OpenID code authentication in Apache SuperSet - Not keycloak

Question

I have been trying to set up the OpenID authentication for SuperSet. I have seen many configurations for Oauth but not for OpenID.

I tried the following configuration:

from formshare_sso_security_manager import FormShareSsoSecurityManager
from flask_appbuilder.security.manager import AUTH_OID
...
AUTH_TYPE = AUTH_OID


OPENID_PROVIDERS = [
    {
        'name': 'FormShare',
        'icon': 'fa-google',
        'token_key': 'access_token',
        'remote_app': {
            'client_id': '501cE2ow7V4J',
            'client_secret': '060a450db0474b7db20afeda22a671b6',
            'api_base_url': 'https://qlands.ngrok.io/',
            'client_kwargs':{
              'scope': 'profile'
            },
            'request_token_url': None,
            'access_token_url': 'https://qlands.ngrok.io/openid_token',
            'authorize_url': 'https://qlands.ngrok.io/openid_authentication'
        }
    }
]

The contents of formshare_sso_security_manager.py are:

from superset.security import SupersetSecurityManager

class FormShareSsoSecurityManager(SupersetSecurityManager):
    def oauth_user_info(self, provider, response=None):
        logging.debug("Oauth2 provider: {0}.".format(provider))
        if provider == 'FormShare':
            me = self.appbuilder.sm.oauth_remotes[provider].get('openid_userinfo').data
            logging.debug("user_data: {0}".format(me))
            return { 'name' : me['name'], 'email' : me['email'], 'id' : me['user_name'], 'username' : me['user_name'], 'first_name':'', 'last_name':''}

But I get the following image in the Superset login:

If I click the provider nothing happens but then the interface asks me for my OpenID ID as an input. If I enter an authenticated user id for example "carlos" Superset logs:

"GET /login/?next=http://qlands.eu.ngrok.io/login/ HTTP/1.1" 200 -
2021-05-18 09:53:17,871:WARNING:superset.views.base:404 Not Found: The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.

I guess I am basing my configuration in OAuth but OpenID is different? I have seen a post on keycloak but my OpenID server is a simple implementation that uses PyOp tested with https://oidcdebugger.com/

I would want superset to perform a GET to https://qlands.ngrok.io/openid_authentication to authenticate a user and in return, the server would provide superset with a code to be used to exchange it for a token and use the token to get the user information.

I also tried with the following OAUTH configuration that took me forward in the authentication process:

OAUTH_PROVIDERS = [
    {   'name':'FormShare',
        'token_key':'access_token', # Name of the token in the response of access_token_url
        'icon':'fa-address-card',   # Icon for the provider
        'remote_app': {
            'client_id':'501cE2ow7V4J',  # Client Id (Identify Superset application)
            'client_secret':'060a450db0474b7db20afeda22a671b6', # Secret for this Client Id (Identify Superset application)
            'client_kwargs':{
                'scope': 'openid profile'               # Scope for the Authorization
            },
            'access_token_method':'POST',    # HTTP Method to call access_token_url
            'access_token_params':{},
            'access_token_headers':{    # Additional headers for calls to access_token_url
                'Authorization': 'Basic Base64EncodedClientIdAndSecret'
            },
            'base_url':'https://qlands.ngrok.io',
            'access_token_url':'https://qlands.ngrok.io/openid_token',
            'authorize_url':'https://qlands.ngrok.io/openid_authentication'
        }
    }
]

Superset provided the following output:

2021-05-19 15:08:29,869:DEBUG:authlib.integrations.base_client.base_app:Saving authorize data: {'redirect_uri': 'http://qlands.eu.ngrok.io/oauth-authorized/FormShare', 'nonce': 'V3k0XaaVFL6pBqGbjGNt', 'url': 'https://qlands.ngrok.io/openid_authentication?response_type=code&client_id=501cE2ow7V4J&redirect_uri=http%3A%2F%2Fqlands.eu.ngrok.io%2Foauth-authorized%2FFormShare&scope=openid+profile&state=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJuZXh0IjpbIiJdfQ.NTWe_SlU7cdUrf4WrQFRxasVKdcIpm98sMOoXkMg2No&nonce=V3k0XaaVFL6pBqGbjGNt', 'state': 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJuZXh0IjpbIiJdfQ.NTWe_SlU7cdUrf4WrQFRxasVKdcIpm98sMOoXkMg2No'}
2021-05-19 15:08:29,872:INFO:werkzeug:127.0.0.1 - - [19/May/2021 15:08:29] "GET /login/FormShare?next= HTTP/1.1" 302 -
2021-05-19 15:08:30,636:DEBUG:authlib.integrations.base_client.base_app:Retrieve temporary data: {'code': '89cb4c27ed4f42268c59ab170a932aa1', 'state': 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJuZXh0IjpbIiJdfQ.NTWe_SlU7cdUrf4WrQFRxasVKdcIpm98sMOoXkMg2No', 'redirect_uri': 'http://qlands.eu.ngrok.io/oauth-authorized/FormShare'}
2021-05-19 15:08:30,641:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): qlands.ngrok.io:443
2021-05-19 15:08:30,929:DEBUG:urllib3.connectionpool:https://qlands.ngrok.io:443 "POST /openid_token HTTP/1.1" 200 1140
Oauth2 provider: FormShare.
2021-05-19 15:08:30,938:INFO:werkzeug:127.0.0.1 - - [19/May/2021 15:08:30] "GET /oauth-authorized/FormShare?code=89cb4c27ed4f42268c59ab170a932aa1&state=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJuZXh0IjpbIiJdfQ.NTWe_SlU7cdUrf4WrQFRxasVKdcIpm98sMOoXkMg2No HTTP/1.1" 302 -
2021-05-19 15:08:31,310:INFO:werkzeug:127.0.0.1 - - [19/May/2021 15:08:31] "GET /login/ HTTP/1.1" 200 -

With the following requests made by Superset

[3]GET /login/                     200 OK                                                                                                                        
[2]GET /oauth-authorized/FormShare 302 FOUND                                                                                                                     
[1]GET /login/FormShare            302 FOUND

And the following request made by Supeset to the OpenID server:

[2]POST /openid_token             200 OK                                                                                                                         
[1]GET  /openid_authentication    303 See Other

But then the process takes me back to login with the message:

Invalid login. Please try again.

Any tips are appreciated

QLands QLands · Accepted Answer · 2021-05-21T14:07:28

After some trial and error, I managed to configure SuperSet with my OpenID server but using OAUTH. I used the following configuration:

from formshare_sso_security_manager import FormShareSsoSecurityManager
from flask_appbuilder.security.manager import AUTH_OAUTH
...
CUSTOM_SECURITY_MANAGER = FormShareSsoSecurityManager
AUTH_TYPE = AUTH_OAUTH


OAUTH_PROVIDERS = [
    {
        "name": "FormShare",
        "token_key": "access_token",  # Name of the token in the response of access_token_url
        "icon": "fa-address-card",  # Icon for the provider
        "remote_app": {
            "client_id": "501cE2ow7V4J",  # Client Id (Identify Superset application)
            "client_secret": "060a450db0474b7db20afeda22a671b6",  # Secret for this Client Id (Identify Superset application)
            "client_kwargs": {"scope": "openid profile"},  # Scope for the Authorization
            "access_token_method": "POST",  # HTTP Method to call access_token_url
            "access_token_params": {
                "redirect_uri": "http://qlands.eu.ngrok.io/oauth-authorized/FormShare"
            },
            "access_token_headers": {  # Additional headers for calls to access_token_url
                "Authorization": "Basic Base64EncodedClientIdAndSecret"
            },
            "base_url": "https://qlands.ngrok.io",
            "access_token_url": "https://qlands.ngrok.io/openid_token",
            "authorize_url": "https://qlands.ngrok.io/openid_authentication",
        },
    }
]

The custom manager code is:

class FormShareSsoSecurityManager(SupersetSecurityManager):
    def oauth_user_info(self, provider, response=None):
        if provider == "FormShare":
            access_token = response["access_token"]
            headers = {"Authorization": "Bearer {}".format(access_token)}
            response = requests.get("https://qlands.ngrok.io/openid_userinfo", headers=headers)
            user_data = response.json()
            return {
                "name": user_data["name"],
                "email": user_data["email"],
                "id": user_data["user_name"],
                "username": user_data["user_name"],
                "first_name": user_data["name"],
                "last_name": user_data["name"],
            }

The custom security manager uses Python requests to get the user information because the following code indicated in the Superset documentation does not work:

me = self.appbuilder.sm.oauth_remotes[provider].get('openid_userinfo').data

For the OpenID integration to work, you need in the superset_config.py file to set up AUTH_USER_REGISTRATION = True which doesn't make sense for OpenID. Therefore if you have AUTH_USER_REGISTRATION = False you would need to modify the manager to customize the function auth_user_oauth():

class FormShareSsoSecurityManager(SupersetSecurityManager):
    def oauth_user_info(self, provider, response=None):
        if provider == "FormShare":
            access_token = response["access_token"]
            headers = {"Authorization": "Bearer {}".format(access_token)}
            response = requests.get("https://qlands.ngrok.io/openid_userinfo", headers=headers)
            user_data = response.json()
            return {
                "name": user_data["name"],
                "email": user_data["email"],
                "id": user_data["user_name"],
                "username": user_data["user_name"],
                "first_name": user_data["name"],
                "last_name": user_data["name"],
            }

    def auth_user_oauth(self, userinfo):
        ...

Like the original at flask_appbuilder/security/manager.py but to auto-register the user once is authenticated by the OpenID client.

OpenID code authentication in Apache SuperSet - Not keycloak

1 Answers