fix(source-okta): Fix OAuth with private key PEM parsing issue by Airbyte-Support · Pull Request #69831 · airbytehq/airbyte

Airbyte Support (Airbyte-Support) · 2025-11-24T02:47:19Z

What

Fixes a critical issue where OAuth authentication with private key fails in the Okta connector (and potentially other connectors using OAuth with private key in the connector builder) with the error:

jwt.exceptions.InvalidKeyError: Could not parse the provided public key.

This occurs because the private key string from Airbyte Cloud contains escaped newlines (\\n) instead of actual newline characters, causing PyJWT to fail parsing the PEM-formatted key.

How

Added a normalization step in CustomOauth2PrivateKeyAuthenticator.token() that converts escaped newlines to actual newlines before passing the private key to jwt.encode(). This follows the same pattern used elsewhere in the codebase (see commit e53e290).

# Normalize escaped newlines in the private key to actual newlines
if "\\n" in private_key:
    private_key = private_key.replace("\\n", "\n")

Additionally, removed {include = "main.py"} from the packages list in pyproject.toml to fix a Poetry 2.x validation error that was blocking the publish workflow. The newer Poetry version in the Docker build environment performs stricter validation and rejects main.py with the error "does not contain any element". The connector still works correctly via the source-okta console script entrypoint.

Review guide

airbyte-integrations/connectors/source-okta/source_okta/components.py - Review the normalization logic in the token() method (lines 91-93)
airbyte-integrations/connectors/source-okta/pyproject.toml - Review the removal of main.py from packages list (line 15)
Consider whether this fix should be:
- Applied to other connectors with similar OAuth private key flows
- Moved to a shared utility function in the CDK
- Accompanied by a unit test
Verify the connector still runs correctly in Docker after the packaging change

User Impact

Positive:

Users can now successfully authenticate to Okta using OAuth 2.0 with private key
This also fixes the same issue for any custom connectors built in the connector builder that use OAuth with private key
The connector can now be published successfully

Negative:

None expected. The OAuth fix is a simple normalization that only applies when escaped newlines are present. The packaging change only affects the build process and should not impact runtime behavior.

Can this PR be safely reverted and rolled back?

YES 💚
NO ❌

The changes are minimal and only affect the OAuth with private key authentication flow and the packaging configuration. Reverting would restore the broken authentication behavior and the publish workflow failure.

Link to Devin run: https://app.devin.ai/sessions/ccfafd12c230478f82106eb1bac5de88

Requested by: Airbyte Support (@Airbyte-Support) (syed.khadeer@airbyte.io)

Note: The OAuth fix was implemented based on error logs and pattern matching with historical fixes in the codebase. The packaging fix was needed to resolve a Poetry 2.x validation error during Docker build. Ideally, both changes should be tested with an actual Okta instance using OAuth with private key authentication before merging.

The private key string from Airbyte Cloud contains escaped newlines (\n) instead of actual newline characters, causing PyJWT to fail parsing the PEM-formatted key with 'InvalidKeyError: Could not parse the provided public key.' This fix normalizes the escaped newlines to actual newlines before passing the key to jwt.encode(), following the same pattern used in other parts of the codebase (see commit e53e290). This resolves the issue for both the Okta connector and any other connectors using OAuth with private key authentication in the connector builder. Co-Authored-By: syed.khadeer@airbyte.io <cloud-support@airbyte.io>

devin-ai-integration · 2025-11-24T02:47:21Z

Original prompt from syed.khadeer@airbyte.io

@Devin Hi
Thread URL: https://airbytehq-team.slack.com/archives/D09QB1SEDDX/p1763952090971809

devin-ai-integration · 2025-11-24T02:47:23Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

github-actions · 2025-11-24T02:47:42Z

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

Helpful Resources

Breaking Changes Guide - Breaking changes, migration guides, and upgrade deadlines
Developing Connectors Locally
Managing Connector Secrets
On-Demand Live Tests
On-Demand Regression Tests
#connector-ci-issues
#connector-publish-updates
#connector-build-statuses

PR Slash Commands

Airbyte Maintainers (that's you!) can execute the following slash commands on your PR:

/format-fix - Fixes most formatting issues.
/bump-version - Bumps connector versions.
- You can specify a custom changelog by passing changelog. Example: /bump-version changelog="My cool update"
- Leaving the changelog arg blank will auto-populate the changelog from the PR title.
/run-cat-tests - Runs legacy CAT tests (Connector Acceptance Tests)
/run-live-tests - Runs live tests for the modified connector(s).
/run-regression-tests - Runs regression tests for the modified connector(s).
/build-connector-images - Builds and publishes a pre-release docker image for the modified connector(s).
JVM connectors:
- /update-connector-cdk-version connector=<CONNECTOR_NAME> - Updates the specified connector to the latest CDK version.
  Example: /update-connector-cdk-version connector=destination-bigquery
- /bump-bulk-cdk-version bump=patch changelog='foo' - Bump the Bulk CDK's version. bump can be major/minor/patch.
Python connectors:
- /poe connector source-example lock - Run the Poe lock task on the source-example connector, committing the results back to the branch.
- /poe source example lock - Alias for /poe connector source-example lock.
- /poe source example use-cdk-branch my/branch - Pin the source-example CDK reference to the branch name specified.
- /poe source example use-cdk-latest - Update the source-example CDK dependency to the latest available version.

📝 Edit this welcome message.

github-actions · 2025-11-24T02:49:53Z

`source-okta` Connector Test Results

3 tests 0 ✅ 1s ⏱️
1 suites 0 💤
1 files 0 ❌ 3 🔥

For more details on these errors, see this check.

Results for commit 41c27ea.

♻️ This comment has been updated with latest results.

Co-Authored-By: syed.khadeer@airbyte.io <cloud-support@airbyte.io>

github-actions · 2025-11-24T03:01:52Z

Deploy preview for airbyte-docs ready!

✅ Preview
https://airbyte-docs-fpg8wtl3q-airbyte-growth.vercel.app

Built with commit 41c27ea.
This pull request is being automatically deployed with vercel-action

devin-ai-integration · 2025-11-27T04:46:05Z

User Blocked - Needs v0.3.22 Deployed to Cloud

A user is currently blocked in Airbyte Cloud trying to use OAuth with private key authentication for the Okta connector.

Current situation:

User is on Okta connector version 0.3.21 (without this fix)
Getting error: jwt.exceptions.InvalidKeyError: Could not parse the provided public key
The user's private key has escaped newlines (\n as literal characters) which PyJWT cannot parse

Validation:
I tested the user's actual private key locally:

✗ Without this fix (v0.3.21): InvalidKeyError - matches the user's error
✓ With this fix (v0.3.22): Successfully generates JWT token

Impact:

This is blocking the user from using OAuth with private key authentication
The user also reported that custom Builder connectors have the same issue (separate investigation needed)

Next steps:

Merge this PR to get v0.3.22 available
Deploy v0.3.22 to Airbyte Cloud
Investigate Builder connector OAuth with private key implementation for the same issue

cc Ian Alton (@ian-at-airbyte) for visibility on this customer-impacting issue.

Comment posted by Devin on behalf of Airbyte Support (@Airbyte-Support) (syed.khadeer@airbyte.io)

Fixes an issue where JWT authentication fails when PEM-formatted private keys contain escaped newlines (\n) instead of actual newline characters. This commonly occurs when keys are stored in configuration systems like Airbyte Cloud. The fix adds normalization logic in JwtAuthenticator._get_secret_key() that: - Detects PEM-style keys (containing '-----BEGIN' and 'KEY-----') - Converts escaped newlines to actual newlines before JWT signing - Is guarded to only affect PEM keys, leaving other secret types unchanged This resolves the same issue fixed for the Okta connector in airbytehq/airbyte#69831, but at the CDK level so all declarative/Builder connectors using JWT authentication with private keys benefit from the fix. Includes a unit test that verifies JWT signing works with escaped newlines. Co-Authored-By: syed.khadeer@airbyte.io <cloud-support@airbyte.io>

devin-ai-integration · 2025-11-27T04:58:24Z

CDK-Level Fix for Builder Connectors

I've created a companion PR for the CDK that fixes the same escaped newline issue for Builder/declarative connectors using JWT authentication with private keys: airbytehq/airbyte-python-cdk#855

This means:

Okta connector: Fixed in this PR (v0.3.22)
Builder connectors: Fixed in the CDK PR (will benefit once the new CDK version is consumed)

Both fixes use the same PEM-specific normalization approach and have been verified with the user's actual private key locally.

Comment posted by Devin on behalf of Airbyte Support (@Airbyte-Support) (syed.khadeer@airbyte.io)

The newer Poetry version in the Docker build environment performs stricter validation and rejects main.py with 'does not contain any element' error. Removing main.py from the packages list resolves this while keeping the source_okta package and console script entrypoint intact. Co-Authored-By: syed.khadeer@airbyte.io <cloud-support@airbyte.io>

devin-ai-integration Bot assigned Airbyte Support (Airbyte-Support) Nov 24, 2025

Octavia Squidington III (octavia-squidington-iii) added the connectors/source/okta label Nov 24, 2025

Bump version to 0.3.22 and update changelog

77d45c0

Co-Authored-By: syed.khadeer@airbyte.io <cloud-support@airbyte.io>

devin-ai-integration Bot mentioned this pull request Nov 27, 2025

fix(jwt-authenticator): handle PEM private keys with escaped newlines airbytehq/airbyte-python-cdk#855

Open

4 tasks

Daryna Ishchenko (darynaishchenko) and others added 2 commits December 10, 2025 14:18

Merge branch 'master' into devin/1763952367-fix-okta-private-key-parsing

eb7b611

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(source-okta): Fix OAuth with private key PEM parsing issue#69831

fix(source-okta): Fix OAuth with private key PEM parsing issue#69831
Airbyte Support (Airbyte-Support) wants to merge 4 commits into
masterfrom
devin/1763952367-fix-okta-private-key-parsing

Airbyte Support (Airbyte-Support) commented Nov 24, 2025 •

edited by devin-ai-integration Bot

Loading

Uh oh!

devin-ai-integration Bot commented Nov 24, 2025

Uh oh!

devin-ai-integration Bot commented Nov 24, 2025

Uh oh!

github-actions Bot commented Nov 24, 2025

Uh oh!

github-actions Bot commented Nov 24, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 24, 2025 •

edited

Loading

Uh oh!

devin-ai-integration Bot commented Nov 27, 2025

Uh oh!

devin-ai-integration Bot commented Nov 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Airbyte Support (Airbyte-Support) commented Nov 24, 2025 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How

Review guide

User Impact

Can this PR be safely reverted and rolled back?

Uh oh!

devin-ai-integration Bot commented Nov 24, 2025

Uh oh!

devin-ai-integration Bot commented Nov 24, 2025

🤖 Devin AI Engineer

Uh oh!

github-actions Bot commented Nov 24, 2025

👋 Greetings, Airbyte Team Member!

Helpful Resources

PR Slash Commands

Uh oh!

github-actions Bot commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

source-okta Connector Test Results

Uh oh!

github-actions Bot commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot commented Nov 27, 2025

User Blocked - Needs v0.3.22 Deployed to Cloud

Uh oh!

devin-ai-integration Bot commented Nov 27, 2025

CDK-Level Fix for Builder Connectors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Airbyte Support (Airbyte-Support) commented Nov 24, 2025 •

edited by devin-ai-integration Bot

Loading

github-actions Bot commented Nov 24, 2025 •

edited

Loading

`source-okta` Connector Test Results

github-actions Bot commented Nov 24, 2025 •

edited

Loading