Support microsoft login

client/app/pages/settings/OrganizationSettings.jsx

@@ -48,7 +48,7 @@ class OrganizationSettings extends React.Component {
   }
 
   disablePasswordLoginToggle = () =>
-    !(clientConfig.googleLoginEnabled || clientConfig.ldapLoginEnabled || this.state.formValues.auth_saml_enabled);
+    !(clientConfig.googleLoginEnabled || clientConfig.microsoftLoginEnabled || clientConfig.ldapLoginEnabled || this.state.formValues.auth_saml_enabled);
 
   handleSubmit = e => {
     e.preventDefault();
@@ -103,6 +103,34 @@ class OrganizationSettings extends React.Component {
     );
   }
 
+  renderMicrosoftLoginOptions() {
+    const { formValues } = this.state;
+    return (
+      <React.Fragment>
+        <h4>Microsoft Login</h4>
+        <Form.Item label="Allowed Microsoft Apps Domains">
+          <Select
+            mode="tags"
+            value={formValues.auth_microsoft_apps_domains}
+            onChange={value => this.handleChange("auth_microsoft_apps_domains", value)}
+          />
+          {!isEmpty(formValues.auth_microsoft_apps_domains) && (
+            <Alert
+              message={
+                <p>
+                  Any user registered with a <strong>{join(formValues.auth_microsoft_apps_domains, ", ")}</strong> Microsoft
+                  Apps account will be able to login. If they don{"'"}t have an existing user, a new user will be
+                  created and join the <strong>Default</strong> group.
+                </p>
+              }
+              className="m-t-15"
+            />
+          )}
+        </Form.Item>
+      </React.Fragment>
+    );
+  }
+
   renderSAMLOptions() {
     const { formValues } = this.state;
     return (
@@ -252,6 +280,7 @@ class OrganizationSettings extends React.Component {
           </Checkbox>
         </Form.Item>
         {clientConfig.googleLoginEnabled && this.renderGoogleLoginOptions()}
+        {clientConfig.microsoftLoginEnabled && this.renderMicrosoftLoginOptions()}
         {this.renderSAMLOptions()}
       </React.Fragment>
     );

redash/authentication/__init__.py

@@ -243,6 +243,7 @@ def logout_and_redirect_to_index():
 def init_app(app):
     from redash.authentication import (
         google_oauth,
+        microsoft_oauth,
         saml_auth,
         remote_user_auth,
         ldap_auth,
@@ -252,6 +253,7 @@ def init_app(app):
     login_manager.anonymous_user = models.AnonymousUser
 
     app.register_blueprint(google_oauth.blueprint)
+    app.register_blueprint(microsoft_oauth.blueprint)
     app.register_blueprint(saml_auth.blueprint)
     app.register_blueprint(remote_user_auth.blueprint)
     app.register_blueprint(ldap_auth.blueprint)

redash/authentication/microsoft_oauth.py

@@ -0,0 +1,119 @@
+import logging
+import requests
+import jwt
+from flask import redirect, url_for, Blueprint, flash, request, session
+from flask_oauthlib.client import OAuth
+
+from redash import models, settings
+from redash.authentication import (
+    create_and_login_user,
+    logout_and_redirect_to_index,
+    get_next_path,
+)
+from redash.authentication.org_resolving import current_org
+
+logger = logging.getLogger("microsoft_oauth")
+
+oauth = OAuth()
+blueprint = Blueprint("microsoft_oauth", __name__)
+
+def microsoft_remote_app():
+    if "microsoft" not in oauth.remote_apps:
+        oauth.remote_app(
+            "microsoft",
+            base_url="https://login.microsoftonline.com",
+            authorize_url="https://login.microsoftonline.com/{}/oauth2/v2.0/authorize".format(settings.MICROSOFT_TENANT_ID),
+            request_token_url=None,
+            request_token_params={
+                "scope": "openid email",
+            },
+            access_token_url="https://login.microsoftonline.com/{}/oauth2/v2.0/token".format(settings.MICROSOFT_TENANT_ID),
+            access_token_method="POST",
+            consumer_key=settings.MICROSOFT_CLIENT_ID,
+            consumer_secret=settings.MICROSOFT_CLIENT_SECRET,
+        )
+
+    return oauth.microsoft
+
+
+def get_user_profile(code):
+    resp = microsoft_remote_app().authorized_response()
+    id_token = resp.get("id_token")
+    if id_token is None:
+        logger.warning("Failed getting user profile.", resp)
+        return None
+    profile = jwt.decode(id_token.encode('utf-8'), verify=False)
+    profile['name'] = profile['email'].split('@', 1)[0]
+    return profile
+
+
+def verify_profile(org, profile):
+    if org.is_public:
+        return True
+
+    email = profile["email"]
+    domain = email.split("@")[-1]
+
+    if domain in org.microsoft_apps_domains:
+        return True
+
+    if org.has_user(email) == 1:
+        return True
+
+    return False
+
+
+@blueprint.route("/<org_slug>/oauth/microsoft", endpoint="authorize_org")
+def org_login(org_slug):
+    session["org_slug"] = current_org.slug
+    return redirect(url_for(".authorize", next=request.args.get("next", None)))
+
+
+@blueprint.route("/oauth/microsoft", endpoint="authorize")
+def login():
+    callback = url_for(".callback", _external=True)
+    next_path = request.args.get(
+        "next", url_for("redash.index", org_slug=session.get("org_slug"))
+    )
+    logger.debug("Callback url: %s", callback)
+    logger.debug("Next is: %s", next_path)
+    return microsoft_remote_app().authorize(callback=callback, state=next_path)
+
+
+@blueprint.route("/oauth/microsoft_callback", endpoint="callback")
+def authorized():
+    code = request.args.get('code')
+    if code is None:
+        logger.warning("code missing in call back request.")
+        flash("Validation error. Please retry.")
+        return redirect(url_for("redash.login"))
+    profile = get_user_profile(code)
+    if profile is None:
+        flash("Validation error. Please retry.") 
+        return redirect(url_for("redash.login"))
+
+    if "org_slug" in session:
+        org = models.Organization.get_by_slug(session.pop("org_slug"))
+    else:
+        org = current_org
+
+    if not verify_profile(org, profile):
+        logger.warning(
+            "User tried to login with unauthorized domain name: %s (org: %s)",
+            profile["email"],
+            org,
+        )
+        flash("Your microsoft Apps account ({}) isn't allowed.".format(profile["email"]))
+        return redirect(url_for("redash.login", org_slug=org.slug))
+
+    picture_url = profile.get('picture')
+    user = create_and_login_user(org, profile["name"], profile["email"], picture_url)
+    if user is None:
+        return logout_and_redirect_to_index()
+
+    unsafe_next_path = request.args.get("state") or url_for(
+        "redash.index", org_slug=org.slug
+    )
+    next_path = get_next_path(unsafe_next_path)
+
+    return redirect(next_path)

redash/cli/organization.py

@@ -18,7 +18,7 @@ def set_google_apps_domains(domains):
     models.db.session.add(organization)
     models.db.session.commit()
     print(
-        "Updated list of allowed domains to: {}".format(
+        "Updated list of google allowed domains to: {}".format(
             organization.google_apps_domains
         )
     )
@@ -33,6 +33,32 @@ def show_google_apps_domains():
         )
     )
 
+@manager.command()
+@argument("domains")
+def set_microsoft_apps_domains(domains):
+    """
+    Sets the allowable domains to the comma separated list DOMAINS.
+    """
+    organization = models.Organization.query.first()
+    k = models.Organization.SETTING_MICROSOFT_APPS_DOMAINS
+    organization.settings[k] = domains.split(",")
+    models.db.session.add(organization)
+    models.db.session.commit()
+    print(
+        "Updated list of microsoft allowed domains to: {}".format(
+            organization.microsoft_apps_domains
+        )
+    )
+
+
+@manager.command()
+def show_microsoft_apps_domains():
+    organization = models.Organization.query.first()
+    print(
+        "Current list of Microsoft Apps domains: {}".format(
+            ", ".join(organization.microsoft_apps_domains)
+        )
+    )
 
 @manager.command(name="list")
 def list_command():

redash/handlers/authentication.py

@@ -30,6 +30,9 @@ def get_google_auth_url(next_path):
         google_auth_url = url_for("google_oauth.authorize", next=next_path)
     return google_auth_url
 
+def get_microsoft_auth_url(next_path):
+    microsoft_auth_url = url_for("microsoft_oauth.authorize", next=next_path)
+    return microsoft_auth_url
 
 def render_token_login_page(template, org_slug, token, invite):
     try:
@@ -93,12 +96,15 @@ def render_token_login_page(template, org_slug, token, invite):
             return redirect(url_for("redash.index", org_slug=org_slug))
 
     google_auth_url = get_google_auth_url(url_for("redash.index", org_slug=org_slug))
+    microsoft_auth_url = get_microsoft_auth_url(url_for("redash.index", org_slug=org_slug))
 
     return (
         render_template(
             template,
             show_google_openid=settings.GOOGLE_OAUTH_ENABLED,
             google_auth_url=google_auth_url,
+            show_microsoft_openid=settings.MICROSOFT_OAUTH_ENABLED,
+            microsoft_auth_url=microsoft_auth_url,
             show_saml_login=current_org.get_setting("auth_saml_enabled"),
             show_remote_user_login=settings.REMOTE_USER_LOGIN_ENABLED,
             show_ldap_login=settings.LDAP_LOGIN_ENABLED,
@@ -215,6 +221,7 @@ def login(org_slug=None):
             flash("Wrong email or password.")
 
     google_auth_url = get_google_auth_url(next_path)
+    microsoft_auth_url = get_microsoft_auth_url(next_path)
 
     return render_template(
         "login.html",
@@ -223,6 +230,8 @@ def login(org_slug=None):
         email=request.form.get("email", ""),
         show_google_openid=settings.GOOGLE_OAUTH_ENABLED,
         google_auth_url=google_auth_url,
+        show_microsoft_openid=settings.MICROSOFT_OAUTH_ENABLED,
+        microsoft_auth_url=microsoft_auth_url,
         show_password_login=current_org.get_setting("auth_password_login_enabled"),
         show_saml_login=current_org.get_setting("auth_saml_enabled"),
         show_remote_user_login=settings.REMOTE_USER_LOGIN_ENABLED,
@@ -295,6 +304,7 @@ def client_config():
         "dashboardRefreshIntervals": settings.DASHBOARD_REFRESH_INTERVALS,
         "queryRefreshIntervals": settings.QUERY_REFRESH_INTERVALS,
         "googleLoginEnabled": settings.GOOGLE_OAUTH_ENABLED,
+        "microsoftLoginEnabled": settings.MICROSOFT_OAUTH_ENABLED,
         "ldapLoginEnabled": settings.LDAP_LOGIN_ENABLED,
         "pageSize": settings.PAGE_SIZE,
         "pageSizeOptions": settings.PAGE_SIZE_OPTIONS,

redash/handlers/data_sources.py

@@ -1,5 +1,5 @@
 import logging
-
+import traceback
 from flask import make_response, request
 from flask_restful import abort
 from funcy import project
@@ -193,6 +193,7 @@ def get(self, data_source_id):
             }
         except Exception:
             response["error"] = {"code": 2, "message": "Error retrieving schema."}
+            logging.ERROR(traceback.format_exc())
 
         return response
 

redash/handlers/settings.py

@@ -21,6 +21,7 @@ def get_settings_with_defaults(defaults, org):
             settings[setting] = current_value
 
     settings["auth_google_apps_domains"] = org.google_apps_domains
+    settings["auth_microsoft_apps_domains"] = org.microsoft_apps_domains
 
     return settings
 
@@ -44,6 +45,9 @@ def post(self):
             if k == "auth_google_apps_domains":
                 previous_values[k] = self.current_org.google_apps_domains
                 self.current_org.settings[Organization.SETTING_GOOGLE_APPS_DOMAINS] = v
+            elif k == "auth_microsoft_apps_domains":
+                previous_values[k] = self.current_org.microsoft_apps_domains
+                self.current_org.settings[Organization.SETTING_MICROSOFT_APPS_DOMAINS] = v
             else:
                 previous_values[k] = self.current_org.get_setting(
                     k, raise_on_missing=False

redash/models/organizations.py

@@ -12,6 +12,7 @@
 @generic_repr("id", "name", "slug")
 class Organization(TimestampMixin, db.Model):
     SETTING_GOOGLE_APPS_DOMAINS = "google_apps_domains"
+    SETTING_MICROSOFT_APPS_DOMAINS = "microsoft_apps_domains"
     SETTING_IS_PUBLIC = "is_public"
 
     id = Column(db.Integer, primary_key=True)
@@ -44,6 +45,10 @@ def default_group(self):
     def google_apps_domains(self):
         return self.settings.get(self.SETTING_GOOGLE_APPS_DOMAINS, [])
 
+    @property
+    def microsoft_apps_domains(self):
+        return self.settings.get(self.SETTING_MICROSOFT_APPS_DOMAINS, [])
+
     @property
     def is_public(self):
         return self.settings.get(self.SETTING_IS_PUBLIC, False)

redash/query_runner/amazon_elasticsearch.py

@@ -1,4 +1,5 @@
-from .elasticsearch import ElasticSearch
+from .elasticsearch import BaseElasticSearch, ElasticSearch
+from typing import Tuple, Optional
 from . import register
 
 try:
@@ -63,5 +64,53 @@ def __init__(self, configuration):
 
         self.auth = AWSV4Sign(cred, region, "es")
 
+class AmazonElasticsearchSqlService(AmazonElasticsearchService):
+    @classmethod
+    def name(cls):
+        return "Amazon Elasticsearch Service for SQL"
+
+    @classmethod
+    def enabled(cls):
+        return enabled
+
+    @classmethod
+    def type(cls):
+        return "aws_es_sql"
+
+    @classmethod
+    def configuration_schema(cls):
+        return {
+            "type": "object",
+            "properties": {
+                "server": {"type": "string", "title": "Endpoint"},
+                "region": {"type": "string"},
+                "access_key": {"type": "string", "title": "Access Key"},
+                "secret_key": {"type": "string", "title": "Secret Key"},
+            },
+            "secret": ["secret_key"],
+            "order": [
+                "server",
+                "region",
+                "access_key",
+                "secret_key",
+            ],
+            "required": ["server", "region"],
+        }
+
+    def __init__(self, configuration):
+        super(AmazonElasticsearchSqlService, self).__init__(configuration)
+        self.syntax = 'sql'
+
+    def run_query(self, query, user):
+        return BaseElasticSearch.run_query(self, query, user)
+
+    def _build_query(self, query: str) -> Tuple[dict, str, Optional[list]]:
+        sql_query = {
+            'query': query
+        }
+        sql_query_url = '/_opendistro/_sql'
+        return None, sql_query, sql_query_url, None
+
 
 register(AmazonElasticsearchService)
+register(AmazonElasticsearchSqlService)