You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "devikaaaa33 (via GitHub)" <gi...@apache.org> on 2025/07/23 12:59:18 UTC
[D] How to authenticate with Superset with service account [superset]
GitHub user devikaaaa33 created a discussion: How to authenticate with Superset with service account
Hi Team,
We were previously using Superset default credentials to obtain the access token and CSRF token for asset imports. Now, instead of the default credentials, we have created a service account in Zitadel, which has generated a token.
Which endpoints should we use, and how should we authenticate with Superset to perform asset imports using this token?
these were the endpoint I was using before.
curl -s -k --request POST --url "https://$APP_PREFIX.$DOMAIN/api/v1/security/login"
curl -k -s -c cookies.txt --request GET \
--url "https://$APP_PREFIX.$DOMAIN/api/v1/security/csrf_token/"
GitHub link: https://github.com/apache/superset/discussions/34278
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to authenticate with Superset with service account [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: How to authenticate with Superset with service account
<!-- Answer -->
Superset doesn't natively support authenticating API requests with external OIDC/JWT tokens like those from Zitadel. To enable this, you'll need to implement a custom SecurityManager and possibly middleware. Here’s a high-level outline of what you need to do:
1. **Create a custom SecurityManager** that extracts and validates the Bearer token from the Authorization header, verifies it using Zitadel's public keys, and maps it to a Superset user. You can do this by subclassing `SupersetSecurityManager` and overriding methods like `request_loader` or `is_user_authenticated`. See [this discussion for a similar approach](https://github.com/apache/superset/discussions/33131).
Example (simplified for illustration):
```python
# custom_security_manager.py
from superset.security import SupersetSecurityManager
from flask import request
import jwt # Use python-jose or PyJWT for JWT validation
class CustomSecurityManager(SupersetSecurityManager):
def request_loader(self, request):
auth_header = request.headers.get("Authorization")
if auth_header and auth_header.startswith("Bearer "):
token = auth_header.split(" ", 1)[1]
# Validate the JWT using Zitadel's public keys
try:
payload = jwt.decode(token, zitadel_public_key, algorithms=["RS256"], audience="your-audience")
user = self.find_user(username=payload["preferred_username"])
return user
except Exception:
return None
return None
```
2. **Configure Superset to use your custom SecurityManager** by setting `CUSTOM_SECURITY_MANAGER = CustomSecurityManager` in your `superset_config.py` file. If you need to preprocess headers or environment variables, you can also add custom middleware via the `ADDITIONAL_MIDDLEWARE` config option. See [middleware example](https://github.com/apache/superset/discussions/33131).
3. **Apply your changes**: Place your custom SecurityManager code in a Python file accessible to Superset (e.g., in your project directory), and update `superset_config.py` to import and use it.
There are no official plugins for Zitadel or generic OIDC/JWT API authentication in Superset, so this custom approach is required. For more details and community examples, see [this discussion](https://github.com/apache/superset/discussions/32038) and the [SupersetSecurityManager code](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/manager.py).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/4576260d-f1be-4170-bdc3-1bd69099ce51?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/4576260d-f1be-4170-bdc3-1bd69099ce51?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/4576260d-f1be-4170-bdc3-1bd69099ce51?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/4576260d-f1be-4170-bdc3-1bd69099ce51?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/4576260d-f1be-4170-bdc3-1bd69099ce51?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/4576260d-f1be-4170-bdc3-1bd69099ce51?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/4576260d-f1be-4170-bdc3-1bd69099ce51?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/34278)
GitHub link: https://github.com/apache/superset/discussions/34278#discussioncomment-13863861
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to authenticate with Superset with service account [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: How to authenticate with Superset with service account
<!-- Answer -->
Superset's API does not natively support authenticating with arbitrary external JWT/OIDC tokens (like those issued by Zitadel) for standard API operations such as asset imports. The default and supported approach is still to use session-based authentication: POST to `/api/v1/security/login` with the service account's username and password to obtain a session cookie, then use that cookie to GET `/api/v1/security/csrf_token/` for the CSRF token—just as you did with the default credentials.
If you want to use a Zitadel-issued token directly (for example, as a Bearer token in the Authorization header), Superset would need to be custom-configured with a custom SecurityManager and possibly middleware to validate and accept those tokens. This is an advanced setup and not part of the standard Superset configuration or documentation. There are community discussions and code examples about implementing such custom authentication flows if you want to explore that route further ([example discussion](https://github.com/apache/superset/discussions/33131)).
Unless you have already customized Superset to accept Zitadel tokens, the recommended and supported workflow is to use the service account's username/password with the login endpoint, then proceed as before for asset imports. If you do implement a custom authentication flow, ensure your token is accepted by Superset's authentication system—otherwise, requests to the CSRF endpoint will fail with an authentication error ([reference](https://github.com/apache/superset/issues/32257)).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/5751a6f2-2946-4ff2-82c7-a6ebbcd6e2c8?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5751a6f2-2946-4ff2-82c7-a6ebbcd6e2c8?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5751a6f2-2946-4ff2-82c7-a6ebbcd6e2c8?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5751a6f2-2946-4ff2-82c7-a6ebbcd6e2c8?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5751a6f2-2946-4ff2-82c7-a6ebbcd6e2c8?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5751a6f2-2946-4ff2-82c7-a6ebbcd6e2c8?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/5751a6f2-2946-4ff2-82c7-a6ebbcd6e2c8?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/34278)
GitHub link: https://github.com/apache/superset/discussions/34278#discussioncomment-13863472
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to authenticate Superset with service account [superset]
Posted by "devikaaaa33 (via GitHub)" <gi...@apache.org>.
GitHub user devikaaaa33 edited a discussion: How to authenticate Superset with service account
Hi Team,
We were previously using Superset default credentials to obtain the access token and CSRF token for asset imports. Now, instead of the default credentials, we have created a service account in Zitadel, which has generated a token.
Which endpoints should we use, and how should we authenticate with Superset to perform asset imports using this token?
these were the endpoint I was using before.
curl -s -k --request POST --url "https://$APP_PREFIX.$DOMAIN/api/v1/security/login"
curl -k -s -c cookies.txt --request GET \
--url "https://$APP_PREFIX.$DOMAIN/api/v1/security/csrf_token/"
GitHub link: https://github.com/apache/superset/discussions/34278
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to authenticate with Superset with service account [superset]
Posted by "devikaaaa33 (via GitHub)" <gi...@apache.org>.
GitHub user devikaaaa33 added a comment to the discussion: How to authenticate with Superset with service account
Hi [@dosu](https://go.dosu.dev/dosubot), Could you please provide a sample code for authenticating with a Zitadel-issued token? What changes need to be made, and where should they be applied in the Superset application?
GitHub link: https://github.com/apache/superset/discussions/34278#discussioncomment-13863830
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to authenticate Superset with service account [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: How to authenticate Superset with service account
<!-- Answer -->
Superset doesn't natively support authenticating API requests with external OIDC/JWT tokens like those from Zitadel. To enable this, you'll need to implement a custom SecurityManager and possibly middleware. Here’s a high-level outline of what you need to do:
1. **Create a custom SecurityManager** that extracts and validates the Bearer token from the Authorization header, verifies it using Zitadel's public keys, and maps it to a Superset user. You can do this by subclassing `SupersetSecurityManager` and overriding methods like `request_loader` or `is_user_authenticated`. See [this discussion for a similar approach](https://github.com/apache/superset/discussions/33131).
Example (simplified for illustration):
```python
# custom_security_manager.py
from superset.security import SupersetSecurityManager
from flask import request
import jwt # Use python-jose or PyJWT for JWT validation
class CustomSecurityManager(SupersetSecurityManager):
def request_loader(self, request):
auth_header = request.headers.get("Authorization")
if auth_header and auth_header.startswith("Bearer "):
token = auth_header.split(" ", 1)[1]
# Validate the JWT using Zitadel's public keys
try:
payload = jwt.decode(token, zitadel_public_key, algorithms=["RS256"], audience="your-audience")
user = self.find_user(username=payload["preferred_username"])
return user
except Exception:
return None
return None
```
2. **Configure Superset to use your custom SecurityManager** by setting `CUSTOM_SECURITY_MANAGER = CustomSecurityManager` in your `superset_config.py` file. If you need to preprocess headers or environment variables, you can also add custom middleware via the `ADDITIONAL_MIDDLEWARE` config option. See [middleware example](https://github.com/apache/superset/discussions/33131).
3. **Apply your changes**: Place your custom SecurityManager code in a Python file accessible to Superset (e.g., in your project directory), and update `superset_config.py` to import and use it.
There are no official plugins for Zitadel or generic OIDC/JWT API authentication in Superset, so this custom approach is required. For more details and community examples, see [this discussion](https://github.com/apache/superset/discussions/32038) and the [SupersetSecurityManager code](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/manager.py).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=4576260d-f1be-4170-bdc3-1bd69099ce51) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/34278#discussioncomment-13863861
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to authenticate Superset with service account [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: How to authenticate Superset with service account
<!-- Answer -->
Superset's API does not natively support authenticating with arbitrary external JWT/OIDC tokens (like those issued by Zitadel) for standard API operations such as asset imports. The default and supported approach is still to use session-based authentication: POST to `/api/v1/security/login` with the service account's username and password to obtain a session cookie, then use that cookie to GET `/api/v1/security/csrf_token/` for the CSRF token—just as you did with the default credentials.
If you want to use a Zitadel-issued token directly (for example, as a Bearer token in the Authorization header), Superset would need to be custom-configured with a custom SecurityManager and possibly middleware to validate and accept those tokens. This is an advanced setup and not part of the standard Superset configuration or documentation. There are community discussions and code examples about implementing such custom authentication flows if you want to explore that route further ([example discussion](https://github.com/apache/superset/discussions/33131)).
Unless you have already customized Superset to accept Zitadel tokens, the recommended and supported workflow is to use the service account's username/password with the login endpoint, then proceed as before for asset imports. If you do implement a custom authentication flow, ensure your token is accepted by Superset's authentication system—otherwise, requests to the CSRF endpoint will fail with an authentication error ([reference](https://github.com/apache/superset/issues/32257)).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=5751a6f2-2946-4ff2-82c7-a6ebbcd6e2c8) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/34278#discussioncomment-13863472
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org