Superset authentication with Azure Entra ID

[Moise1]

I've successfully set up my Apache Superset to authenticated users with Azure Entra ID 2-step verification. However, when I log out and try to log in again, I get the 502 bad gateway error and this url in the browser: https://my-app.com/login/azure?next= and it looks like Superset doesn't clear cache on logout unless I manually clear the browser's history

I'd appreciate your help.

Here's my nginx config:

server {
    server_name my-app.rw;

    location / {
        proxy_pass http://127.0.0.1:8088;  # Changed to localhost
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_redirect http:// $scheme://;
    }

    location = /logout {
        proxy_pass http://127.0.0.1:8088/logout;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect http:// $scheme://;
        proxy_redirect off;  # Critical for Azure AD
    }

    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/my-app.rw/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/my-app.rw/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

superset_config.py

class CustomSecurityManager(SupersetSecurityManager):

    def oauth_user_info(self, provider, response=None):
    
        if provider != 'azure':
            # Handle other providers or return empty
            return {}
        
        try:
            # Log the response for debugging
            logger.debug(f"OAuth response for {provider}: {response}")

          
            remote = self.appbuilder.sm.oauth_remotes[provider]

            # Log the authorize URL (initial redirect to Azure AD)
            logger.debug(f"Authorize URL: {remote.authorize_url}")  # Should match Azure AD


            # Log the token exchange URL
            logger.debug(f"Token URL: {remote.access_token_url}")  # Should be Azure AD's /token endpoint
            
            
            # More robust token handling
            headers = {}
            if response.get('access_token'):
                headers['Authorization'] = f"Bearer {response.get('access_token')}"
            
            # Make the API request
            me = remote.get('https://graph.microsoft.com/v1.0/me', token=response, headers=headers)
            
            # Check for success
            if me.status_code != 200:
                logger.error(f"Microsoft Graph API error: {me.status_code} - {me.text}")
                return {}
            
            # Parse the response
            user_data = me.json()
            logger.debug(f"User data from Microsoft Graph: {user_data}")
            
            # Extract user information
            email = user_data.get('mail')
            if not email:
                upn = user_data.get('userPrincipalName')
                if upn:
                    email = upn.split('#EXT#')[0].replace('_', '@')

            existing_user = self.appbuilder.get_session.query(User).filter_by(email=email).first()
            username = existing_user.username if existing_user else email

            return {
                'email': email,
                'username': username,
                'first_name': user_data.get('givenName', ''),
                'last_name': user_data.get('surname', ''),
            }
        except Exception as e:
            # Log the full error with traceback
            logger.exception(f"OAuth error for {provider}: {str(e)}")
            # Return empty dict instead of raising to prevent authentication failures
            return {}
    


class CustomAuthDBView(AuthDBView):
    @expose('/logout')
    def logout(self):
        # Clear local session
        self.appbuilder.sm.logout_user()
        # Redirect to Azure AD logout
        return redirect(
            "https://login.microsoftonline.com/974x/oauth2/v2.0/logout"
            "?post_logout_redirect_uri=https://my-app.rw/login"
        )


CUSTOM_SECURITY_MANAGER = CustomSecurityManager


# Register the view
APP_BUILDER_VIEWS = [CustomAuthDBView]

ENABLE_PROXY_FIX = True 

AUTH_TYPE = AUTH_OAUTH

OAUTH_PROVIDERS = [
    {
            "name": "azure",
            "icon": "fa-windows",
            "token_key": "access_token",
            "remote_app": {
                "client_id": "0722xxx", 
                "client_secret": "ky8xxx",
                "api_base_url": "https://graph.microsoft.com/v1.0/",
                "server_metadata_url": "https://login.microsoftonline.com/974xx/v2.0/.well-known/openid-configuration",
                "redirect_uri": "https://my-app.rw/oauth-authorized/azure",
               "logout_url": (
                    "https://login.microsoftonline.com/9xxx/oauth2/v2.0/logout"
                    "?post_logout_redirect_uri=https://my-app.rw/logout"
                ),
                "client_kwargs": {
                    "scope": "openid profile email User.Read",
                },
                "request_token_url": None,
                "access_token_url": "https://login.microsoftonline.com/974x/oauth2/v2.0/token",  
                "authorize_url": "https://login.microsoftonline.com/974x/oauth2/v2.0/authorize", 
            },
        }
    ]

[dosubot[bot]]

Hello @Moise1! I'm here to help you solve bugs, answer questions, and assist with becoming a contributor. While you wait for a human maintainer, feel free to ask me anything!

I found a similar unsolved discussion regarding redirect URLs in Superset, which might be related to your issue. You can check it out here ^[1].

Regarding your issue, the 502 Bad Gateway error could be related to the Nginx configuration or the way Superset handles cache clearing upon logout. Superset clears local storage upon logout, as indicated by tests in RightMenu.test.tsx, which verify that session data is removed ^[2]. However, if you're experiencing cache issues, it might be worth checking if the proxy_cache_bypass directive is correctly configured or if additional cache-related settings are needed in Nginx.

Additionally, ensure that the post_logout_redirect_uri parameter in your Azure AD configuration is correctly set to redirect users back to the login page after logout. This parameter can affect the logout process and subsequent login attempts. If the redirect URI is incorrect, it might lead to errors during login.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}