You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "miguel-saca (via GitHub)" <gi...@apache.org> on 2025/01/13 19:36:44 UTC
[PR] feat(auth): integrate Keycloak authentication with SLO and configurable user roles [superset]
miguel-saca opened a new pull request, #31821:
URL: https://github.com/apache/superset/pull/31821
### SUMMARY
This PR integrates Keycloak authentication into Superset. The changes include:
- Modification of configuration files in `docker/pythonpath_dev/` (i.e. `superset_config.py` and `keycloak_security_manager.py`) to support Keycloak integration.
- Implementation of Single Logout (SLO) by retrieving the ID token after authentication and using it during logout.
- Adjustment of new user role assignment: Instead of hardcoding the role to "Gamma", new users are now assigned the role defined in the environment variable `AUTH_USER_REGISTRATION_ROLE`. This allows production settings (e.g., setting `AUTH_USER_REGISTRATION_ROLE=Admin`) to be used without changing code.
- Updates to various Docker Compose manifests (`docker-compose.yml`, `docker-compose-non-dev.yml`, and `docker-compose-image-tag.yml`) and the `.env` file to properly reflect the changes for production deployment.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
_N/A (no UI changes)_
### TESTING INSTRUCTIONS
1. Run `pre-commit run --all-files` locally to ensure no linting or type-check errors occur.
2. Using the development environment:
- Spin up the Superset stack via `docker-compose -f docker-compose-image-tag.yml up -d`.
- Authenticate through Keycloak and verify that:
- Upon first login, the new user is created with the role defined in the `AUTH_USER_REGISTRATION_ROLE` environment variable.
- The ID token is correctly stored in the session and used during logout.
- Logout correctly logs the user out on both Superset and Keycloak (i.e., the session is cleared).
3. Verify logs and check that the application behaves as expected regarding role assignment and logout flow.
### ADDITIONAL INFORMATION
- [ ] Has associated issue: _<if applicable, include issue reference, e.g., Fixes #123>_
- [ ] Required feature flags: _None_
- [ ] Changes UI: _No_
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)):
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API: _Yes – Keycloak integration with Single Logout and configurable role assignment_
- [ ] Removes existing feature or API: _No_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(auth): integrate Keycloak authentication with SLO and configurable user roles [superset]
Posted by "korbit-ai[bot] (via GitHub)" <gi...@apache.org>.
korbit-ai[bot] commented on code in PR #31821:
URL: https://github.com/apache/superset/pull/31821#discussion_r1913720436
##########
docker/pythonpath_dev/superset_config.py:
##########
@@ -120,3 +122,31 @@ class CeleryConfig:
)
except ImportError:
logger.info("Using default Docker config...")
+
+# Basic secret key
+SECRET_KEY = os.getenv("SECRET_KEY", "your-constant-secret-key")
+ENCRYPTION_KEY = os.getenv("ENCRYPTION_KEY", "your-constant-encryption-key")
Review Comment:
### Hardcoded secret and encryption keys found. <sub></sub>
<details>
<summary>Tell me more</summary>
​
Security Issue: Hardcoded Secret Key and Encryption Key
The `SECRET_KEY` and `ENCRYPTION_KEY` are hardcoded with default values in the `superset_config.py` file. Hardcoding sensitive information like secret keys is a security risk because if the codebase is compromised, an attacker can easily obtain these keys and use them for malicious purposes.
To resolve this issue, remove the hardcoded default values and ensure the secret key and encryption key are loaded from environment variables or a secure secrets management system at runtime. Do not commit the actual key values in the codebase.
</details>
###### Chat with Korbit by mentioning @korbit-ai, and give a 👍 or 👎 to help Korbit improve your reviews.
<!--- korbi internal id:b613949a-7258-448f-85e2-9edb52461d2c -->
##########
docker/pythonpath_dev/superset_config.py:
##########
@@ -120,3 +122,31 @@ class CeleryConfig:
)
except ImportError:
logger.info("Using default Docker config...")
+
+# Basic secret key
+SECRET_KEY = os.getenv("SECRET_KEY", "your-constant-secret-key")
+ENCRYPTION_KEY = os.getenv("ENCRYPTION_KEY", "your-constant-encryption-key")
+
+# ------------------------------------------------------------------------------
+# Keycloak (OpenID Connect) authentication config and other settings...
+# ------------------------------------------------------------------------------
+AUTH_TYPE = AUTH_OID
+OIDC_CLIENT_SECRETS = "/app/docker/pythonpath_dev/client_secret.json"
Review Comment:
### Non-configurable OIDC Client Secrets Path <sub></sub>
<details>
<summary>Tell me more</summary>
###### What is the issue?
Hardcoded path to client secrets file could cause authentication failures if the file location changes or in different environments.
###### Why this matters
A non-configurable secrets file location reduces deployment flexibility and could break authentication if the file is stored elsewhere.
###### Suggested change ∙ *Feature Preview*
Make the client secrets path configurable via environment variable:
```python
OIDC_CLIENT_SECRETS = os.getenv("OIDC_CLIENT_SECRETS", "/app/docker/pythonpath_dev/client_secret.json")
```
</details>
###### Chat with Korbit by mentioning @korbit-ai, and give a 👍 or 👎 to help Korbit improve your reviews.
<!--- korbi internal id:d1a73307-e35b-4e2e-bcd0-28afb9d4b201 -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(auth): integrate Keycloak authentication with SLO and configurable user roles [superset]
Posted by "miguel-saca (via GitHub)" <gi...@apache.org>.
miguel-saca closed pull request #31821: feat(auth): integrate Keycloak authentication with SLO and configurable user roles
URL: https://github.com/apache/superset/pull/31821
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org