Problems calling Superset Api with authentication via oauth provider

[tancir]

Hi to all,
we have integrated Superset 2.1.0 in our application, using KeyCloak as identity provider.
The integration works correctly, so we can access to Superset functions from our application.

Now we would like to call SuperSet Api from an external standalone application, but we have some authentication problems.
In particular we generate a JWT token with a curl like the following, where client_id, client_secret and url are the same configured in superset_config.py of our superset installation:

curl -k -L -X POST 'https://test.it/auth/realms/tst/protocol/openid-connect/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
 --data 'client_id=my_app' \
 --data 'client_secret=secret_key' \
 --data 'grant_type=client_credentials' 

and obtain an HTTP 200 response with a Bearer access_token .

Then we set this token in the Authorization header of a Superset rest call and obtain HTTP 401 with message : "The client application my_app has forbidden access".

Are these steps correct or there is another way to proceed?
What could be the problem?

In attachment my superset_config.py

Thanks,
Tania
superset_config.txt

[tancir]

We have found a solution.

[rdvij]

How did you resolve this, can you please share the steps?

[shohamyamin]

@tancir can you please share how you succeeded with that?

[tancir]

Hi,
to generate a valid token to call superset api we have created an admin user with this command:

superset fab create-admin --username ${SUPERSET_ADMIN_USR} --firstname superset --lastname conf --email superset@localhost --password ${SUPERSET_DB_ADMIN_PWD}

This user can authenticate on Superset bypassing oauth provider.
So we can invoke /api/v1/security/login Api, specifying the username and password of this user, obtain a valid token and invoke other APIs.

[mtrentz]

Thank you for this 😊

Works perfectly on 3.1!

I also think all installations will have a admin user by default (created by the docker-init.sh) and you can recover that password by running this in your app instance superset fab reset-password --username admin --password NEW_PASS

[berna396]

Hi! How did you bypass oauth? Any further configuration?
I tried in v3.0 and is not working using the API like in the example:

{
  "password": "complex-password",
  "provider": "db",
  "refresh": true,
  "username": "admin"
}

It seems that it keeps trying to use oauth even if I pass the admin user.