Apache Airflow with Google OAuth logins, how?

we would like to use google workspace to authenticate against apache airflow. i have set up an oauth client as described here, downloaded the docker-compose airflow setup from here, and then tried to configure airflow as described - mostly - here.

when i then click on the "login using google" button, i get to the consent screen, i can accept, and i'm being redirected to my test-server "localhost:8080". (docker setup).

it then tells me "invalid login".

some observations:

• i have not configured a security manager, as i don't know how and what for
• it seems the redirect url is correct
  (which is .../oauth-authorized/google, actually),
  as before i did not have it configured correctly, and google didn't even
  perform the login
• i have not configured an "authentication backend",
  as i only found this in older versions of airflow
• the docker image (apache/airflow, v2.5.1) has library oauthlib 3.2.2 installed
• when i test the OIDC flow with oauthdebugger, google issues a token for me. so i think the "problem" is somewhere on the airflow side

this is my webserver_config.py:

from flask_appbuilder.security.manager import AUTH_OAUTH
import os

# OAUTH configuration for Airflow Web Server

# copied from default config
WTF_CSRF_ENABLED = True
WTF_CSRF_TIME_LIMIT = None

# oauth specific
AUTH_TYPE = AUTH_OAUTH
AUTH_ROLES_SYNC_AT_LOGIN = True  # Checks roles on every login
AUTH_USER_REGISTRATION = False
# FAB_SECURITY_MANAGER_CLASS = "your_module.your_security_manager_class"

OAUTH_PROVIDERS = [
    {
        "name": "google",
        "token_key": "access_token",
        "icon": "fa-google",
        "remote_app": {
            "api_base_url": "https://www.googleapis.com/oauth2/v2/",
            "client_kwargs": {"scope": "email profile"},
            "access_token_url": "https://accounts.google.com/o/oauth2/token",
            "authorize_url": "https://accounts.google.com/o/oauth2/auth",
            "request_token_url": None,
            "client_id": "123456789012-asdfkjhagsdfkjhgasdkfjhgasdfkjhgapps.googleusercontent.com",
            "client_secret": "wooooo",
        },
    }
]

here is the relevant docker-compose.yaml part:

  airflow-webserver:
    <<: *airflow-common
    # ... rest is unchanged ... 
    volumes:
      - ${AIRFLOW_PROJ_DIR:-./data/airflow}/dags:/opt/airflow/dags
      - ${AIRFLOW_PROJ_DIR:-./data/airflow}/logs:/opt/airflow/logs
      - ${AIRFLOW_PROJ_DIR:-./data/airflow}/plugins:/opt/airflow/plugins
      - ./webserver_config.py:/opt/airflow/webserver_config.py

funny thing is, it apparently seems to load files for web pages when coming back to airflow, but i can't leave the login screen and no matter what i do, i get the popup message "Invalid login. Please try again."

as i am fairly stuck i'd appreciate any help.

Have you tried setting the proper redirect_url that you've set as Authorized redirect URIs in https://console.cloud.google.com/apis/credentials/oauthclient?

'remote_app': {
    'api_base_url': 'https://www.googleapis.com/oauth2/v2/',
    'client_kwargs': {'scope': 'email profile'},
    'access_token_url': 'https://accounts.google.com/o/oauth2/token',
    'authorize_url': 'https://accounts.google.com/o/oauth2/auth',
    'request_token_url': None,
    'client_id': os.getenv("OAUTH_APP_ID"),
    'client_secret': os.getenv("OAUTH_APP_SECRET"),
    'redirect_url': '/oauth-authorized/google',
},