariableRequest],
+        *,
+        user: AwsAuthManagerUser,
     ) -> bool:
-        """
-        Batch version of ``is_authorized_variable``.
-
-        :param requests: a list of requests containing the parameters for ``is_authorized_variable``
-        """
         facade_requests: Sequence[IsAuthorizedRequest] = [
             {
                 "method": request["method"],
@@ -298,39 +285,29 @@ class AwsAuthManager(BaseAuthManager):
             }
             for request in requests
         ]
-        return self.avp_facade.batch_is_authorized(requests=facade_requests, user=self.get_user())
+        return self.avp_facade.batch_is_authorized(requests=facade_requests, user=user)
 
     def filter_permitted_dag_ids(
         self,
         *,
         dag_ids: set[str],
+        user: AwsAuthManagerUser,
         methods: Container[ResourceMethod] | None = None,
-        user=None,
     ):
-        """
-        Filter readable or writable DAGs for user.
-
-        :param dag_ids: the list of DAG ids
-        :param methods: whether filter readable or writable
-        :param user: the current user
-        """
         if not methods:
             methods = ["PUT", "GET"]
 
-        if not user:
-            user = self.get_user()
-
         requests: dict[str, dict[ResourceMethod, IsAuthorizedRequest]] = defaultdict(dict)
         requests_list: list[IsAuthorizedRequest] = []
         for dag_id in dag_ids:
             for method in ["GET", "PUT"]:
                 if method in methods:
                     request: IsAuthorizedRequest = {
-                        "method": cast(ResourceMethod, method),
+                        "method": cast("ResourceMethod", method),
                         "entity_type": AvpEntities.DAG,
                         "entity_id": dag_id,
                     }
-                    requests[dag_id][cast(ResourceMethod, method)] = request
+                    requests[dag_id][cast("ResourceMethod", method)] = request
                     requests_list.append(request)
 
         batch_is_authorized_results = self.avp_facade.get_batch_is_authorized_results(
@@ -400,14 +377,10 @@ class AwsAuthManager(BaseAuthManager):
         return accessible_items
 
     def get_url_login(self, **kwargs) -> str:
-        return url_for("AwsAuthManagerAuthenticationViews.login")
+        return f"{self.fastapi_endpoint}/auth/login"
 
     def get_url_logout(self) -> str:
-        return url_for("AwsAuthManagerAuthenticationViews.logout")
-
-    @cached_property
-    def security_manager(self) -> AwsSecurityManagerOverride:
-        return AwsSecurityManagerOverride(self.appbuilder)
+        raise NotImplementedError()
 
     @staticmethod
     def get_cli_commands() -> list[CLICommand]:
@@ -420,9 +393,20 @@ class AwsAuthManager(BaseAuthManager):
             ),
         ]
 
-    def register_views(self) -> None:
-        if self.appbuilder:
-            self.appbuilder.add_view_no_menu(AwsAuthManagerAuthenticationViews())
+    def get_fastapi_app(self) -> FastAPI | None:
+        from airflow.providers.amazon.aws.auth_manager.router.login import login_router
+
+        app = FastAPI(
+            title="AWS auth manager sub application",
+            description=(
+                "This is the AWS auth manager fastapi sub application. This API is only available if the "
+                "auth manager used in the Airflow environment is AWS auth manager. "
+                "This sub application provides login routes."
+            ),
+        )
+        app.include_router(login_router)
+
+        return app
 
     @staticmethod
     def _get_menu_item_request(resource_name: str) -> IsAuthorizedRequest:
@@ -436,7 +420,7 @@ class AwsAuthManager(BaseAuthManager):
         if not self.avp_facade.is_policy_store_schema_up_to_date():
             self.log.warning(
                 "The Amazon Verified Permissions policy store schema is different from the latest version "
-                "(https://github.com/apache/airflow/blob/main/airflow/providers/amazon/aws/auth_manager/avp/schema.json). "
+                "(https://github.com/apache/airflow/blob/main/providers/amazon/aws/src/airflow/providers/amazon/aws/auth_manager/avp/schema.json). "
                 "Please update it to its latest version. "
                 "See doc: https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/auth-manager/setup/amazon-verified-permissions.html#update-the-policy-store-schema."
             )

airflow/providers/amazon/aws/auth_manager/router/login.py

@@ -0,0 +1,124 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+import anyio
+from fastapi import HTTPException, Request
+from starlette import status
+from starlette.responses import RedirectResponse
+
+from airflow.api_fastapi.app import get_auth_manager
+from airflow.api_fastapi.common.router import AirflowRouter
+from airflow.configuration import conf
+from airflow.providers.amazon.aws.auth_manager.constants import CONF_SAML_METADATA_URL_KEY, CONF_SECTION_NAME
+from airflow.providers.amazon.aws.auth_manager.user import AwsAuthManagerUser
+
+try:
+    from onelogin.saml2.auth import OneLogin_Saml2_Auth
+    from onelogin.saml2.errors import OneLogin_Saml2_Error
+    from onelogin.saml2.idp_metadata_parser import OneLogin_Saml2_IdPMetadataParser
+except ImportError:
+    raise ImportError(
+        "AWS auth manager requires the python3-saml library but it is not installed by default. "
+        "Please install the python3-saml library by running: "
+        "pip install apache-airflow-providers-amazon[python3-saml]"
+    )
+
+log = logging.getLogger(__name__)
+login_router = AirflowRouter(tags=["AWSAuthManagerLogin"])
+
+
+@login_router.get("/login")
+def login(request: Request):
+    """Authenticate the user."""
+    saml_auth = _init_saml_auth(request)
+    callback_url = saml_auth.login()
+    return RedirectResponse(url=callback_url)
+
+
+@login_router.post("/login_callback")
+def login_callback(request: Request):
+    """Authenticate the user."""
+    saml_auth = _init_saml_auth(request)
+    try:
+        saml_auth.process_response()
+    except OneLogin_Saml2_Error as e:
+        log.exception(e)
+        raise HTTPException(status.HTTP_500_INTERNAL_SERVER_ERROR, "Failed to authenticate")
+    errors = saml_auth.get_errors()
+    is_authenticated = saml_auth.is_authenticated()
+    if not is_authenticated:
+        error_reason = saml_auth.get_last_error_reason()
+        log.error("Failed to authenticate")
+        log.error("Errors: %s", errors)
+        log.error("Error reason: %s", error_reason)
+        raise HTTPException(status.HTTP_500_INTERNAL_SERVER_ERROR, f"Failed to authenticate: {error_reason}")
+
+    attributes = saml_auth.get_attributes()
+    user = AwsAuthManagerUser(
+        user_id=attributes["id"][0],
+        groups=attributes["groups"],
+        username=saml_auth.get_nameid(),
+        email=attributes["email"][0] if "email" in attributes else None,
+    )
+    return RedirectResponse(url=f"/webapp?token={get_auth_manager().get_jwt_token(user)}", status_code=303)
+
+
+def _init_saml_auth(request: Request) -> OneLogin_Saml2_Auth:
+    request_data = _prepare_request(request)
+    base_url = conf.get(section="fastapi", key="base_url")
+    settings = {
+        # We want to keep this flag on in case of errors.
+        # It provides an error reasons, if turned off, it does not
+        "debug": True,
+        "sp": {
+            "entityId": "aws-auth-manager-saml-client",
+            "assertionConsumerService": {
+                "url": f"{base_url}/auth/login_callback",
+                "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+            },
+        },
+    }
+    merged_settings = OneLogin_Saml2_IdPMetadataParser.merge_settings(_get_idp_data(), settings)
+    return OneLogin_Saml2_Auth(request_data, merged_settings)
+
+
+def _prepare_request(request: Request) -> dict:
+    host = request.headers.get("host", request.client.host if request.client else "localhost")
+    data: dict[str, Any] = {
+        "https": "on" if request.url.scheme == "https" else "off",
+        "http_host": host,
+        "server_port": request.url.port,
+        "script_name": request.url.path,
+        "get_data": request.query_params,
+        "post_data": {},
+    }
+    form_data = anyio.from_thread.run(request.form)
+    if "SAMLResponse" in form_data:
+        data["post_data"]["SAMLResponse"] = form_data["SAMLResponse"]
+    if "RelayState" in form_data:
+        data["post_data"]["RelayState"] = form_data["RelayState"]
+    return data
+
+
+def _get_idp_data() -> dict:
+    saml_metadata_url = conf.get_mandatory_value(CONF_SECTION_NAME, CONF_SAML_METADATA_URL_KEY)
+    return OneLogin_Saml2_IdPMetadataParser.parse_remote(saml_metadata_url)

airflow/providers/amazon/aws/executors/batch/batch_executor.py

@@ -56,7 +56,7 @@ from airflow.providers.amazon.aws.executors.batch.utils import (
 )
 from airflow.utils.state import State
 
-CommandType = list[str]
+CommandType = Sequence[str]
 ExecutorConfigType = dict[str, Any]
 
 INVALID_CREDENTIALS_EXCEPTIONS = [
@@ -350,7 +350,7 @@ class AwsBatchExecutor(BaseExecutor):
         self.pending_jobs.append(
             BatchQueuedJob(
                 key=key,
-                command=command,
+                command=list(command),
                 queue=queue,
                 executor_config=executor_config or {},
                 attempt_number=1,

airflow/providers/amazon/aws/executors/ecs/boto_schema.py

@@ -56,7 +56,7 @@ class BotoTaskSchema(Schema):
     last_status = fields.String(data_key="lastStatus", required=True)
     desired_status = fields.String(data_key="desiredStatus", required=True)
     containers = fields.List(fields.Nested(BotoContainerSchema), required=True)
-    started_at = fields.Field(data_key="startedAt")
+    started_at = fields.Raw(data_key="startedAt")
     stopped_reason = fields.String(data_key="stoppedReason")
 
     @post_load

airflow/providers/amazon/aws/executors/ecs/utils.py

@@ -25,6 +25,7 @@ from __future__ import annotations
 
 import datetime
 from collections import defaultdict
+from collections.abc import Sequence
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any, Callable
 
@@ -36,7 +37,7 @@ from airflow.utils.state import State
 if TYPE_CHECKING:
     from airflow.models.taskinstance import TaskInstanceKey
 
-CommandType = list[str]
+CommandType = Sequence[str]
 ExecutorConfigFunctionType = Callable[[CommandType], dict]
 ExecutorConfigType = dict[str, Any]