aminghadersohi commented on code in PR #44368:
URL: https://github.com/apache/superset/pull/44368#discussion_r4041449963
##########
superset/security/manager.py:
##########
@@ -6020,7 +6020,17 @@ def register_views(self) -> None:
# FlaskAppBuilder's AuthRemoteUserView actually claims the route.
if self.register_superset_auth_view and self.auth_type !=
AUTH_REMOTE_USER:
self.auth_view = self.appbuilder.add_view_no_menu(SupersetAuthView)
- if self.register_superset_registeruser_view:
+ # AUTH_USER_REGISTRATION is what makes FlaskAppBuilder provision users
on
+ # first login, so LDAP/SAML/AUTH_REMOTE_USER deployments have to enable
+ # it; that must not publish the "/register/" self-registration page.
+ # FlaskAppBuilder only wires the "/register/form" handler that page
posts
+ # to for AUTH_DB and AUTH_OAUTH (see its own register_views), so for
any
+ # other auth type the page is a registration form that submits to a
404.
+ if (
+ self.register_superset_registeruser_view
+ and self.auth_user_registration
+ and self.auth_type in (AUTH_DB, AUTH_OAUTH)
Review Comment:
FAB forces `AUTH_USER_REGISTRATION` for OAuth provisioning too
(`auth_user_oauth` manager.py:1509, same guard as `auth_user_ldap`:1247), and
OAuth's `/register/form` does resolve — so it keeps a live unlinked
self-registration page. #37100 names OAuth and `Fixes #37100` auto-closes it.
Deliberate?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
