Okta auth failing

[Lewiscowles1986]

Bug description

The underlying Flask-AppBuilder dependency does not work with Okta

Screenshots/recordings

dpgaspar/Flask-AppBuilder#2291 has lots of information, which I have confirmed in a minimal reproducible example with the library

Superset version

master / latest-dev

Python version

3.11

Node version

Not applicable

Browser

Not applicable

Additional context

This is a server-side behaviour. I Have confirmed that I can get information from the endpoint for userinfo and that I am using the URL from the server_metadata of self.appbuilder.sm.oauth_remotes[provider], and while it works in CURL, it 404's in that library, which is hampering an effort to setup Apache Superset

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[EnxDev]

@dpgaspar, please could you have a look at this?

[Lewiscowles1986]

There is a branch I PR'd to that library dpgaspar/Flask-AppBuilder#2292

The hard part is writing automated tests which run against okta. I guess I could try capturing responses with freezegun, so that signatures don't expire; but it's a lot of heavy lift, and vs a live test would not represent any greater surity against Okta.

[Lewiscowles1986]

So I don't know how long this will take with that library, but while investigating our demo sample app, @chrispsheehan and I found that we could also have Flask-AppBuilder work, with no code edits by using okta as the server-side and auth0 as the client; something not made possible using Superset implementation, because in flask-appbuilder security/manager.py, the change I'm trying to make, just makes okta and auth0 behave the same. I'm only mentioning this in-case anyone has the bandwidth to de-couple the client and server-side of how this works for superset.

[gugupy]

@Lewiscowles1986 In superset extending SupersetSecurityManager and overrides oauth_user_info works. Custom OAuth2 Configuration

[Lewiscowles1986]

I believe we tried this. I do see a note that the directoy matters, perhaps this was a contributing factor; but in any case, wouldn't it be nice to have this solved for all users, so that the code that is part of flask app builder (the root cause), just works?

[rusackas]

I think @dpgaspar is the right person to look at this, but I think @sadpandajoe might also have some context, so ping!

[rusackas]

Assuming this is no longer an issue for folks, thus the long silence here. I'll close it out as inactive, but holler if it needs a revisit. I know at Preset we're using Okta for our auth, so hopefully things are working smoothly for you too :D

[Lewiscowles1986]

the issue exists in superset; I'm fine with you not fixing it; workaround exists

[NoamLiber-Reco]

@Lewiscowles1986 what's the workaround?

[Lewiscowles1986]

there is literally a PR above... dpgaspar/Flask-AppBuilder#2292

[Lewiscowles1986]

so you need to patch Flask-AppBuilder, and mod superset to use that patched version.