Superset docker and LDAP Integration | Unable to get the next page after authentication with LDAP

[quadrakpp]

Hello,

I'am able to connect to superset with admin/admin (AUTH_DB).
But when I tried to integrate LDAP, I'm getting "Invalid login. Please try again." feedback but nothing wrong is not printed in the logs.
When I started the integration I was getting below errors in the logs regarding the LDAP config but I fixed them already :

• ERROR:flask_appbuilder.security.manager:{'result': -1, 'desc': "Can't contact LDAP server", 'ctrls': []}
• ERROR:flask_appbuilder.security.manager:(0, 'Error')

PS: I'm doing my config directly into config.py file because when I put the same config inside of /app/docker/pythonpath_dev/superset_config.py file, the container is getting restarted without ending.

[dosubot[bot]]

Hey there, @quadrakpp! I'm here to help you with any bugs, questions, or contributions you have. Let's tackle this LDAP integration issue together!

I found a similar closed issue that might help you resolve the "Invalid login. Please try again." error when integrating LDAP with Superset Docker:

1. LDAP auth doesn't work in Superset v.3.0.0 - The issue was resolved by checking the default settings of Talisman CSP, cookie security, or CSRF in config.py and disabling several security settings in superset_config_docker.py:

WTF_CSRF_ENABLED = False
TALISMAN_ENABLED = False
SESSION_COOKIE_SAMESITE = None
SESSION_COOKIE_SECURE = False
SESSION_COOKIE_HTTPONLY = False

However, be cautious as disabling these security measures may make your instance more insecure. Adjust these settings appropriately for a production environment ^[1].

To ensure your LDAP configuration is correct, verify the following key configurations in your superset_config.py:

1. LDAP Server Configuration:
   Ensure that the LDAP server URL, bind user, and bind password are correctly set.

2. LDAP Search Configuration:
   Verify that the search base and search filter are correctly configured to find the user in the LDAP directory.

3. Role Mapping:
   Ensure that the AUTH_ROLES_MAPPING is correctly set to map LDAP groups to Superset roles.

4. Syncing Roles at Login:
   Check if AUTH_ROLES_SYNC_AT_LOGIN is set to True to sync roles at each login.

Here is an example configuration for superset_config.py:

# LDAP Configuration
AUTH_TYPE = AUTH_LDAP
AUTH_LDAP_SERVER = "ldap://your-ldap-server"
AUTH_LDAP_USE_TLS = False
AUTH_LDAP_SEARCH = "ou=users,dc=example,dc=com"
AUTH_LDAP_BIND_USER = "cn=admin,dc=example,dc=com"
AUTH_LDAP_BIND_PASSWORD = "your_bind_password"
AUTH_LDAP_UID_FIELD = "uid"
AUTH_LDAP_FIRSTNAME_FIELD = "givenName"
AUTH_LDAP_LASTNAME_FIELD = "sn"
AUTH_LDAP_EMAIL_FIELD = "mail"

# Mapping LDAP groups to Superset roles
AUTH_ROLES_MAPPING = {
    "cn=superset_users,ou=groups,dc=example,dc=com": ["Gamma", "Alpha"],
    "cn=superset_admins,ou=groups,dc=example,dc=com": ["Admin"],
}

# Sync roles at login
AUTH_ROLES_SYNC_AT_LOGIN = True

Ensure these configurations are correctly set in your superset_config.py file and that the file is correctly referenced in your Docker setup ^[2]. If the issue persists, check the Superset logs for more detailed error messages.

To continue talking to Dosu, mention @dosu.

[quadrakpp]

Hello @dosu,

I did the change but no change. Still not able to access to portal and no error from superset logs.

Here below my LDAP config :

AUTH_TYPE = AUTH_LDAP
AUTH_LDAP_SERVER = "mylocaldomain.lan"
AUTH_LDAP_USE_TLS = True
#AUTH_USER_REGISTRATION = True
AUTH_USER_REGISTRATION_ROLE = "Gamma"
AUTH_LDAP_SEARCH = "ou=users,dc=mylocaldomain,dc=lan"
AUTH_LDAP_UID_FIELD = "uid"
AUTH_LDAP_BIND_USER = "uid=myaccount,dc=mylocaldomain,dc=lan"
AUTH_LDAP_BIND_PASSWORD = "myaccountpassword"
AUTH_LDAP_FIRSTNAME_FIELD = "givenName"
AUTH_LDAP_LASTNAME_FIELD = "sn"
AUTH_LDAP_EMAIL_FIELD = "mail"
AUTH_ROLES_MAPPING = {
"cn=fab_users,ou=users,dc=mylocaldomain,dc=lan": ["Gamma"],
"cn=fab_admins,ou=my_OrgUnit_for_domaincontroller_admins,dc=mylocaldomain,dc=lan": ["Admin"],
}
AUTH_ROLES_SYNC_AT_LOGIN = True

[dosubot[bot]]

Ensure that your LDAP configuration is correct and that the superset_config.py file is properly loaded in your Docker setup. Here are a few steps to troubleshoot and verify your configuration:

1. Verify LDAP Configuration:
   Ensure that your LDAP server details, bind user, and search base are correct. Double-check the AUTH_LDAP_SEARCH and AUTH_LDAP_BIND_USER values.

2. Enable Detailed Logging:
   Increase the logging level to DEBUG to capture more detailed logs, which can help diagnose the issue.

   import logging
   
   app_config = {
       "SILENCE_FAB": False,
       "LOG_FORMAT": "%(asctime)s:%(levelname)s:%(name)s:%(message)s",
       "LOG_LEVEL": logging.DEBUG,  # Set to DEBUG for more detailed logs
       "ENABLE_TIME_ROTATE": False,
       "TIME_ROTATE_LOG_LEVEL": logging.DEBUG,
       "FILENAME": os.path.join(DATA_DIR, "superset.log"),
       "ROLLOVER": "midnight",
       "INTERVAL": 1,
       "BACKUP_COUNT": 30,
   }
   
   logging_configurator = DefaultLoggingConfigurator()
   logging_configurator.configure_logging(app_config, debug_mode=True)

3. Check Docker Configuration:
   Ensure that the superset_config.py file is correctly referenced in your Docker setup. Set the SUPERSET_CONFIG_PATH environment variable to point to the configuration file.

   COPY --chown=superset superset_config.py /app/
   ENV SUPERSET_CONFIG_PATH /app/superset_config.py

4. Review LDAP Bind and Search:
   Ensure that the bind user has the necessary permissions to search the LDAP directory. Also, verify that the search base and filter are correctly configured to locate the user.

5. Test LDAP Connection:
   Use an LDAP client or command-line tool to test the connection and search queries manually. This can help identify any issues with the LDAP server or configuration.

6. Check for Common Pitfalls:

   • Ensure that the AUTH_LDAP_BIND_USER and AUTH_LDAP_BIND_PASSWORD are correct.
   • Verify that the AUTH_LDAP_SEARCH base is correct and that the user exists within this base.
   • Ensure that the AUTH_LDAP_UID_FIELD matches the attribute used for the username in your LDAP directory.

By following these steps, you should be able to identify and resolve the issue with LDAP authentication in your Superset Docker setup ^[1][2].

To continue talking to Dosu, mention @dosu.