login failure using custom auth backend leads to call to /login instead of /admin/login

[imiten]

Hi,

I am trying custom backend and for correct credentials login and logout works fine but if there is login failure either password incorrect or scope issue as coded in snippet below url /login is being redirected seems and it causes Bad Request there after when I submit form it keeps using /login even though when I inspect form it shows /admin/login as form post url.

log snippet:

 "GET /admin/login HTTP/1.1" 200 OK
game:admin scope auth failure
INFO:     127.0.0.1:49510 - "POST /login HTTP/1.1" 400 Bad Request

CustomBackend class

class CustomBackend(AuthenticationBackend):                                     
                                                                                
    async def login(self, request: Request) -> bool:                            
        form_data = await request.form()                                        
        user : models.User = authenticate_user(get_db(), form_data['username'], 
                form_data['password'])                                          
        if not user or user.disabled:                                           
            print("auth failure")                                               
            return False                                                        
        if not 'game:admin' in user.scopes:                                     
            print("game:admin scope auth failure")                              
            return False                                                        
        request.session.update({'token': user.username})                        
        return True                  

Here is full log:

INFO:     Started server process [7325]
INFO:     Waiting for application startup.
INFO:     Application startup complete.
INFO:     127.0.0.1:49240 - "GET /admin HTTP/1.1" 307 Temporary Redirect
INFO:     127.0.0.1:49240 - "GET / HTTP/1.1" 302 Found
INFO:     127.0.0.1:49244 - "GET /admin/login HTTP/1.1" 200 OK
INFO:     127.0.0.1:49378 - "POST /login HTTP/1.1" 302 Found
INFO:     127.0.0.1:49378 - "GET / HTTP/1.1" 200 OK
INFO:     127.0.0.1:49378 - "GET /js/jquery.min.js HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:49390 - "GET /js/select2.full.min.js HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:49382 - "GET /js/popper.min.js HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:49394 - "GET /js/flatpickr.min.js HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:49378 - "GET /js/main.js HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:49386 - "GET /js/bootstrap.min.js HTTP/1.1" 304 Not Modified
INFO:     127.0.0.1:49510 - "GET /logout HTTP/1.1" 302 Found
INFO:     127.0.0.1:49510 - "GET / HTTP/1.1" 302 Found
INFO:     127.0.0.1:49514 - "GET /admin/login HTTP/1.1" 200 OK
game:admin scope auth failure
INFO:     127.0.0.1:49510 - "POST /login HTTP/1.1" 400 Bad Request

Regards,

Miten.

[aminalaee]

Hey @imiten ,

So to be clear, what exactly is the issue? Doesn't the login work anymore after that?

[aminalaee]

Yeah, take a look at the example implementation, you need the context dict with request in it: https://github.com/aminalaee/sqladmin/blob/main/sqladmin/application.py#L498
The error is also there.

[imiten]

admin:index redirect generates login page instead of showing the next page with users, logout etc. The default page you have seems to work in terms of blocking access would be good if can be easily customized. I also tried to create /templates/login.html and removing the MyAdmin but still same behavior. you might want to just try custom login page and verify it really works. you see i have two cases of error for authentication as password invalid and no admin scope. if I can show that instead of invalid credentails that will also be helpful.

[aminalaee]

I'm guessing you're doing something wrong on your side, I have tested this and works ok:

• create templates dir with custom_login.html
• just copy paste existing login.html into it
• you should not remove MyAdmin, using MyAdmin you can completely override the login logic, handle GET, POST anything. You have full control.

I will add it to the docs later too.

[imiten]

All good now. I followed your steps. I had layout.html from my old code in templates which was issue. Also I modified CustomBackend login to raise Exception and use it in MyAdmin for error messages. I see you using those jinja vars like {{ admin.title }}. I have just edited them and hardcoded to my need but can those be set in some file as properties.

[aminalaee]

Great, yeah you have full control now.