-
Notifications
You must be signed in to change notification settings - Fork 13.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Apache Superset & Keycloak integration #29539
Comments
To resolve the issue where, after entering credentials on the Keycloak page, you are redirected back to Apache Superset with the message: "The request to sign in was denied," you need to ensure that the OAuth2 flow is correctly configured and that the necessary permissions are granted. Here are some steps you can take to troubleshoot and resolve the issue:
Here is the relevant part of the code that handles the OAuth2 redirect and message validation: const handleMessage = (event: MessageEvent) => {
const redirectUrl = new URL(extra.redirect_uri);
if (
event.origin === redirectUrl.origin &&
event.data.tabId === extra.tab_id &&
event.source === oAuthTab.current
) {
if (source === 'sqllab' && query) {
dispatch(reRunQuery(query));
} else if (source === 'explore' && chartId) {
dispatch(triggerQuery(true, chartId));
} else if (source === 'dashboard') {
dispatch(onRefresh(chartList, true, 0, dashboardId));
}
}
}; Ensure that the Additionally, review the specific error messages or logs generated by Superset when the OAuth2 authentication fails. The relevant error messages are:
By following these steps and ensuring that the configurations are correct, you should be able to resolve the issue and successfully authenticate using Keycloak with Apache Superset. |
This is like a ChatGPT reply, lol. |
To resolve the issue where, after entering credentials on the Keycloak page, you are redirected back to Apache Superset with the message: "The request to sign in was denied," you need to ensure that the OAuth2 flow is correctly configured and that the necessary permissions are granted. Here are some steps you can take to troubleshoot and resolve the issue:
Here is the relevant part of the code that handles the OAuth2 redirect and message validation: const handleMessage = (event: MessageEvent) => {
const redirectUrl = new URL(extra.redirect_uri);
if (
event.origin === redirectUrl.origin &&
event.data.tabId === extra.tab_id &&
event.source === oAuthTab.current
) {
if (source === 'sqllab' && query) {
dispatch(reRunQuery(query));
} else if (source === 'explore' && chartId) {
dispatch(triggerQuery(true, chartId));
} else if (source === 'dashboard') {
dispatch(onRefresh(chartList, true, 0, dashboardId));
}
}
}; Ensure that the Additionally, review the specific error messages or logs generated by Superset when the OAuth2 authentication fails. The relevant error messages are:
By following these steps and ensuring that the configurations are correct, you should be able to resolve the issue and successfully authenticate using Keycloak with Apache Superset. |
Great timing @kormpakis -- can you please take a look at this pending addition to the documentation about how to set up Keycloak auth: #29487 |
just FYI, you can make sure everything is well set up in Keycloak itself, and then just refer to the well-known endpoint. Here is my working -but truncated- version, without installing any additional package such as
|
Bug description
I am currently working on configuring OAuth authentication between Keycloak and Apache Superset. I am encountering an issue where, after entering the credentials on the Keycloak page, I am redirected back to Superset with the message: "The request to sign in was denied."
How to reproduce the bug
Below are the configurations I have used: Keycloak Configuration (Version 23.0.3)
Keycloak Client Settings
Valid Redirect URIs: http://localhost:8089/oauth-authorized/keycloak
Web Origins: http://localhost:8089/%5C*
Apache Superset Configuration (superset_config.py):
OAuth provider configuration for Keycloak in superset_config.py
Issue Description
After entering the credentials in the Keycloak login page, the redirection to Superset results in the following message: "The request to sign in was denied."
Screenshots/recordings
No response
Superset version
master / latest-dev
Python version
I don't know
Node version
I don't know
Browser
Not applicable
Additional context
I am unsure what might be causing this error and would greatly appreciate your assistance in identifying and resolving the issue.
Has anyone had any similar issues?
I tried various configurations and similar issues for several days now with no result.
It seems to be connected in the first place (it redirects to Keycloak sign-in page and comes back to Superset when correct credentials are provided) but it stucks in the final step.
Please help me and let's create a clear and working configuration, since the official docs are not so helpful...
Checklist
The text was updated successfully, but these errors were encountered: