experimental OAuth data source implementation

[dobrych]

SUMMARY

In this example custom PostgreSQL DB driver tries to reuse existing OAuth session that current user logged in to authenticate DB connection.

TESTING INSTRUCTIONS

To test it, we need to add custom OAuth security manager into Python path

import logging
from superset.security import SupersetSecurityManager


log = logging.getLogger(__name__)

class TIPSsoSecurityManager(SupersetSecurityManager):

    def oauth_user_info(self, provider, response=None):
        if provider == 'TIP':
            userinfo = self.appbuilder.sm.oauth_remotes[provider].get('openid/userinfo').json()
            token = self.appbuilder.sm.oauth_remotes[provider].token
            me = self.appbuilder.sm.oauth_remotes[provider].get(f'api/v1/accounts/{userinfo["sub"]}').json()
            log.info("[TIP SSO] user_data: {0}".format(me.keys()))
            log.debug("[TIP SSO] access token: {0}".format(token.get('access_token')))
            return { 'email' : me['emailAddress'], 'first_name': me['name']['first'], 'last_name':me['name']['last'] }

Superset configuration changes to use it:

from flask_appbuilder.security.manager import AUTH_OAUTH
from tip_security_manager import TIPSsoSecurityManager

AUTH_ROLE_PUBLIC = 'Public'
AUTH_USER_REGISTRATION = True
AUTH_USER_REGISTRATION_ROLE = "Admin"
AUTH_TYPE = AUTH_OAUTH

OAUTH_BASE_ENDPOINT = os.environ.get('SUPERSET_OAUTH_BASE_URL', 'https://iam-service.trial.platform.intertrust.com')

OAUTH_PROVIDERS = [
  {   'name':'TIP',
      'token_key':os.environ.get('SUPERSET_OAUTH_TOKEN', 'id_token'), # Name of the token in the response of access_token_url
      'icon':'fa-address-card',   # Icon for the provider
      'remote_app': {
          'client_id':'8390d3ef-c280-4c59-baac-28843949c9e0',  # Client Id (Identify Superset application)
          'client_secret':'<...>'
          'api_base_url': f'{OAUTH_BASE_ENDPOINT}/',
          'server_metadata_url': f'{OAUTH_BASE_ENDPOINT}/.well-known/openid-configuration',
          'client_kwargs':{ 'scope': 'openid intertrust_platform email profile' }
      }
  }
]

CUSTOM_SECURITY_MANAGER = TIPSsoSecurityManager

ADDITIONAL INFORMATION

Problem appears in a difference on where security manager is called
Calling self.appbuilder.sm.oauth_remotes[provider].token inside TIPSsoSecurityManager yields proper OAuth access token, but calling current_app.appbuilder.sm.oauth_remotes[provider].token inside TIPPostgresEngineSpec yields None