2

I'm trying to enable authentication in Apache SuperSet through Oauth2.

It shoud be straightforward due to the fact that it's built upon Flask AppBuilder which supports OAuth and is extremely easy to setup and use.

I managed to make both the following examples work seamlessy with Twitter Oauth configuration:

  1. FAB OAuth example
  2. flask-oauthlib examples

Now I'm trying to apply the same configuration to SuperSet.

Docker

As I can't manually build the project for several mysterious python errors (tried on Windows 7/Ubuntu Linux and with Python versions 2.7 and 3.6), I decided to use this Superset docker image (that installs and works fine) and inject my configuration as suggested by docs:

Follow the instructions provided by Apache Superset for writing your own superset_config.py. Place this file in a local directory and mount this directory to /home/superset/.superset inside the container.

I added a superset_config.py (in a folder and alone) and mounted it by adding to the Dockerfile the following:

ADD config .superset/config

(config is the name of the folder) or (for the single file):

COPY superset_config.py .superset

In both cases the files end up in the right place in the container (I check with docker exec /bin/bash) but the web application shows no difference: no traces of Twitter authentication.

Can somebody figure out what I am doing wrong?

dmigo
  • 2,849
  • 4
  • 41
  • 62
Linuslabo
  • 1,568
  • 2
  • 24
  • 34

2 Answers2

5

You have to change the superset_config.py. Look at this example config, it works for me.

import os
from flask_appbuilder.security.manager import AUTH_OID, 
AUTH_REMOTE_USER, 
AUTH_DB, AUTH_LDAP, AUTH_OAUTH
basedir = os.path.abspath(os.path.dirname(__file__))
ROW_LIMIT = 5000
SUPERSET_WORKERS = 4
SECRET_KEY = 'a long and random secret key'
SQLALCHEMY_DATABASE_URI = ‘postgresql://username:pass@host:port/dbname’
CSRF_ENABLED = True
AUTH_TYPE = AUTH_OAUTH
AUTH_USER_REGISTRATION = True
AUTH_USER_REGISTRATION_ROLE = "Public"
OAUTH_PROVIDERS = [
    {
       'name': 'google',
       'whitelist': ['@company.com'],
   'icon': 'fa-google',
   'token_key': 'access_token', 
   'remote_app': {
        'base_url': 'https://www.googleapis.com/oauth2/v2/',
        'request_token_params': {
              'scope': 'email profile'
            },
        'request_token_url': None,
        'access_token_url':         
        'https://accounts.google.com/o/oauth2/token',
        'authorize_url': 'https://accounts.google.com/o/oauth2/auth',
        'consumer_key': 'GOOGLE_AUTH_KEY',
        'consumer_secret': 'GOOGLE_AUTH_SECRET'
          }
       }
]
ankur09011
  • 453
  • 3
  • 12
2

2021 update: The FAB OAuth provider schema seems like it changed a bit since this answer. If you're trying to do this with Superset >= 1.1.0, try this instead:

OAUTH_PROVIDERS = [
    {
        'name': 'google',
        'icon': 'fa-google',
        'token_key': 'access_token',
        'remote_app': {
            'client_id': 'GOOGLE_KEY',
            'client_secret': 'GOOGLE_SECRET',
            'api_base_url': 'https://www.googleapis.com/oauth2/v2/',
            'client_kwargs':{
              'scope': 'email profile'
            },
            'request_token_url': None,
            'access_token_url': 'https://accounts.google.com/o/oauth2/token',
            'authorize_url': 'https://accounts.google.com/o/oauth2/auth'
        }
    }
]

Of course, sub out GOOGLE_KEY and GOOGLE_SECRET. The rest should be fine. This was cribbed from the FAB security docs for the next time there is drift.

hert
  • 1,012
  • 8
  • 16