You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "datasc24 (via GitHub)" <gi...@apache.org> on 2026/04/22 10:12:47 UTC
[D] How to connect to databases via Oauth2 using user's token? [superset]
GitHub user datasc24 created a discussion: How to connect to databases via Oauth2 using user's token?
Hello,
We are trying to connect to Trino from Superset using Oauth2 authentification and i wan't to use the token from the connected user to Trino.
Is it possible ? How to achieve it ?
GitHub link: https://github.com/apache/superset/discussions/39558
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to connect to databases via Oauth2 using user's token? [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: How to connect to databases via Oauth2 using user's token?
<!-- Answer -->
Yes, Superset supports OAuth2 authentication for Trino database connections, and there are two approaches to pass a user's token to Trino:
**Approach 1: Per-Database OAuth2 (available now)**
Superset has built-in per-user, per-database OAuth2 token management. You configure OAuth2 clients in `superset_config.py` [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py#L1604-L1631):
```python
DATABASE_OAUTH2_CLIENTS = {
"trino": {
"client_id": "...",
"client_secret": "...",
"authorization_uri": "...",
"token_uri": "...",
"scope": "..."
}
}
```
With this setup, users go through an OAuth2 dance when they first query Trino. Superset stores the token (encrypted) per user and automatically refreshes it when expired [[2]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/utils/oauth2.py#L48-L84). The Trino engine spec passes the token as a Bearer header via a custom HTTP session [[3]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/db_engine_specs/trino.py#L133-L151).
**Approach 2: Upstream OAuth Token Forwarding (reuse Superset login token)**
This is the approach that directly answers your question — reusing the token from the user's Superset login. It requires two config changes [[4]](https://github.com/apache/superset/pull/38469):
1. Add `"save_token": True` to your OAuth provider and include the Trino scope:
```python
OAUTH_PROVIDERS = [
{
"name": "keycloak",
"save_token": True,
"remote_app": {
"client_id": "...",
"client_secret": "...",
"client_kwargs": {
"scope": "openid profile email offline_access superset trino"
},
...
},
}
]
```
2. Map the database to the upstream provider:
```python
DATABASE_OAUTH2_UPSTREAM_PROVIDERS = {"trino": "keycloak"}
```
When a user logs into Superset via OAuth, the token is saved and automatically reused for Trino connections — no second OAuth flow needed. The `offline_access` scope is important for obtaining refresh tokens so they can be refreshed automatically.
Note that this upstream token forwarding feature was introduced in [PR #38469](https://github.com/apache/superset/pull/38469) [[5]](https://github.com/apache/superset/pull/38469). You'll also need to ensure your Trino coordinator is configured to accept OAuth2 tokens with the matching issuer, client ID, and scopes [[6]](https://github.com/apache/superset/pull/38469#L8-L15).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset#message_id=7c6d5b5a-98a9-4739-a042-d053424df5ff) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/39558#discussioncomment-16668957
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org