GitHub user TongyiDai deleted a comment on the discussion: Can the Host Application’s SSO Access Token Be Used for Superset Embedded Guest Token Generation?
The ZITADEL access token cannot be passed directly to Superset's `/api/v1/security/csrf_token/` or `/guest_token/` endpoints unless you have implemented an authentication manager that accepts that token as a Superset API credential. Sharing an upstream IdP does not make tokens issued for the Angular application's client/audience valid for Superset's REST API. The Embedded SDK's intended trust boundary is backend-to-backend: 1. Angular authenticates the user with ZITADEL. 2. Your backend validates that ZITADEL token and applies your authorization policy. 3. Your backend obtains or creates a short-lived Superset guest token containing only the allowed dashboard resource and any RLS rules. 4. The frontend's `fetchGuestToken` callback receives that guest token; no Superset service credentials or signing secret reach the browser. For issuing the token, Superset documents two choices: - call `POST /api/v1/security/guest_token/` as a Superset principal with `can_grant_guest_token`; or - mint the guest JWT directly in your trusted backend using `GUEST_TOKEN_JWT_SECRET`, the configured algorithm, and matching audience. The second avoids logging in a service account for every request, but it does not remove the backend trust boundary—it replaces the service credential with a highly sensitive signing secret. CSRF is not part of that direct-JWT path. Do not send the ZITADEL token or Superset signing secret to the Embedded SDK. Use the ZITADEL identity only as authenticated input to your backend's dashboard/RLS decision, then issue a narrowly scoped, short-lived guest token. GitHub link: https://github.com/apache/superset/discussions/44205#discussioncomment-18459919 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
