1

I've finally gotten Azure Single Sign-On (SSO) connected to Apache Superset running via docker-compose, following the Flask docs. Users in my company's Azure group can create and access Superset accounts by logging in with Azure and they are assigned roles based on their identity. This is good.

The usernames they get assigned, however, are long Azure ID strings. These are undesirable in displays. Here's what my account looks like on the List Users screen and on my profile:

enter image description here enter image description here

How can I modify either my Azure application SSO setup or my Superset config to have Superset populate usernames like SFirke for the account usernames, instead of values like 3ee660ff-a274 ... ?

The security part of my config.py looks like this, almost identical to the Flask template:

OAUTH_PROVIDERS = [
{
    "name": "azure",
    "icon": "fa-windows",
    "token_key": "access_token",
    "remote_app": {
        "client_id": "CLIENT_ID",
        "client_secret": "CLIENT_SECRET",
        "api_base_url": "https://login.microsoftonline.com/TENANT_ID/oauth2",
        "client_kwargs": {
            "scope": "User.read name preferred_username email profile upn groups",
            "resource": "RESOURCE_ID",
        },
        "request_token_url": None,
        "access_token_url": "https://login.microsoftonline.com/TENANT_ID/oauth2/token",
        "authorize_url": "https://login.microsoftonline.com/TENANT_ID/oauth2/authorize",
    },
},
]

EDIT: Looks like the way to go is writing a custom userinfo retrieval method, there's a template on the Flask page linked above and an example used for Superset in this Github comment. I think I would use a line like "id": me["preferred_username"] or "id": me["upn"], based on the field names in the Microsoft docs.

But Microsoft notes that this value can change over time and should not be used for authorization changes. Since the oid value is immutable, and it is hardly visible to the typical user, I plan to just stick to it.

Sam Firke
  • 21,571
  • 9
  • 87
  • 105
  • can you attach your superset config here? what do you want to show on this superset page? It's very likely that you are not passing the right field from user info in azure ad to superset. – Alex Jiang Aug 06 '22 at 20:54
  • I've added my superset config and updated the question with more research. Now I'm leaning toward just leaving this alone as not desirable. Maybe the question and any future answers will be of use to others. – Sam Firke Aug 08 '22 at 14:56

0 Answers0