Login to ui with access_token

[cemrehancavdar]

Hi,

I implemented a system that uses the Superset REST API access token to bypass login in Superset's UI. This solution aims to simplify access to Superset through our app. The decode_token function, which can be found here, verifies the token against the configuration, AFAIU.

I would appreciate your feedback on this approach.
Thank you!

from flask import redirect, flash, request
from superset.security import SupersetSecurityManager
from flask_appbuilder.security.views import AuthDBView
from flask_appbuilder.security.views import expose
from flask_login import login_user
from flask_jwt_extended import decode_token

class CustomAuthDBView(AuthDBView):

    @expose('/login/', methods=['GET', 'POST'])
    def login(self):
        token = request.args.get('token')
        sm = self.appbuilder.sm
        session = sm.get_session
        if not token:
            return super(CustomAuthDBView,self).login()
        try:
            token = decode_token(token)
            id = token["sub"]
            user = session.query(sm.user_model).filter_by(id=id).first()
            login_user(user, remember=False, force=True)
            return redirect(self.appbuilder.get_url_for_index)
        except:
            flash('Unable to auto login', 'warning')
            return super(CustomAuthDBView,self).login()

class CustomSecurityManager(SupersetSecurityManager):
    authdbview = CustomAuthDBView
    def __init__(self, appbuilder):
        super(CustomSecurityManager, self).__init__(appbuilder)

[Jai-0011]

Hi @cemrehancavdar .Is , this functionality worked for you .?

[Jai-0011]

Yes ,@cemrehancavdar. I tried to implement same method with my codebase but superset yelling at me 404 .

can you plzzz drop a mail to [email protected]. It would be helpful.
Thank you a loadzzzzzzzzzzzz.....

[cemrehancavdar]

There were specific talks about @Jai-0011's scenario.
Do ask your questions here, we could try to answer her first @ggoouutthhaamm

[manik-ushur]

Thanks @cemrehancavdar Tried the above option. It works fine on Safari and Firefox in iframe. But, on chrome it enters and infinite loop of redirects and ends with

any help is deeply appreciated.

[manik-ushur]

Actually, i used the following code from https://www.tetranyde.com/blog/embedding-superset
`from flask_appbuilder.security.manager import BaseSecurityManager
from flask_appbuilder.security.manager import AUTH_REMOTE_USER
from flask import redirect, request, flash
from flask_login import login_user

Create a custom view to authenticate the user

AuthRemoteUserView=BaseSecurityManager.authremoteuserview
class CustomAuthUserView(AuthRemoteUserView):
@expose('/login/')
def login(self):
token = request.args.get('token')
next = request.args.get('next')
sm = self.appbuilder.sm
session = sm.get_session
user = session.query(sm.user_model).filter_by(username='admin').first()
if token == '1234abcd456':
login_user(user, remember=False, force=True)
if (next is not None):
return redirect(next)
else:
return redirect(self.appbuilder.get_url_for_index)
else:
flash('Unable to auto login', 'warning')
return super(CustomAuthUserView,self).login()

Create a custom Security manager that overrides the CustomAuthUserView

class CustomSecurityManager(SupersetSecurityManager):
authremoteuserview = CustomAuthUserView

Use our custom authenticator

CUSTOM_SECURITY_MANAGER = CustomSecurityManager

User remote authentication

AUTH_TYPE = AUTH_REMOTE_USER`

[manik-ushur]

Thanks @cemrehancavdar Finally, this is my complete superset_config.py. This worked for me:
`from flask import redirect, flash, request
from superset.security import SupersetSecurityManager
from flask_appbuilder.security.views import AuthDBView
from flask_appbuilder.security.views import expose
from flask_login import login_user
import jwt
import logging

Flask App Builder configuration

Your App secret key will be used for securely signing the session cookie

and encrypting sensitive information on the database

Make sure you are changing this key for your deployment with a strong key.

Alternatively you can set it with SUPERSET_SECRET_KEY environment variable.

You MUST set this for production environments or the server will not refuse

to start and you will see an error in the logs accordingly.

JWT_SECRET_KEY = 'YOUR_OWN_RANDOM_GENERATED_SECRET_KEY' # Generate a secure random key with openssl rand -base64 42
SECRET_KEY = JWT_SECRET_KEY
GUEST_ROLE_NAME = "Gamma"
GUEST_TOKEN_JWT_SECRET = SECRET_KEY
GUEST_TOKEN_JWT_ALGO = "HS256"
GUEST_TOKEN_HEADER_NAME = "X-GuestToken"
GUEST_TOKEN_JWT_EXP_SECONDS = 300 # 5 minutes
PUBLIC_ROLE_LIKE = "Gamma"
FAB_API_SWAGGER_UI = True
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True

#For logging
LOG_LEVEL = "DEBUG" # 'INFO' for Basic or 'DEBUG' for more detailed logs
LOG_FORMAT = '%(asctime)s:%(levelname)s:%(name)s:%(message)s'
handler = logging.FileHandler('superset.log')
handler.setLevel(LOG_LEVEL)
handler.setFormatter(logging.Formatter(LOG_FORMAT))
logging.getLogger().addHandler(handler)

Superset specific config

ROW_LIMIT = 5000

The SQLAlchemy connection string to your database backend

This connection defines the path to the database that stores your

superset metadata (slices, connections, tables, dashboards, ...).

Note that the connection information to connect to the datasources

you want to explore are managed directly in the web UI

The check_same_thread=false property ensures the sqlite client does not attempt

to enforce single-threaded access, which may be problematic in some edge cases

SQLALCHEMY_DATABASE_URI = 'sqlite:////app/superset/superset.db?check_same_thread=false'
#SQLALCHEMY_DATABASE_URI = 'postgresql://[email protected]:R!sh!k@[email protected]:5432/ushur_dev?sslmode=require&sslrootcert=/app/superset/ca.crt'

CA_CERT_PATH = "/app/superset/ca.crt"
DEBUG = True

TALISMAN_ENABLED = False
WTF_CSRF_ENABLED = False

Set this API key to enable Mapbox visualizations

MAPBOX_API_KEY = ''
ENABLE_JAVASCRIPT_CONTROLS = True
FEATURE_FLAGS = {
"EMBEDDED_SUPERSET": True
}
ENABLE_CORS = True
ENABLE_PROXY_FIX = True
CORS_OPTIONS = {
"supports_credentials": True,
"allow_headers": "",
"expose_headers": "",
"resources": "*",
"origins": ["http://localhost:4200","http://localhost:3000"] #4200 for angular , 3000 for react, #add more of your domains
}
class CustomAuthDBView(AuthDBView):

@expose('/login/', methods=['GET', 'POST'])
def login(self):
    token = request.args.get('token')
    sm = self.appbuilder.sm
    session = sm.get_session
    if not token:
        return super(CustomAuthDBView,self).login()
    try:
        # token = decode_token(token)
        decoded_token = jwt.decode(
            token,
            GUEST_TOKEN_JWT_SECRET,
            audience="http://0.0.0.0:8080/",
            algorithms=["HS256"],
        )
        username = decoded_token["user"]["username"]
        user = session.query(sm.user_model).filter_by(username=username).first()
        # id = token["sub"]
        # user = session.query(sm.user_model).filter_by(id=id).first()
        login_user(user, remember=False, force=True)
        return redirect(self.appbuilder.get_url_for_index)
    except:
        flash('Unable to auto login', 'warning')
        return super(CustomAuthDBView,self).login()

class CustomSecurityManager(SupersetSecurityManager):
authdbview = CustomAuthDBView
def init(self, appbuilder):
super(CustomSecurityManager, self).init(appbuilder)

Use our custom authenticator

CUSTOM_SECURITY_MANAGER = CustomSecurityManager`

[sallunasrullah]

I am using superset in my flask application, I am using superset login rest API in my flask application to authenticate my flask application and its working, but when after I open superset dashboard which I have a link in my flask application it against redirects me to login page,

[GspeyanHov]

Hi,

I implemented a system that uses the Superset REST API access token to bypass login in Superset's UI. This solution aims to simplify access to Superset through our app. The decode_token function, which can be found here, verifies the token against the configuration, AFAIU.

I would appreciate your feedback on this approach. Thank you!

from flask import redirect, flash, request
from superset.security import SupersetSecurityManager
from flask_appbuilder.security.views import AuthDBView
from flask_appbuilder.security.views import expose
from flask_login import login_user
from flask_jwt_extended import decode_token

class CustomAuthDBView(AuthDBView):

    @expose('/login/', methods=['GET', 'POST'])
    def login(self):
        token = request.args.get('token')
        sm = self.appbuilder.sm
        session = sm.get_session
        if not token:
            return super(CustomAuthDBView,self).login()
        try:
            token = decode_token(token)
            id = token["sub"]
            user = session.query(sm.user_model).filter_by(id=id).first()
            login_user(user, remember=False, force=True)
            return redirect(self.appbuilder.get_url_for_index)
        except:
            flash('Unable to auto login', 'warning')
            return super(CustomAuthDBView,self).login()

class CustomSecurityManager(SupersetSecurityManager):
    authdbview = CustomAuthDBView
    def __init__(self, appbuilder):
        super(CustomSecurityManager, self).__init__(appbuilder)

could you be able to help me, I have an error 'NoneType' object has no attribute 'is_active'

for any support --> [email protected]

thanks a lot for advance