How to enable sso login in Superset 5.0.0?

[johannes-ws]

How to enable sso login in Superset 5.0.0?

[dosubot[bot]]

To enable SSO login in Superset 5.0.0, set up your authentication in superset_config.py using one of the supported SSO methods: OAuth, OIDC, LDAP, or REMOTE_USER. For OAuth/OIDC, set AUTH_TYPE = AUTH_OAUTH and configure the OAUTH_PROVIDERS list with your identity provider's details. You’ll also need a custom security manager that extends SupersetSecurityManager (not Flask AppBuilder’s SecurityManager) and implements an oauth_user_info method to extract user info from the provider’s response. Reference this class in your config with CUSTOM_SECURITY_MANAGER example & details.

If you deploy with Helm or Docker, manage secrets like CLIENT_ID and CLIENT_SECRET via Kubernetes Secrets or environment variables, and ensure they’re referenced in your config. After configuring SSO, run superset db upgrade and superset init to update the database schema and permissions init steps.

Note: For background tasks (alerts, reports, thumbnails), SSO-only setups can cause issues with headless browser authentication. Workarounds include using guest tokens, public roles, or machine auth cookies limitations & workarounds.

If you want both SSO and standard login, you can customize the login view in your security manager to support both flows custom login example.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[dosubot[bot]]

Here's a working example for enabling Microsoft Azure SSO in Superset 5.0.0. Add this to your superset_config.py (or split out the custom security manager if you prefer):

import os
import logging
from flask_appbuilder.security.manager import AUTH_OAUTH
from superset.security import SupersetSecurityManager

AUTH_TYPE = AUTH_OAUTH
AUTH_USER_REGISTRATION = True
AUTH_USER_REGISTRATION_ROLE = "Public"

OAUTH_PROVIDERS = [{
    "name": "azure",
    "icon": "fa-windows",
    "token_key": "access_token",
    "remote_app": {
        "client_id": os.environ.get("CLIENT_ID"),  # Set via env or secret
        "client_secret": os.environ.get("CLIENT_SECRET"),  # Set via env or secret
        "api_base_url": "https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/",
        "access_token_url": "https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token",
        "authorize_url": "https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/authorize",
        "client_kwargs": {
            "scope": "openid email profile User.Read GroupMember.Read.All upn"
        }
    }
}]

# Optional: Map Azure AD group IDs to Superset roles
AUTH_ROLES_MAPPING = {
    "Azure-Group-Object-ID-1": ["Admin"],
    "Azure-Group-Object-ID-2": ["Gamma"],
    # Add more as needed
}

AUTH_ROLES_SYNC_AT_LOGIN = True
ENABLE_PROXY_FIX = True  # Important if behind a proxy/load balancer

# Optional: Custom security manager for advanced role mapping or user info extraction
class CustomSsoSecurityManager(SupersetSecurityManager):
    def oauth_user_info(self, provider, response=None):
        if provider == "azure":
            me = self.appbuilder.sm.oauth_remotes[provider].get("https://graph.microsoft.com/v1.0/me").json()
            groups = me.get("groups", [])
            group_role_map = {
                "Azure-Group-Object-ID-1": "Admin",
                "Azure-Group-Object-ID-2": "Gamma",
            }
            user_roles = [group_role_map[g] for g in groups if g in group_role_map]
            return {
                "username": me.get("userPrincipalName"),
                "first_name": me.get("givenName", ""),
                "last_name": me.get("surname", ""),
                "email": me.get("mail"),
                "role_keys": user_roles,
            }
        return super().oauth_user_info(provider, response)

CUSTOM_SECURITY_MANAGER = CustomSsoSecurityManager

Replace <tenant_id> with your Azure AD tenant ID. Set CLIENT_ID and CLIENT_SECRET as environment variables or via your deployment secrets. The scopes must include upn and group claims for role mapping to work. If you want to map Azure AD groups to Superset roles, either use AUTH_ROLES_MAPPING or implement it in the oauth_user_info method as shown above. Make sure your Azure app registration is configured to return group claims in the token.

If you deploy with Helm or Docker, manage secrets via Kubernetes Secrets and reference them in your deployment config. After setup, run superset db upgrade and superset init to update the schema and permissions.

For more details and troubleshooting, see this example and this discussion.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[johannes-ws]

Sign in
Sorry, but we’re having trouble signing you in.

AADSTS900971: No reply address provided.

why? @dosu

[dosubot[bot]]

The error "AADSTS900971: No reply address provided" means your Azure AD app registration is missing the correct redirect URI (reply address) for Superset. For Azure SSO to work, you must register the exact redirect URI that Superset uses for OAuth callbacks in your Azure AD app.

For Superset, the redirect URI is usually:

https://<your-superset-domain>/oauth-authorized/azure

Replace <your-superset-domain> with your actual Superset hostname (including https if you use SSL). This URI must match exactly—protocol, domain, and path—with what you register in Azure AD, or you'll get this error. If you use a proxy or load balancer, set ENABLE_PROXY_FIX = True in your superset_config.py to ensure the correct redirect URI is generated and used by Superset, especially to avoid http/https mismatches.

To fix:

1. Go to your Azure AD app registration → "Authentication" → "Redirect URIs".
2. Add the URI above (with your real domain).
3. Save the changes and try logging in again.

If you still see the error, double-check for typos, protocol mismatches (http vs https), or missing path segments. If you’re behind a proxy, make sure it isn’t rewriting the host or path in a way that changes the callback URL. More details and examples are in this discussion and this config guide.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[basarix]

I want to use OIDC as SSO login. Can you help me with the code? @dosu

[michofwood]

@dosu Can I use the superset restapi with an azure sso user ?