How to enable oauth2 or SSO like login

[simonsax]

Hi

I'm struggling to setup oauth2/OIDC authentication with sqladmin (in the end I'd like to let users with a specific userdata-attribute login to my backend). In my case I'm using authlib.

... #imports
from starlette.config import Config

config = Config('.env')  # read config from .env file
oauth = OAuth(config)

app = FastAPI()
app.add_middleware(SessionMiddleware, secret_key=settings.SECRET_KEY)

oauth.register(
    name='OIDC',
    server_metadata_url=settings.OIDC_CONFIGURATION_URL,
    client_kwargs={
        'scope': 'openid roles profile'
    }
)

class AdminAuthBackend(AuthenticationBackend):
    async def login(self, request: Request):    
        redirect_uri = request.url_for('auth_callback')
        return await oauth.OIDC.authorize_redirect(request, redirect_uri)
        

    async def logout(self, request: Request) -> bool:
        print("logout method")
        request.session.clear()
        return True

    async def authenticate(self, request: Request) -> bool:
        token = await oauth.OIDC.authorize_access_token(request)
        print(token)
        return "token" in request.session

@app.on_event("startup")
async def on_startup():
       admin_backend = Admin(app=app, engine=engine, authentication_backend=AdminAuthBackend(secret_key=settings.SECRET_KEY))
       ... #add routers etc. (e.g. callback route)

when I try to visit /admin I get the following error:
authlib.integrations.base_client.errors.MismatchingStateError: mismatching_state: CSRF Warning! State not equal in request and response.

does someone know why this is happening? Or what would be the right approach to use oauth2/OIDC with sqladmin?

Thanks in advance for any help. Best Regards
Simon

[aminalaee]

Hi,
Can you please provide a minimal example to run this?
I think the issue might be that SQLAdmin AuthenticationBackend is using another SessionMiddleware from your main App.

[simonsax]

I did everything from scratch and was not able to reproduce the error. It could be that having 2 functions called "login" (one as a function name for the login route and one function in the admin backend class) was the root cause. So this can be closed anyway. Still thank you a lot for your community work!

[aminalaee]

Glad it's resolved here.