Integration with OAuth provider okta #13948
Comments
|
Note that OKTA will be supported out of the box on FAB on 3.2.2 to be release this week. So you don't have to write your own custom security class |
|
@dpgaspar - Now i changed my superset_config.py file and have below configuration only. It allows me to authenticate using okta but after authentication. It redirects me to login page with message 'Invalid login. Please try again. Thanks in advance |
|
@dpgaspar would you happen to have any updates on FAB's version in Airflow? Was it updated to 3.2.2 by any chance in the |
|
I have a similar scenario. But when I select Okta as a provider and click the Sign In button I'm redirected to an error page that says: I tried using |
|
@Bonifacio-Oliveira have you tried using See #15010 |
|
@shawnzhu It worked. Thank you for the response and for the doc update. :) |
|
Hello again, @shawnzhu . I reread the entire discussion here and noticed that the version I'm running locally was supposed to already have a built-in Okta support. But when I try to run the app without a It's nice that we were able to improve the docs on the redirect uri usage, but unfortunately we haven't solved the original issue yet. Any suggestions on what to try? Please let me know if you need additional information. |
|
In my case, the server side has the following logs: |
|
@Bonifacio-Oliveira looks like we're getting a 405 from okta |
|
the okta docs say it's |
|
@vinit2580 The error in your logs is coming from the code in your custom security manager if res.status != 200:python Response objects don't have that attribute, I think you're looking for |
|
Found this gist titled Enable Okta Login for Superset: https://gist.github.com/ktmud/2475282a166893e5d17039c308cbe50d my working setupI get used to specify After configuring either class CustomSecurityManager(SupersetSecurityManager):
'''
Custom security manager to support my OpenID Connect
'''
def oauth_user_info(self, provider, response=None):
if provider == 'my-oidc-provider-name':
# As OpenID connect 1.0 provider, it provides id_token in response
user_info = self.appbuilder.sm.oauth_remotes[provider].parse_id_token(response)
return {
# use email as username
'username': user_info['email'],
'email': user_info['email']
}let me know if it works for you or not |
|
Hello, @shawnzhu . I tried your code and it didn't work. Let me share mine: class CustomSsoSecurityManager(SupersetSecurityManager):
def oauth_user_info(self, provider, response=None):
if provider == 'okta':
user_info = self.appbuilder.sm.oauth_remotes[provider].get('userinfo')
me = user_info.json()
return {
'name': me['name'],
'email': me['email'],
'id': me['email'],
'username': me['email'],
'first_name': me['given_name'],
'last_name': me['family_name']
}I'm now able to retrieve the data from Okta, but it's still not clear to me what is the interface of the object |
|
@Bonifacio-Oliveira I had the similar experience, do you mind adding debug info via logging? in your import logging
logger = logging.getLogger(__name__)
logger.setLevel(logging.DEBUG)
class CustomSsoSecurityManager(SupersetSecurityManager):
def oauth_user_info(self, provider, response=None):
log.debug('oauth2 provider: {0}'.format(provider))
log.debug('response: {0}'.format(response))
if provider == 'okta':
user_info = self.appbuilder.sm.oauth_remotes[provider].get('userinfo')
log.debug('user_info: {0}'.format(user_info))
# maybe you want to debug the parsed id_token since you said it doesn't work for you
# user_info = self.appbuilder.sm.oauth_remotes[provider].parse_id_token(response)
me = user_info.json()
return {
'name': me['name'],
'email': me['email'],
'id': me['email'],
'username': me['email'],
'first_name': me['given_name'],
'last_name': me['family_name']
}Question: have you enabled the |
|
Here are the logs you asked: About your question: No, I haven't. Is this required? If so, how do I do this? Any documentation on the subject? |
|
@Bonifacio-Oliveira So your debug info showed that it has provided an id token in the response object, so do you mind uncommenting the line that parse id_token: user_info = self.appbuilder.sm.oauth_remotes[provider].parse_id_token(response)
log.debug('user_info: {0}'.format(user_info))Then you can see if you can use the
The doc is here: https://github.com/lepture/authlib/blob/33aab0272d7c8a857c851f49a32c6d374930549a/authlib/integrations/base_client/base_app.py#L14-L55 |
|
Uncommenting the line you mentioned results in an error: |
|
According to Okta, it needs to retrieve the PS: you could specify the I really should document this in the official doc as well. |
|
Set How do I know what I have to return when I override {
'name': user_info['name'],
'email': user_info['email'],
'id': user_info['email'],
'username': user_info['email'],
} |
|
And hopefully one of the outcomes of this discussion is better documentation on how to set things up. I'm happy to help with what I can. :) |
This is the logic of the latest flask-appbuilder: this is how flask appbuilder uses user_info: https://github.com/dpgaspar/Flask-AppBuilder/blob/dae4dd47d51e1e2eb5894bce55221c1d26864c3b/flask_appbuilder/security/manager.py#L1287-L1302 So the key attributes are |
|
Ah, so the user isn't upserted, it's just matched against an existing user in the db based on the username attribute. |
|
it should be an upsert if |
|
I was finally able to login successfully. I just searched the repo and didn't find any reference to |
|
Glad to hear it works for you! Sorry I didn't make it clear. The As a superset administrator, you can run command |
|
can share insights to logout side of code. thank you. |
|
can someone please share their working code here. |
|
from flask_appbuilder.security.views import AuthOAuthView class CustomSsoAuthOAuthView(AuthOAuthView): class CustomSsoSecurityManager(SupersetSecurityManager): |
i did some customization for logout to get the url from config. |
|
I see that as per suggestion from FAB already has okta setup. Just putting if some find it's useful. |
Hi,
I am trying to integrate okta using OAuth but everytime it gives me invalid login. Please try again message.
My superset_config.py has below configuration:
import os
from flask import Flask
import logging
from flask_appbuilder.security.manager import AUTH_OID, AUTH_REMOTE_USER, AUTH_DB, AUTH_LDAP, AUTH_OAUTH
from superset.security import SupersetSecurityManager
import logging
from flask_appbuilder import SQLA, AppBuilder
class CustomSsoSecurityManager(SupersetSecurityManager):
Superset specific config
ROW_LIMIT = 5000
AUTH_USER_REGISTRATION = True
AUTH_USER_REGISTRATION_ROLE = 'Admin'
AUTH_ROLE_ADMIN = 'Admin'
AUTH_ROLE_PUBLIC = 'Admin'
WTF_CSRF_EXEMPT_LIST = ['']
Flask App Builder configuration
Your App secret key
SECRET_KEY = '\2\1thisismyscretkey\1\2\e\y\y\h'
AUTH_TYPE = AUTH_OAUTH
OAUTH_PROVIDERS = [{
'name': 'okta',
'token_key': 'access_token', # Name of the token in the response of access_token_url
'icon':'fa-circle-o', # Icon for the provider
'remote_app': {
'client_id': '0oa8hoe9t1c8555666091z357', # Client Id (Identify Superset application)
'client_secret': 'b8exxJID0BQOXlvMl1234565frU4OY7FX3cXDOMLM', # Secret for this Client Id (Identify Superset application)
'client_kwargs': {
'scope': 'openid'
},
'access_token_method': 'POST', # HTTP Method to call access_token_url
'access_token_headers': { # Additional headers for calls to access_token_url
'Authorization': 'Basic MG9hOGhvZTl0MWM4THhCMXozNTc6YjhleHhKSUQwQlFPWGx2TWxRYTVUbzVmclU0T1k3RlgzY1hET01MTQ=='
},
'base_url': 'https://dev-514411.okta.com/oauth2/default/',
'authorize_url': 'https://dev-514411.okta.com/oauth2/default/v1/authorize',
'access_token_url': 'https://dev-514411.okta.com/oauth2/default/v1/token',
'redirect_uris': ['http://127.0.0.1:8088/oauth-authorized/okta']
}
}]
CUSTOM_SECURITY_MANAGER = CustomSsoSecurityManager
Whenever i try to login. It gives below error message :
I got stuck here. i followed the steps mentioned into superset configuration settings. Can someone help me here please ?
The text was updated successfully, but these errors were encountered: