Superset session creation using keycloak authentication for a third party application.

[praveer38]

From our application we are trying to show the superset dashboard using but currently we are using the public user role. How can we call the dashboard but authenticate the session before exposing the dashboard? The authentication we want to use is keycloak.

[dosubot[bot]]

To authenticate a Superset session using Keycloak before exposing the dashboard to a third-party application, you can follow these steps:

1. Install Flask-OIDC: Ensure the Flask-OIDC package is installed.

2. Create a Security Manager: Define a new security manager in a file named keycloak_security_manager.py:

   from flask_appbuilder.security.manager import AUTH_OID
   from superset.security import SupersetSecurityManager
   from flask_oidc import OpenIDConnect
   from flask_appbuilder.security.views import AuthOIDView
   from flask_login import login_user
   from urllib.parse import quote
   from flask import redirect, request
   
   class OIDCSecurityManager(SupersetSecurityManager):
       def __init__(self, appbuilder):
           super(OIDCSecurityManager, self).__init__(appbuilder)
           if self.auth_type == AUTH_OID:
               self.oid = OpenIDConnect(self.appbuilder.get_app)
           self.authoidview = AuthOIDCView
   
   class AuthOIDCView(AuthOIDView):
       @expose('/login/', methods=['GET', 'POST'])
       def login(self, flag=True):
           sm = self.appbuilder.sm
           oidc = sm.oid
   
           @self.appbuilder.sm.oid.require_login
           def handle_login():
               user = sm.auth_user_oid(oidc.user_getfield('email'))
   
               if user is None:
                   info = oidc.user_getinfo(['preferred_username', 'given_name', 'family_name', 'email'])
                   user = sm.add_user(info.get('preferred_username'), info.get('given_name'), info.get('family_name'),
                                      info.get('email'), sm.find_role('Gamma'))
   
               login_user(user, remember=False)
               return redirect(self.appbuilder.get_url_for_index)
   
           return handle_login()
   
       @expose('/logout/', methods=['GET', 'POST'])
       def logout(self):
           oidc = self.appbuilder.sm.oid
   
           oidc.logout()
           super(AuthOIDCView, self).logout()
           redirect_url = request.url_root.strip('/') + self.appbuilder.get_url_for_login
   
           return redirect(
               oidc.client_secrets.get('issuer') + '/protocol/openid-connect/logout?redirect_uri=' + quote(redirect_url))

3. Configure Superset: Add the following to your superset_config.py:

   from keycloak_security_manager import OIDCSecurityManager
   from flask_appbuilder.security.manager import AUTH_OID
   
   AUTH_TYPE = AUTH_OID
   SECRET_KEY = 'SomethingNotEntirelySecret'
   OIDC_CLIENT_SECRETS = '/path/to/client_secret.json'
   OIDC_ID_TOKEN_COOKIE_SECURE = False
   OIDC_OPENID_REALM = '<myRealm>'
   OIDC_INTROSPECTION_AUTH_METHOD = 'client_secret_post'
   CUSTOM_SECURITY_MANAGER = OIDCSecurityManager
   AUTH_USER_REGISTRATION = True
   AUTH_USER_REGISTRATION_ROLE = 'Public'

4. Client Secret Configuration: Store your client-specific OpenID information in client_secret.json:

   {
       "<myOpenIDProvider>": {
           "issuer": "https://<myKeycloakDomain>/realms/<myRealm>",
           "auth_uri": "https://<myKeycloakDomain>/realms/<myRealm>/protocol/openid-connect/auth",
           "client_id": "https://<myKeycloakDomain>",
           "client_secret": "<myClientSecret>",
           "redirect_uris": [
               "https://<SupersetWebserver>/oauth-authorized/<myOpenIDProvider>"
           ],
           "userinfo_uri": "https://<myKeycloakDomain>/realms/<myRealm>/protocol/openid-connect/userinfo",
           "token_uri": "https://<myKeycloakDomain>/realms/<myRealm>/protocol/openid-connect/token",
           "token_introspection_uri": "https://<myKeycloakDomain>/realms/<myRealm>/protocol/openid-connect/token/introspect"
       }
   }

This setup will allow Superset to authenticate users via Keycloak before exposing the dashboard to a third-party application ^[1].

To continue talking to Dosu, mention @dosu.