Skip to content

Commit 9b554f7

Browse files
sudoshisudoshi
committed
feat(acropolis): wire Authentik group claims into local SSO surfaces
Propagate Authentik group membership end-to-end for shared admin mapping across local Acumenus Docker surfaces: - Installer ensures common admin groups (authentik Admins + Parthenon/ Aurora alias groups) and seeds default admin/bootstrap memberships, plus an OAuth2 'groups' scope mapping emitting group names. - Add Alfresco service def and rename Superset OIDC display name. - Request 'groups' scope across pgAdmin, Superset, Grafana, DataHub. - Superset: custom security manager maps admin groups -> Admin role, Gamma default, roles synced at login. - Grafana role mapping recognizes Parthenon/Aurora admin groups. - Add memory limits to previously-unbounded local compose services. - Document local Authentik audit (2026-06-18).
1 parent 676869d commit 9b554f7

9 files changed

Lines changed: 504 additions & 18 deletions

‎acropolis/config/pgadmin/config_local.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
'OAUTH2_API_BASE_URL': f'https://auth.{DOMAIN}/application/o/',
2323
'OAUTH2_USERINFO_ENDPOINT': f'https://auth.{DOMAIN}/application/o/userinfo/',
2424
'OAUTH2_SERVER_METADATA_URL': f'https://auth.{DOMAIN}/application/o/pgadmin-oidc/.well-known/openid-configuration',
25-
'OAUTH2_SCOPE': 'openid profile email',
25+
'OAUTH2_SCOPE': 'openid profile email groups',
2626
'OAUTH2_ICON': 'fa-key',
2727
'OAUTH2_BUTTON_COLOR': '#fd4b2d',
2828
}]

‎acropolis/config/superset/superset_config.py‎

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
# =============================================================================
99
import os
1010
from flask_appbuilder.security.manager import AUTH_OAUTH
11+
from superset.security import SupersetSecurityManager
1112

1213
# ── Core ────────────────────────────────────────────────────────────────────
1314
ENABLE_PROXY_FIX = True
@@ -64,9 +65,19 @@ class CeleryConfig:
6465

6566
# ── Authentik OIDC ─────────────────────────────────────────────────────────
6667
DOMAIN = os.environ.get("DOMAIN", "acumenus.net")
68+
AUTHENTIK_ADMIN_GROUPS = {
69+
"authentik Admins",
70+
"Parthenon Admins",
71+
"Aurora Admins",
72+
}
6773
AUTH_TYPE = AUTH_OAUTH
6874
AUTH_USER_REGISTRATION = True
69-
AUTH_USER_REGISTRATION_ROLE = "Public"
75+
AUTH_USER_REGISTRATION_ROLE = "Gamma"
76+
AUTH_ROLES_SYNC_AT_LOGIN = True
77+
AUTH_ROLES_MAPPING = {
78+
"Admin": ["Admin"],
79+
"Gamma": ["Gamma"],
80+
}
7081
OAUTH_PROVIDERS = [
7182
{
7283
"name": "authentik",
@@ -79,11 +90,34 @@ class CeleryConfig:
7990
"access_token_url": f"https://auth.{DOMAIN}/application/o/token/",
8091
"authorize_url": f"https://auth.{DOMAIN}/application/o/authorize/",
8192
"server_metadata_url": f"https://auth.{DOMAIN}/application/o/superset-oidc/.well-known/openid-configuration",
82-
"client_kwargs": {"scope": "openid profile email"},
93+
"client_kwargs": {"scope": "openid profile email groups"},
8394
},
8495
}
8596
]
8697

98+
99+
class AuthentikSecurityManager(SupersetSecurityManager):
100+
def oauth_user_info(self, provider, response=None):
101+
if provider != "authentik":
102+
return super().oauth_user_info(provider, response)
103+
104+
remote = self.appbuilder.sm.oauth_remotes[provider]
105+
userinfo = remote.get("userinfo").json()
106+
groups = userinfo.get("groups") or []
107+
name = userinfo.get("name") or userinfo.get("preferred_username") or userinfo.get("email")
108+
role_key = "Admin" if any(group in AUTHENTIK_ADMIN_GROUPS for group in groups) else "Gamma"
109+
return {
110+
"username": userinfo.get("preferred_username") or userinfo.get("email"),
111+
"name": name,
112+
"email": userinfo.get("email"),
113+
"first_name": name,
114+
"last_name": "",
115+
"role_keys": [role_key],
116+
}
117+
118+
119+
CUSTOM_SECURITY_MANAGER = AuthentikSecurityManager
120+
87121
# ── Display ─────────────────────────────────────────────────────────────────
88122
APP_NAME = "Acropolis Analytics"
89123
SUPERSET_WEBSERVER_TIMEOUT = 300

‎acropolis/docker-compose.community.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,11 @@ services:
8181
GF_AUTH_GENERIC_OAUTH_NAME: Authentik
8282
GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ${GRAFANA_OAUTH_CLIENT_ID}
8383
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ${GRAFANA_OAUTH_CLIENT_SECRET}
84-
GF_AUTH_GENERIC_OAUTH_SCOPES: openid profile email
84+
GF_AUTH_GENERIC_OAUTH_SCOPES: openid profile email groups
8585
GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://auth.${DOMAIN:-acumenus.net}/application/o/authorize/
8686
GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://auth.${DOMAIN:-acumenus.net}/application/o/token/
8787
GF_AUTH_GENERIC_OAUTH_API_URL: https://auth.${DOMAIN:-acumenus.net}/application/o/userinfo/
88-
GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: "contains(groups[*], 'authentik Admins') && 'Admin' || 'Viewer'"
88+
GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: "(contains(groups[*], 'authentik Admins') || contains(groups[*], 'Parthenon Admins') || contains(groups[*], 'Aurora Admins')) && 'Admin' || 'Viewer'"
8989
GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: "true"
9090
GF_AUTH_GENERIC_OAUTH_AUTO_LOGIN: "false"
9191
env_file:

‎acropolis/docker-compose.enterprise.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -437,7 +437,7 @@ services:
437437
- AUTH_OIDC_CLIENT_SECRET=${DATAHUB_OAUTH_CLIENT_SECRET}
438438
- AUTH_OIDC_DISCOVERY_URI=https://auth.${DOMAIN:-acumenus.net}/application/o/datahub-oidc/.well-known/openid-configuration
439439
- AUTH_OIDC_BASE_URL=https://datahub.${DOMAIN:-acumenus.net}
440-
- AUTH_OIDC_SCOPE=openid,profile,email
440+
- AUTH_OIDC_SCOPE=openid,profile,email,groups
441441
- AUTH_OIDC_USER_NAME_CLAIM=preferred_username
442442
- AUTH_OIDC_GROUPS_CLAIM=groups
443443
- AUTH_JAAS_ENABLED=true

‎acropolis/docker-compose.local.yml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,29 @@
22
services:
33
# Authentik bootstrap credentials
44
authentik-worker:
5+
deploy:
6+
resources:
7+
limits:
8+
memory: 1536M
59
environment:
610
AUTHENTIK_BOOTSTRAP_EMAIL: ${AUTHENTIK_BOOTSTRAP_EMAIL}
711
AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD}
812
AUTHENTIK_BOOTSTRAP_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN}
913

1014
# Expose service ports to host for Apache proxy
1115
n8n:
16+
deploy:
17+
resources:
18+
limits:
19+
memory: 1536M
1220
ports:
1321
- "5678:5678"
1422

1523
superset:
24+
deploy:
25+
resources:
26+
limits:
27+
memory: 2048M
1628
ports:
1729
- "8089:8088"
1830
environment:
@@ -21,31 +33,138 @@ services:
2133
bash -c "uv pip install --system --target /app/superset_home/.local/lib/python3.10/site-packages psycopg2-binary && /usr/bin/run-server.sh"
2234
2335
superset-worker:
36+
deploy:
37+
resources:
38+
limits:
39+
memory: 2048M
2440
environment:
2541
- PYTHONPATH=/app/superset_home/.local/lib/python3.10/site-packages
2642
command: >
2743
bash -c "uv pip install --system --target /app/superset_home/.local/lib/python3.10/site-packages psycopg2-binary && celery --app=superset.tasks.celery_app:app worker --pool=prefork -O fair -c 4"
2844
2945
superset-beat:
46+
deploy:
47+
resources:
48+
limits:
49+
memory: 512M
3050
environment:
3151
- PYTHONPATH=/app/superset_home/.local/lib/python3.10/site-packages
3252
command: >
3353
bash -c "uv pip install --system --target /app/superset_home/.local/lib/python3.10/site-packages psycopg2-binary && celery --app=superset.tasks.celery_app:app beat --pidfile /tmp/celerybeat.pid --schedule /tmp/celerybeat-schedule"
3454
3555
datahub-frontend:
56+
deploy:
57+
resources:
58+
limits:
59+
memory: 1024M
3660
ports: []
3761

3862
portainer:
63+
deploy:
64+
resources:
65+
limits:
66+
memory: 512M
3967
ports:
4068
- "9443:9443"
4169

4270
pgadmin:
71+
deploy:
72+
resources:
73+
limits:
74+
memory: 1024M
4375
ports:
4476
- "5050:80"
4577

4678
authentik-server:
79+
deploy:
80+
resources:
81+
limits:
82+
memory: 1536M
4783
ports:
4884
- "9000:9000"
4985

5086
wazuh-dashboard:
87+
deploy:
88+
resources:
89+
limits:
90+
memory: 1024M
5191
ports: []
92+
93+
# ── Added memory caps for previously-unbounded services ──
94+
authentik-db:
95+
deploy:
96+
resources:
97+
limits:
98+
memory: 1024M
99+
100+
authentik-redis:
101+
deploy:
102+
resources:
103+
limits:
104+
memory: 256M
105+
106+
datahub-mysql:
107+
deploy:
108+
resources:
109+
limits:
110+
memory: 1536M
111+
112+
datahub-opensearch:
113+
deploy:
114+
resources:
115+
limits:
116+
memory: 1536M
117+
118+
datahub-broker:
119+
deploy:
120+
resources:
121+
limits:
122+
memory: 2048M
123+
124+
datahub-schema-registry:
125+
deploy:
126+
resources:
127+
limits:
128+
memory: 1024M
129+
130+
datahub-gms:
131+
deploy:
132+
resources:
133+
limits:
134+
memory: 3072M
135+
136+
datahub-actions:
137+
deploy:
138+
resources:
139+
limits:
140+
memory: 1024M
141+
142+
superset-cache:
143+
deploy:
144+
resources:
145+
limits:
146+
memory: 512M
147+
148+
superset-db:
149+
deploy:
150+
resources:
151+
limits:
152+
memory: 1024M
153+
154+
traefik:
155+
deploy:
156+
resources:
157+
limits:
158+
memory: 512M
159+
160+
wazuh-indexer:
161+
deploy:
162+
resources:
163+
limits:
164+
memory: 7168M
165+
166+
wazuh-manager:
167+
deploy:
168+
resources:
169+
limits:
170+
memory: 2048M

0 commit comments

Comments
 (0)