You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "kerem-coemert (via GitHub)" <gi...@apache.org> on 2025/05/19 11:44:40 UTC
[D] Keycloak Security Manager CSRF Warning [superset]
GitHub user kerem-coemert created a discussion: Keycloak Security Manager CSRF Warning
I am using Keycloak to login, and as per the docs I have `keycloak_security_manager.py`:
```python
from flask import redirect, request
from flask_appbuilder.security.manager import AUTH_OID
from superset.security import SupersetSecurityManager
from flask_oidc import OpenIDConnect
from flask_appbuilder.security.views import AuthOIDView
from flask_login import login_user
from urllib.parse import quote
from flask_appbuilder.views import ModelView, SimpleFormView, expose
import logging
import urllib.parse
logging.debug("OIDC Security Manager loaded")
print("OIDC Security Manager loaded")
class OIDCSecurityManager(SupersetSecurityManager):
def __init__(self, appbuilder):
super(OIDCSecurityManager, self).__init__(appbuilder)
if self.auth_type == AUTH_OID:
self.oid = OpenIDConnect(self.appbuilder.get_app)
self.authoidview = AuthOIDCView
class AuthOIDCView(AuthOIDView):
@expose("/login/", methods=["GET", "POST"])
def login(self, flag=True):
sm = self.appbuilder.sm
oidc = sm.oid
@self.appbuilder.sm.oid.require_login
def handle_login():
user = sm.auth_user_oid(oidc.user_getfield("email"))
logging.debug("handling login for {user}")
if user is None:
info = oidc.user_getinfo(
["preferred_username", "given_name", "family_name", "email"]
)
user = sm.add_user(
info.get("preferred_username"),
info.get("given_name"),
info.get("family_name"),
info.get("email"),
sm.find_role("Gamma"),
)
print(f"User: {user}")
login_user(user, remember=False)
return redirect(self.appbuilder.get_url_for_index)
return handle_login()
@expose("/logout/", methods=["GET", "POST"])
def logout(self):
oidc = self.appbuilder.sm.oid
oidc.logout()
super(AuthOIDCView, self).logout()
redirect_url = urllib.parse.quote_plus(
request.url_root.strip("/") + self.appbuilder.get_url_for_login
)
return redirect(
oidc.client_secrets.get("issuer")
+ "/protocol/openid-connect/logout?client_id="
+ oidc.client_secrets.get("client_id")
+ "&post_logout_redirect_uri="
+ quote(redirect_url)
)
```
and my `superset_config.py` has:
```python
from keycloak_security_manager import OIDCSecurityManager
CUSTOM_SECURITY_MANAGER = OIDCSecurityManager
OIDC_CLIENT_SECRETS = curr + '/docker/pythonpath_dev/client_secret.json' # '/app/superset/client_secret.json' # './client_secret.json'
OIDC_ID_TOKEN_COOKIE_SECURE = False
OIDC_OPENID_REALM = 'XX'
OIDC_INTROSPECTION_AUTH_METHOD = 'client_secret_post'
OIDC_TOKEN_TYPE_HINT ='access_token'
OPENID_PROVIDERS = [
{ 'name': 'nwa-keycloak', 'url': 'example.com/auth/realms/XX/account' },
]
```
among other variables.
When I go to the superset frontend at port `8088`, I can see keycloak's login page. After logging in, I see from keycloak logs that the login looks successful, but from the frontend I see:
```
{
"errors": [
{
"message": "401 Unauthorized: mismatching_state: CSRF Warning! State not equal in request and response.",
"error_type": "GENERIC_BACKEND_ERROR",
"level": "error",
"extra": {
"issue_codes": [
{
"code": 1011,
"message": "Issue 1011 - Superset encountered an unexpected error."
}
]
}
}
]
}
```
The superset logs show:
```
superset_app | ERROR:flask_oidc.views:Could not get the access token
superset_app | Traceback (most recent call last):
superset_app | File "/app/.venv/lib/python3.11/site-packages/flask_oidc/views.py", line 60, in authorize_view
superset_app | token = g._oidc_auth.authorize_access_token()
superset_app | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
superset_app | File "/app/.venv/lib/python3.11/site-packages/authlib/integrations/flask_client/apps.py", line 105, in authorize_access_token
superset_app | params = self._format_state_params(state_data, params)
superset_app | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
superset_app | File "/app/.venv/lib/python3.11/site-packages/authlib/integrations/base_client/sync_app.py", line 260, in _format_state_params
superset_app | raise MismatchingStateError()
superset_app | authlib.integrations.base_client.errors.MismatchingStateError: mismatching_state: CSRF Warning! State not equal in request and response.
superset_app | WARNING:superset.views.error_handling:HTTPException
superset_app | Traceback (most recent call last):
superset_app | File "/app/.venv/lib/python3.11/site-packages/flask_oidc/views.py", line 60, in authorize_view
superset_app | token = g._oidc_auth.authorize_access_token()
superset_app | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
superset_app | File "/app/.venv/lib/python3.11/site-packages/authlib/integrations/flask_client/apps.py", line 105, in authorize_access_token
superset_app | params = self._format_state_params(state_data, params)
superset_app | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
superset_app | File "/app/.venv/lib/python3.11/site-packages/authlib/integrations/base_client/sync_app.py", line 260, in _format_state_params
superset_app | raise MismatchingStateError()
superset_app | authlib.integrations.base_client.errors.MismatchingStateError: mismatching_state: CSRF Warning! State not equal in request and response.
superset_app |
superset_app | During handling of the above exception, another exception occurred:
superset_app |
superset_app | Traceback (most recent call last):
superset_app | File "/app/.venv/lib/python3.11/site-packages/flask/app.py", line 1484, in full_dispatch_request
superset_app | rv = self.dispatch_request()
superset_app | ^^^^^^^^^^^^^^^^^^^^^^^
superset_app | File "/app/.venv/lib/python3.11/site-packages/flask/app.py", line 1469, in dispatch_request
superset_app | return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
superset_app | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
superset_app | File "/app/.venv/lib/python3.11/site-packages/flask_oidc/views.py", line 63, in authorize_view
superset_app | abort(401, str(e))
superset_app | File "/app/.venv/lib/python3.11/site-packages/flask/helpers.py", line 277, in abort
superset_app | current_app.aborter(code, *args, **kwargs)
superset_app | File "/app/.venv/lib/python3.11/site-packages/werkzeug/exceptions.py", line 876, in __call__
superset_app | raise self.mapping[code](*args, **kwargs)
superset_app | werkzeug.exceptions.Unauthorized: 401 Unauthorized: mismatching_state: CSRF Warning! State not equal in request and response.
superset_app | INFO:werkzeug:10.212.134.203 - - [19/May/2025 11:38:07] "GET /authorize?state=1Sdm6jF62Sp5fdfvYivC1nLTRQOljx&session_state=28ca39ab-86a7-49ec-aed3-79bd10c58c65&iss=https://gpu-1.semanticedge.de/realms/NWA&code=9923cb98-06d6-4743-b42e-d2723e6451be.28ca39ab-86a7-49ec-aed3-79bd10c58c65.41c5b93a-03b1-4134-9b7b-b065592fcb88 HTTP/1.1" 401 -
```
Any help is much appreciated.
GitHub link: https://github.com/apache/superset/discussions/33511
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Keycloak Security Manager CSRF Warning [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Keycloak Security Manager CSRF Warning
<!-- Answer -->
I found a similar unresolved discussion regarding the "mismatching_state: CSRF Warning! State not equal in request and response" error in the context of Single Sign-On with OAuth <sup>[[1]](https://github.com/apache/superset/discussions/31440)</sup>. Unfortunately, the thread does not provide a solution, but it might be helpful to review it for any additional insights or shared experiences.
The "mismatching_state" error typically occurs when the state parameter used in the OAuth or OpenID Connect flow does not match between the request and response. This can be due to several reasons, such as:
1. **State Parameter Misconfiguration**: Ensure that the state parameter is correctly generated and validated. It should be unique for each authentication request and stored securely.
2. **Session Management Issues**: Verify that the session handling is consistent and that the state parameter is stored and retrieved correctly during the authentication process.
3. **Network or Proxy Interference**: Check if any network configurations, proxies, or load balancers might be altering the state parameter or interfering with the request/response flow.
4. **Cross-Origin Resource Sharing (CORS)**: Ensure that CORS settings are correctly configured to allow requests between your application and the Keycloak server.
Reviewing these areas might help identify the root cause of the issue. If the problem persists, consider checking the configuration of the `flask_oidc` library and how it handles the state parameter during the authentication flow.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=8f84306a-7a36-4286-bda0-46b0f98beda4) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/33511#discussioncomment-13192841
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Keycloak Security Manager CSRF Warning [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Keycloak Security Manager CSRF Warning
<!-- Answer -->
I found a similar unresolved discussion regarding the "mismatching_state: CSRF Warning! State not equal in request and response" error in the context of Single Sign-On with OAuth <sup>[[1]](https://github.com/apache/superset/discussions/31440)</sup>. Unfortunately, the thread does not provide a solution, but it might be helpful to review it for any additional insights or shared experiences.
The "mismatching_state" error typically occurs when the state parameter used in the OAuth or OpenID Connect flow does not match between the request and response. This can be due to several reasons, such as:
1. **State Parameter Misconfiguration**: Ensure that the state parameter is correctly generated and validated. It should be unique for each authentication request and stored securely.
2. **Session Management Issues**: Verify that the session handling is consistent and that the state parameter is stored and retrieved correctly during the authentication process.
3. **Network or Proxy Interference**: Check if any network configurations, proxies, or load balancers might be altering the state parameter or interfering with the request/response flow.
4. **Cross-Origin Resource Sharing (CORS)**: Ensure that CORS settings are correctly configured to allow requests between your application and the Keycloak server.
Reviewing these areas might help identify the root cause of the issue. If the problem persists, consider checking the configuration of the `flask_oidc` library and how it handles the state parameter during the authentication flow.
<!-- Dosu Comment Footer -->
*To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
---
<sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/8f84306a-7a36-4286-bda0-46b0f98beda4?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/8f84306a-7a36-4286-bda0-46b0f98beda4?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/8f84306a-7a36-4286-bda0-46b0f98beda4?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/8f84306a-7a36-4286-bda0-46b0f98beda4?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/8f84306a-7a36-4286-bda0-46b0f98beda4?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/8f84306a-7a36-4286-bda0-46b0f98beda4?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/8f84306a-7a36-4286-bda0-46b0f98beda4?feedback_type=other)</sup>
GitHub link: https://github.com/apache/superset/discussions/33511#discussioncomment-13192841
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org