Superset : Where to force an autologin

user_3974423 0
Viewed 3477

I am using superset 0.20.4

If I want to add a token to my URL to autologin to a specific user superset/dashboard/3?standalone=true&token=123456789

Where in the codes should I add a check on the token to login and force a user login action? something like : if request.args.get('token') == '123456789': login user xxx

How can I autologin ? I see lots of g.user being called but I don't see where the actual login process is being made. Where did the username/password/csrf_token get used to authenticate the user?

superset apache-superset python-2.7
1 Answers

If you're looking for anonymous/Public access to your dashboard, you should look into the Public role - which is documented here: https://superset.incubator.apache.org/security.html#public

and further here: https://flask-appbuilder.readthedocs.io/en/latest/security.html#role-based

If you have more sophisticated requirements, you should look into Flask App Builder (aka FAB) security model -which is documented here https://flask-appbuilder.readthedocs.io/en/latest/security.html- (Superset is a FAB app).

You can in particular override SecurityManager (from flask_appbuilder.security.sqla.manager).

In your specific case -where you're trying to auto-login users based on a token- it seems you might instead just be able to parse/verify the token and invoke auth_user_db (see BaseSecurityManager) in some view that doesn't require @has_access (see class AuthDBView in flask_appbuilder/security/views.py)

user_20209190
Related