-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #222 from jembi/PLAT-642-keycloak-sso-superset
PLAT-642 Add keycloak SSO Superset
- Loading branch information
Showing
15 changed files
with
331 additions
and
127 deletions.
There are no files selected for viewing
12 changes: 12 additions & 0 deletions
12
dashboard-visualiser-superset/config/client_secret_env.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| { | ||
| "web": { | ||
| "issuer": "${KC_FRONTEND_URL}/realms/${KC_REALM_NAME}", | ||
| "auth_uri": "${KC_FRONTEND_URL}/realms/${KC_REALM_NAME}/protocol/openid-connect/auth", | ||
| "client_id": "${KC_SUPERSET_CLIENT_ID}", | ||
| "client_secret": "${KC_SUPERSET_CLIENT_SECRET}", | ||
| "redirect_uris": ["${SUPERSET_SERVER_ROOT_URL}/*"], | ||
| "userinfo_uri": "${KC_API_URL}/realms/${KC_REALM_NAME}/protocol/openid-connect/userinfo", | ||
| "token_uri": "${KC_API_URL}/realms/${KC_REALM_NAME}/protocol/openid-connect/token", | ||
| "token_introspection_uri": "${KC_API_URL}/realms/${KC_REALM_NAME}/protocol/openid-connect/token/introspect" | ||
| } | ||
| } |
59 changes: 59 additions & 0 deletions
59
dashboard-visualiser-superset/config/keycloack_security_manager.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| from flask import redirect, request | ||
| from flask_appbuilder.security.manager import AUTH_OID | ||
| from superset.security import SupersetSecurityManager | ||
| from flask_oidc import OpenIDConnect | ||
| from flask_appbuilder.security.views import AuthOIDView | ||
| from flask_login import login_user | ||
| from urllib.parse import quote | ||
| from flask_appbuilder.views import ModelView, SimpleFormView, expose | ||
| import urllib.parse | ||
|
|
||
| class OIDCSecurityManager(SupersetSecurityManager): | ||
|
|
||
| def __init__(self, appbuilder): | ||
| super(OIDCSecurityManager, self).__init__(appbuilder) | ||
| if self.auth_type == AUTH_OID: | ||
| self.oid = OpenIDConnect(self.appbuilder.get_app) | ||
| self.authoidview = AuthOIDCView | ||
|
|
||
| class AuthOIDCView(AuthOIDView): | ||
|
|
||
| @expose('/login/', methods=['GET', 'POST']) | ||
| def login(self, flag=True): | ||
| sm = self.appbuilder.sm | ||
| oidc = sm.oid | ||
|
|
||
| @self.appbuilder.sm.oid.require_login | ||
| def handle_login(): | ||
| user = sm.auth_user_oid(oidc.user_getfield('email')) | ||
|
|
||
| if user is None: | ||
| info = oidc.user_getinfo(['preferred_username', 'given_name', 'family_name', 'email']) | ||
| firstname = "" | ||
| lastname = "" | ||
| if not info.get('given_name'): | ||
| firstname = info.get('preferred_username') | ||
| else: | ||
| firstname = info.get('given_name') | ||
| if not info.get('family_name'): | ||
| lastname = info.get('preferred_username') | ||
| else: | ||
| lastname = info.get('family_name') | ||
| user = sm.add_user(info.get('preferred_username'), firstname, lastname, | ||
| info.get('email'), sm.find_role('Admin')) | ||
|
|
||
| login_user(user, remember=False) | ||
| return redirect(self.appbuilder.get_url_for_index) | ||
|
|
||
| return handle_login() | ||
|
|
||
| @expose('/logout/', methods=['GET', 'POST']) | ||
| def logout(self): | ||
| oidc = self.appbuilder.sm.oid | ||
|
|
||
| oidc.logout() | ||
| super(AuthOIDCView, self).logout() | ||
| redirect_url = urllib.parse.quote_plus(request.url_root.strip('/') + self.appbuilder.get_url_for_login) | ||
|
|
||
| return redirect( | ||
| oidc.client_secrets.get('issuer') + '/protocol/openid-connect/logout?client_id=' + oidc.client_secrets.get('client_id') + '&post_logout_redirect_uri=' + quote(redirect_url)) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -12,6 +12,15 @@ | |
| "SUPERSET_EMAIL": "[email protected]", | ||
| "SUPERSET_PASSWORD": "admin", | ||
| "SUPERSET_CONFIG_FILE": "superset-export.zip", | ||
| "SUPERSET_SSL": "false" | ||
| "SUPERSET_SSL": "false", | ||
| "SUPERSET_SECRET_KEY": "87SLdhp3Z/4+eiVCh8zg4kyYSsAKMH0glBS+VBJoEiGghTByAKC/qwVw", | ||
| "KC_SUPERSET_SSO_ENABLED": "false", | ||
| "KC_SUPERSET_CLIENT_ID": "superset-oauth", | ||
| "KC_SUPERSET_CLIENT_SECRET": "g0J7oLbX69dL3CS8HVjRYlhRYVsPoDbQ", | ||
| "KC_REALM_NAME": "platform-realm", | ||
| "KC_FRONTEND_URL": "http://localhost:9088", | ||
| "KC_API_URL": "http://identity-access-manager-keycloak:8080", | ||
| "AUTH_USER_REGISTRATION_ROLE": "Admin", | ||
| "SUPERSET_SERVER_ROOT_URL": "http://localhost:8089" | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| { | ||
| "clientId": "${KC_GRAFANA_CLIENT_ID}", | ||
| "name": "grafana", | ||
| "description": "", | ||
| "rootUrl": "${KC_GRAFANA_ROOT_URL}", | ||
| "adminUrl": "${KC_GRAFANA_ROOT_URL}", | ||
| "baseUrl": "${KC_GRAFANA_ROOT_URL}", | ||
| "surrogateAuthRequired": false, | ||
| "enabled": true, | ||
| "alwaysDisplayInConsole": false, | ||
| "clientAuthenticatorType": "client-secret", | ||
| "secret": "${KC_GRAFANA_CLIENT_SECRET}", | ||
| "redirectUris": ["${KC_GRAFANA_ROOT_URL}/login/generic_oauth"], | ||
| "webOrigins": ["${KC_GRAFANA_ROOT_URL}"], | ||
| "notBefore": 0, | ||
| "bearerOnly": false, | ||
| "consentRequired": false, | ||
| "standardFlowEnabled": true, | ||
| "implicitFlowEnabled": false, | ||
| "directAccessGrantsEnabled": true, | ||
| "serviceAccountsEnabled": false, | ||
| "publicClient": false, | ||
| "frontchannelLogout": true, | ||
| "protocol": "openid-connect", | ||
| "attributes": { | ||
| "oidc.ciba.grant.enabled": "false", | ||
| "client.secret.creation.time": "1672390081", | ||
| "backchannel.logout.session.required": "true", | ||
| "oauth2.device.authorization.grant.enabled": "false", | ||
| "display.on.consent.screen": "false", | ||
| "backchannel.logout.revoke.offline.tokens": "false" | ||
| }, | ||
| "authenticationFlowBindingOverrides": {}, | ||
| "fullScopeAllowed": true, | ||
| "nodeReRegistrationTimeout": -1, | ||
| "defaultClientScopes": ["web-origins", "acr", "roles", "profile", "email"], | ||
| "optionalClientScopes": [ | ||
| "address", | ||
| "phone", | ||
| "offline_access", | ||
| "microprofile-jwt" | ||
| ], | ||
| "access": { | ||
| "view": true, | ||
| "configure": true, | ||
| "manage": true | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| { | ||
| "clientId": "${KC_JEMPI_CLIENT_ID}", | ||
| "name": "JeMPI", | ||
| "description": "", | ||
| "rootUrl": "${KC_JEMPI_ROOT_URL}", | ||
| "adminUrl": "${KC_JEMPI_ROOT_URL}", | ||
| "baseUrl": "${KC_JEMPI_ROOT_URL}", | ||
| "surrogateAuthRequired": false, | ||
| "enabled": true, | ||
| "alwaysDisplayInConsole": false, | ||
| "clientAuthenticatorType": "client-secret", | ||
| "secret": "${KC_JEMPI_CLIENT_SECRET}", | ||
| "redirectUris": ["${KC_JEMPI_ROOT_URL}/login"], | ||
| "webOrigins": ["${KC_JEMPI_ROOT_URL}"], | ||
| "notBefore": 0, | ||
| "bearerOnly": false, | ||
| "consentRequired": false, | ||
| "standardFlowEnabled": true, | ||
| "implicitFlowEnabled": false, | ||
| "directAccessGrantsEnabled": true, | ||
| "serviceAccountsEnabled": false, | ||
| "publicClient": false, | ||
| "frontchannelLogout": true, | ||
| "protocol": "openid-connect", | ||
| "attributes": { | ||
| "oidc.ciba.grant.enabled": "false", | ||
| "client.secret.creation.time": "1674028783", | ||
| "backchannel.logout.session.required": "true", | ||
| "post.logout.redirect.uris": "${KC_JEMPI_ROOT_URL}", | ||
| "display.on.consent.screen": "false", | ||
| "oauth2.device.authorization.grant.enabled": "false", | ||
| "backchannel.logout.revoke.offline.tokens": "false" | ||
| }, | ||
| "authenticationFlowBindingOverrides": {}, | ||
| "fullScopeAllowed": true, | ||
| "nodeReRegistrationTimeout": -1, | ||
| "defaultClientScopes": ["web-origins", "acr", "roles", "profile", "email"], | ||
| "optionalClientScopes": [ | ||
| "address", | ||
| "phone", | ||
| "offline_access", | ||
| "microprofile-jwt" | ||
| ], | ||
| "access": { | ||
| "view": true, | ||
| "configure": true, | ||
| "manage": true | ||
| } | ||
| } |
Oops, something went wrong.