Azure AD auth question

[haripraghash]

A clear and concise description of what the bug is.

How to reproduce the bug

Configure Azure AD OAuth

Expected results

Should be able to login using Azure AD Creds.

Actual results

what actually happens.

ERROR:flask_appbuilder.security.views:Error returning OAuth user info: 'upn'

Screenshots

`AUTH_TYPE = AUTH_OAUTH

  OAUTH_PROVIDERS = [
  {
    "name": "azure",
    "icon": "fa-windows",
    "token_key": "access_token",
    "remote_app": {
        "client_id": "id",
        "client_secret": "pass",
        "api_base_url": "https://login.microsoftonline.com/tenantid/v2.0",
        "client_kwargs": {
            "scope": "openid email profile offline_access",
            "resource": "clientid",
        },
        "request_token_url": None,
        "jwks_uri": "https://login.microsoftonline.com/common/discovery/v2.0/keys",
        "access_token_url": "https://login.microsoftonline.com/tenantid/oauth2/v2.0/token",
        "authorize_url": "https://login.microsoftonline.com/tenantid/oauth2/v2.0/authorize",
      }
      }`

Environment

(please complete the following information):

• browser type and version:
• superset version: superset version
• python version: python --version
• node.js version: node -v
• any feature flags active:

Checklist

Make sure to follow these steps before submitting your issue - thank you!

• I have checked the superset logs for python stacktraces and included it here as text if there are any.
• I have reproduced the issue with at least the latest released version of superset.
• I have checked the issue tracker for the same issue and I haven't found one similar.

Additional context

Add any other context about the problem here.

[sfirke]

The following works successfully for me - a little different than yours, including I have upn in my scope:

OAUTH_PROVIDERS = [
{
    "name": "azure",
    "icon": "fa-windows",
    "token_key": "access_token",
    "remote_app": {
        "client_id": [client_id],
        "client_secret": [secret],
        "api_base_url": "https://login.microsoftonline.com/[tenantid]/oauth2",
        "client_kwargs": {
            "scope": "User.read name preferred_username email profile upn groups",
            "resource": [client_id],
        },
        "request_token_url": None,
        "access_token_url": "https://login.microsoftonline.com/[tenantid]/oauth2/token",
        "authorize_url": "https://login.microsoftonline.com/[tenantid]/oauth2/authorize",
    },
},
]

[rusackas]

Assuming fixed based on the helpful comment from @sfirke (thanks!)

[Narender-007]

i am following above but getting upn error

{
"name": "azure",
"icon": "fa-windows",
"token_key": "access_token",
"remote_app": {
"client_id": "******************,
"client_secret": "*****************************15",
"api_base_url": "https://login.microsoftonline.com/*************************7e/oauth2",
"client_kwargs": {
"scope": "User.read name preferred_username email profile upn groups",
"resource": "************************e2",
},
"request_token_url": None,
"access_token_url": "https://login.microsoftonline.com/******************7e/oauth2/token",
"authorize_url": "https://login.microsoftonline.com/**********************7e/oauth2/authorize",
},
},

[houqp]

@Narender-007 in your azure ad app registration view, make sure you have upn added as an optional claim for access token.

[dcarvalhal]

How resolve the problem of authentication URL of superset is http and azure AD just accept https url?

[CisorKnight]

@dcarvalhal Facing the same issue here, did you manage to find a solution ?

[sharky93]

@CisorKnight @dcarvalhal you'll need ENABLE_PROXY_FIX = True set in your config

[Narender-007]

i am following above but getting upn error

{ "name": "azure", "icon": "fa-windows", "token_key": "access_token", "remote_app": { "client_id": "******************, "client_secret": "*****************************15", "api_base_url": "https://login.microsoftonline.com/*************************7e/oauth2", "client_kwargs": { "scope": "User.read name preferred_username email profile upn groups", "resource": "************************e2", }, "request_token_url": None, "access_token_url": "https://login.microsoftonline.com/******************7e/oauth2/token", "authorize_url": "https://login.microsoftonline.com/**********************7e/oauth2/authorize", }, },

Hello guys ,

[Narender-007]

i am following above but getting upn error
{ "name": "azure", "icon": "fa-windows", "token_key": "access_token", "remote_app": { "client_id": "******************, "client_secret": "*****************************15", "api_base_url": "https://login.microsoftonline.com/*************************7e/oauth2", "client_kwargs": { "scope": "User.read name preferred_username email profile upn groups", "resource": "************************e2", }, "request_token_url": None, "access_token_url": "https://login.microsoftonline.com/******************7e/oauth2/token", "authorize_url": "https://login.microsoftonline.com/**********************7e/oauth2/authorize", }, },

Hello guys ,

user this steps then login successfully have worked.

steps:
Go to Active Directory page select users
Create new user remember username and password
select app registration name
left side navigation Select owners click add users
Add this library authlib in requirements-local.txt file
restart docker container.

[Narender-007]

i am following above but getting upn error
{ "name": "azure", "icon": "fa-windows", "token_key": "access_token", "remote_app": { "client_id": "******************, "client_secret": "*****************************15", "api_base_url": "https://login.microsoftonline.com/*************************7e/oauth2", "client_kwargs": { "scope": "User.read name preferred_username email profile upn groups", "resource": "************************e2", }, "request_token_url": None, "access_token_url": "https://login.microsoftonline.com/******************7e/oauth2/token", "authorize_url": "https://login.microsoftonline.com/**********************7e/oauth2/authorize", }, },

Hello guys ,
Microsoft main din't login in superset

user this steps then login successfully have worked.

steps: Go to Active Directory page select users Create new user remember username and password select app registration name left side navigation Select owners click add users Add this library authlib in requirements-local.txt file restart docker container.

[CisorKnight]

Thanks @sharky93 redirection works with ENABLE_PROXY_FIX = True

I still have the error so I can't login but I feel like it's more Azure-side

[sfirke]

For future Superset admins using Azure AD, FYI that I have updated my Superset config to use the /v2.0 OAuth2 endpoint. This fixed a problem where we required 2-factor authentication on the Azure side but Superset login was only triggering a username/password login, causing the login to fail.

I have submitted the updated config back to Flask-AppBuilder as a pull request, in the meantime you can see it here: dpgaspar/Flask-AppBuilder#2350