GitHub user HemTech created a discussion: Can the Host Application’s SSO Access Token Be Used for Superset Embedded Guest Token Generation?
### Bug description We are new to Superset embedding and would appreciate some guidance on the recommended authentication approach for our use case. Our current setup We have: • An Angular application that is our core operational application. • Apache Superset for reporting and dashboards. • Both applications use ZITADEL as the authentication/SSO provider. • Both applications are configured under the same ZITADEL project. Currently, we have a link in our Angular application that opens the Superset dashboard in a separate browser tab. Because both applications use the same ZITADEL project/SSO configuration, users who are already authenticated in our Angular application can access Superset without being prompted to log in again. We achieved this with a minor customization to the authentication process in superset_config.py/superset_server.py. Our goal: Embed Superset in Angular We now want to embed Superset dashboards directly inside our Angular application using Superset’s embedded dashboard functionality. >From our understanding, embedding requires a guest token. Our current flow is approximately: 1. The user logs into our Angular application using ZITADEL. 2. The Angular application has the user’s ZITADEL access token. 3. Our backend calls: POST /api/v1/security/login using a Superset service account to obtain a Superset access token. 4. We then call: GET /api/v1/security/csrf_token using the Superset access token to obtain a CSRF token. 5. We use this authentication context to generate the guest token for the embedded dashboard. This works, but it requires us to use a Superset service account. Our question Since the user is already authenticated in our host Angular application, and both Angular and Superset use the same ZITADEL SSO provider and project, is there a way to use the user’s existing ZITADEL access token directly with Superset’s authentication/guest-token flow? For example, could we pass the user’s ZITADEL access token to: /api/v1/security/csrf_token or otherwise exchange/validate the ZITADEL token with Superset and generate the required guest token? We tried passing the host application’s ZITADEL access token to the csrf_token endpoint, but Superset returned a Bad Request. What we are trying to avoid Ideally, we would like to avoid using a Superset service account solely for generating guest tokens. Our desired flow would be something like: User | | Login v ZITADEL | | Access Token v Angular Application | | Existing user authentication v Superset Embedded Dashboard Rather than: User | | Login v ZITADEL | v Angular Application | | Request guest token v Backend / Service Account | | Superset login v Superset Access Token | | CSRF Token v Guest Token | v Embedded Dashboard Questions 1. Is it possible to use the existing ZITADEL access token to authenticate/authorize the user with Superset for an embedded dashboard? 2. If not, is there a recommended way to integrate ZITADEL with Superset’s embedded dashboard authentication without using a Superset service account? 3. Is the guest-token approach intentionally designed to require a backend/service account, or are we missing an alternative authentication flow? 4. If using the same ZITADEL project/SSO provider does not help with embedded dashboards, could someone explain why? We understand that SSO and Superset guest-token authentication may be separate mechanisms, but we would like to understand the recommended architecture. 5. What would be the recommended architecture for securely embedding Superset dashboards into an Angular application where the user is already authenticated through ZITADEL? We would appreciate any guidance, examples, or references to the recommended approach. We are relatively new to Superset embedding, so apologies if we are misunderstanding how the authentication flow is intended to work. Thank you! ### Screenshots/recordings _No response_ ### Superset version master / latest-dev ### Python version 3.11 ### Node version 16 ### Browser Chrome ### Additional context _No response_ ### Checklist - [ ] I have searched Superset docs and Slack and didn't find a solution to my problem. - [ ] I have searched the GitHub issue tracker and didn't find a similar bug report. - [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section. GitHub link: https://github.com/apache/superset/discussions/44205 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
