HemTech opened a new issue, #44132:
URL: https://github.com/apache/superset/issues/44132
### Bug description
We are new to Superset embedding and would appreciate some guidance on the
recommended authentication approach for our use case.
Our current setup
We have:
• An Angular application that is our core operational application.
• Apache Superset for reporting and dashboards.
• Both applications use ZITADEL as the authentication/SSO provider.
• Both applications are configured under the same ZITADEL project.
Currently, we have a link in our Angular application that opens the Superset
dashboard in a separate browser tab.
Because both applications use the same ZITADEL project/SSO configuration,
users who are already authenticated in our Angular application can access
Superset without being prompted to log in again. We achieved this with a minor
customization to the authentication process in
superset_config.py/superset_server.py.
Our goal: Embed Superset in Angular
We now want to embed Superset dashboards directly inside our Angular
application using Superset’s embedded dashboard functionality.
From our understanding, embedding requires a guest token.
Our current flow is approximately:
1. The user logs into our Angular application using ZITADEL.
2. The Angular application has the user’s ZITADEL access token.
3. Our backend calls:
POST /api/v1/security/login
using a Superset service account to obtain a Superset access token.
4. We then call:
GET /api/v1/security/csrf_token
using the Superset access token to obtain a CSRF token.
5. We use this authentication context to generate the guest token for the
embedded dashboard.
This works, but it requires us to use a Superset service account.
Our question
Since the user is already authenticated in our host Angular application, and
both Angular and Superset use the same ZITADEL SSO provider and project, is
there a way to use the user’s existing ZITADEL access token directly with
Superset’s authentication/guest-token flow?
For example, could we pass the user’s ZITADEL access token to:
/api/v1/security/csrf_token
or otherwise exchange/validate the ZITADEL token with Superset and generate
the required guest token?
We tried passing the host application’s ZITADEL access token to the
csrf_token endpoint, but Superset returned a Bad Request.
What we are trying to avoid
Ideally, we would like to avoid using a Superset service account solely for
generating guest tokens.
Our desired flow would be something like:
User
|
| Login
v
ZITADEL
|
| Access Token
v
Angular Application
|
| Existing user authentication
v
Superset Embedded Dashboard
Rather than:
User
|
| Login
v
ZITADEL
|
v
Angular Application
|
| Request guest token
v
Backend / Service Account
|
| Superset login
v
Superset Access Token
|
| CSRF Token
v
Guest Token
|
v
Embedded Dashboard
Questions
1. Is it possible to use the existing ZITADEL access token to
authenticate/authorize the user with Superset for an embedded dashboard?
2. If not, is there a recommended way to integrate ZITADEL with Superset’s
embedded dashboard authentication without using a Superset service account?
3. Is the guest-token approach intentionally designed to require a
backend/service account, or are we missing an alternative authentication flow?
4. If using the same ZITADEL project/SSO provider does not help with
embedded dashboards, could someone explain why? We understand that SSO and
Superset guest-token authentication may be separate mechanisms, but we would
like to understand the recommended architecture.
5. What would be the recommended architecture for securely embedding
Superset dashboards into an Angular application where the user is already
authenticated through ZITADEL?
We would appreciate any guidance, examples, or references to the recommended
approach.
We are relatively new to Superset embedding, so apologies if we are
misunderstanding how the authentication flow is intended to work.
Thank you!
### Screenshots/recordings
_No response_
### Superset version
master / latest-dev
### Python version
3.11
### Node version
16
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [ ] I have searched Superset docs and Slack and didn't find a solution to
my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug
report.
- [ ] I have checked Superset's logs for errors and if I found a relevant
Python stacktrace, I included it here as text in the "additional context"
section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
