Integrating Keycloak with Superset (v4.1.1) - Issue with OAuth Login

[alisharifi2000]

# Integrating Keycloak with Superset (v4.1.1) - Issue with OAuth Login
Hi everyone,
I'm trying to integrate Superset 4.1.1 with Keycloak 26.1.1, both running in Docker.

superset -> localhost:8088
keycloak -> localhost:8080

I've configured Superset with the following security manager in superset_config.py

from superset.security import SupersetSecurityManager
from flask_appbuilder.security.manager import AUTH_OAUTH

class KeycloakSecurity(SupersetSecurityManager):
    """
    Custom Security Manager for handling Keycloak authentication.
    """
    def __init__(self, appbuilder):
        super().__init__(appbuilder)
        app = self.appbuilder.get_app
        app.config.setdefault("AUTH_ROLES_MAPPING", {})
        app.config.setdefault("AUTH_TYPE", AUTH_OAUTH)

    def oauth_user_info(self, provider, resp=None):
        if provider == "keycloak":
            log.debug("Keycloak response received: %s", resp)
            log.debug("ID Token: %s", resp.get("id_token"))
            me = self.appbuilder.sm.oauth_remotes[provider].get(
                f'http://{keycloak_address}/auth/realms/{keycloak_realm}/protocol/openid-connect/userinfo'
            )
            me.raise_for_status()
            data = me.json()
            log.debug("User info from Keycloak: %s", data)
            return {
                "name": data["name"],
                "email": data["email"],
                "first_name": data["given_name"],
                "last_name": data["family_name"],
                "id": data["preferred_username"],
                "username": data["preferred_username"],
            }

CUSTOM_SECURITY_MANAGER = KeycloakSecurity
AUTH_USER_REGISTRATION = True  # Allow user self-registration
AUTH_USER_REGISTRATION_ROLE = "Public"
AUTH_TYPE = AUTH_OAUTH
OAUTH_PROVIDERS = [
    {
        "name": "keycloak",
        "icon": "fa-key",
        "token_key": "access_token",
        "remote_app": {
            "client_id": "superset",
            "client_secret": client_secret,
            "client_kwargs": {"scope": "openid email"},
            "api_base_url": f"http://{keycloak_address}/realms/{keycloak_realm}/protocol/openid-connect",
            "authorize_url": f"http://{keycloak_address}/realms/{keycloak_realm}/protocol/openid-connect/auth",
            "access_token_url": f"http://{keycloak_address}/realms/{keycloak_realm}/protocol/openid-connect/token",
            "jwks_uri": f"http://{keycloak_address}/realms/{keycloak_realm}/protocol/openid-connect/certs",
            "request_token_url": None,
            "access_token_method": "POST",
        }
    }
]

Steps Taken:

1. Created a realm (superset) and client (superset) in Keycloak.
2. Created a user (test) with password (test) in Keycloak.
3. In Superset, clicked "Login with Keycloak" → redirected to Keycloak.
4. Entered username (test) and password (test) → redirected back to the Superset login page instead of being logged in with error The request to sign in was denied.

Issue:
Checking the Superset logs, I found this error:

ERROR: flask_appbuilder.security.views: Error authorizing OAuth access token: 
HTTPConnectionPool(host='localhost', port=8080): Max retries exceeded with URL: /realms/superset/protocol/openid-connect/token

[dosubot[bot]]

Hey @alisharifi2000! I'm here to help you with integrating Keycloak with Superset. Let's get to the bottom of this together!

I found a similar open discussion regarding Keycloak integration with Superset, which might be helpful for your issue. The discussion titled Keycloak to superset Redirecting suggests ensuring that the OAuth2 flow is correctly configured and that the necessary permissions are granted. Here are some steps you can take to troubleshoot and resolve the issue:

1. Check Redirect URI: Ensure that the redirect_uri configured in Keycloak matches the one expected by Superset. The redirect_uri should be correctly set in both Keycloak and Superset configurations.

2. Verify OAuth2 Configuration: Make sure that the OAuth2 client configuration in Keycloak is correct. This includes the client ID, client secret, and the allowed redirect URIs.

3. Inspect Browser Console and Network Logs: Look at the browser console and network logs to see if there are any errors or warnings that can provide more details about why the sign-in request was denied.

4. Check Superset Logs: Review the Superset logs for any error messages or warnings related to the OAuth2 authentication process. This can provide more insight into what might be going wrong.

5. Ensure Correct Permissions: Verify that the user has the necessary permissions in Keycloak to access the application.

6. Cross-Origin Requests: Ensure that cross-origin requests are properly handled and that the event.origin and event.source checks in the handleMessage function are correctly validating the message source.

Additionally, a user shared a working configuration without installing any additional package such as Flask-OIDC, which might help in setting up the integration correctly ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[sfirke]

Sorry you are having trouble with this. I haven't used Keycloak myself but have you tried joining the Superset Slack chat and searching for "Keycloak" there? You might find posts from others. And if you figure this out, please post back here to answer your own question and help others that way!