[jira] [Commented] (AIRFLOW-4470) RBAC Github Enterprise OAuth provider callback URL?

["Cooper Gillan (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/AIRFLOW-4470?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17016268#comment-17016268 ] 

Cooper Gillan commented on AIRFLOW-4470:
----------------------------------------

Hello All,

We had been running into a very similar issue with Github Enterprise and RBAC. We have a minimum viable working solution now.

We updated {{airflow.cfg}} to set {{rbac = True}}, which generated the {{webserver_config.py}} file. Inside there, we set the following:

{code:python}
import os

from airflow import configuration as conf
from flask_appbuilder.security.manager import AUTH_OAUTH

basedir = os.path.abspath(os.path.dirname(__file__))

# The SQLAlchemy connection string.
SQLALCHEMY_DATABASE_URI = conf.get("core", "SQL_ALCHEMY_CONN")

# Flask-WTF flag for CSRF
CSRF_ENABLED = True

AUTH_TYPE = AUTH_OAUTH

# Will allow user self registration
AUTH_USER_REGISTRATION = True

# Uncomment to setup Full admin role name
AUTH_ROLE_ADMIN = "Admin"

# The default user self registration role
AUTH_USER_REGISTRATION_ROLE = "Admin" # Probably will want a non-admin role by default

OAUTH_PROVIDERS = [
    {
        "name": "github",
        "token_key": "access_token",
        "icon": "fa-github",
        "remote_app": {
            "base_url": "https://github.your-GHE-url-here.com/api/v3/users",
            "request_token_params": {"scope": "user"},
            "access_token_url": "/login/oauth/access_token",
            "authorize_url": "/login/oauth/authorize",
            "request_token_url": None,
            "consumer_key": "MY_GHE_CLIENT_ID",
            "consumer_secret": "MY_GHE_CLIENT_SECRET",
        },
    }
]
{code}

Then in the so-called "OAuth app" that we set up over in GHE, we set the "Authorization Callback URL" to:

{code}
http://our-airflow-url/oauth-authorized/github
{code}

One *pretty important* thing we have noticed is that the "name" value inside OAUTH_PROVIDERS *MUST BE* "github", since there is logic for this in Flask-Appbuilder: https://github.com/dpgaspar/Flask-AppBuilder/blob/49f93c78f7f4da0c2e0dcca34f2de006ffab8d26/flask_appbuilder/security/manager.py#L450

> RBAC Github Enterprise OAuth provider callback URL?
> ---------------------------------------------------
>
>                 Key: AIRFLOW-4470
>                 URL: https://issues.apache.org/jira/browse/AIRFLOW-4470
>             Project: Apache Airflow
>          Issue Type: Bug
>          Components: authentication, webserver
>    Affects Versions: 1.10.2
>            Reporter: Geez
>            Priority: Blocker
>              Labels: usability
>         Attachments: airflow_ss0_2.PNG, airflow_sso3.PNG, airflow_sso4.PNG, image-2019-10-30-16-25-14-436.png, image-2019-10-31-11-47-04-041.png
>
>
> Hi all,
> Quick question, when using RBAC with OAuth providers (1.10.2):
>  * we are not specifying the {{authenticate}} or {{auth_backend}} in the [webserver] section of \{{airflow.cfg}}anymore
>  * Instead, we set the OAuth provider config in the flask-appbuilder's {{webserver_config.py}}:
> {code:java}
>  
> # Adapting Google OAuth example to Github:
> OAUTH_PROVIDERS = [
>     {'name':'github', 'icon':'fa-github', 'token_key':'access_token',
>          'remote_app': {
>             'base_url':'https://github.corporate-domain.com/login',
>             'access_token_url':'https://github.corporate-domain.com/login/oauth/access_token',
>             'authorize_url':'https://github.corporate-domain.com/login/oauth/authorize',
>             'request_token_url': None,
>             'consumer_key': 'XXXXXXXXXXXX',
>             'consumer_secret': 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
>          }
>     }
> ]
>  
> {code}
>  _Question:_
>  * so what callback URL do we specify in the app? {{http:/webapp/ghe_oauth/callback}} would not work right? (example with github entreprise)
> No matter what I specify for the callback url (/ghe_oauth/callback or [http://webapp.com|http://webapp.com/]), I get an error message about {{redirect_uri}} mismatch:
> {code:java}
> {{error=redirect_uri_mismatch&error_description=The+redirect_uri+MUST+match+the+registered+callback+URL+for+this+application }}{code}
> _Docs ref:_
>  Here is how you setup OAuth with Github Entreprise on Airflow _*without*_ RBAC: [https://airflow.apache.org/security.html#github-enterprise-ghe-authentication]
> And here is how you setup OAuth via the {{webserver_config.py}} of flask_appbuilder used by airflow _*with*_RBAC:
>  [https://flask-appbuilder.readthedocs.io/en/latest/security.html#authentication-oauth]
> What's the *callback url* when using RBAC and OAuth with Airflow?



--
This message was sent by Atlassian Jira
(v8.3.4#803005)