OAuth (Keycloak) – No supported way to skip Superset login page and auto-redirect to IdP in 6.0.0

[iilrgmv]

Description

When using Superset 6.0.0 with OAuth authentication (Keycloak), there does not seem to be a supported or documented way to skip the default Superset login page (/login/) and redirect users directly to the external IdP login page (/login/keycloak).

This results in an extra, unnecessary intermediate page where the user must click a button to continue to Keycloak, even when:

• AUTH_TYPE = AUTH_OAUTH
• Only one OAuth provider is configured
• Superset is used in a corporate SSO context

In previous versions and in other frameworks, it is common to support an “auto-login” or “auto-redirect” behavior when a single OAuth provider is configured.

Environment

Superset version: 6.0.0

Authentication: AUTH_OAUTH

OAuth provider: Keycloak (OIDC)

Deployment: Kubernetes (Helm chart)

Reverse proxy / ingress: Yes (HTTPS)

Current behavior

User accesses https:///

Superset redirects to /login/

Superset displays a login page with a button (e.g. “Login with Keycloak”)

User must manually click the button

Only then is the user redirected to Keycloak

Expected behavior

When:

AUTH_TYPE = AUTH_OAUTH

Only one OAuth provider is configured

Superset should provide a built-in and supported way to:

Automatically redirect users from /login/ to /login/

Or allow configuration to skip the intermediate login page entirely

• This is especially important for:
• Enterprise SSO setups
• Better UX (no unnecessary clicks)
• Consistency with other OAuth-enabled platforms

What we tried

• Looked for a configuration option such as AUTH_OAUTH_AUTO_LOGIN or similar (not found / not documented)
• Checked Superset and Flask-AppBuilder documentation
• Reviewed existing issues and discussions
• Implemented a custom AuthOAuthView override to force the redirect (works, but is a workaround and not officially supported)

Why this matters

• The current behavior adds friction to SSO flows
• Forces users to see an internal Superset login page even when local login is not used
• Requires custom code overrides for a very common OAuth use case
• Proposed solution (open to discussion)

One of the following:

• Add a documented configuration flag to auto-redirect to the sole OAuth provider
• Provide an official hook or setting to override /login/ behavior
• Document the recommended pattern if overriding the login view is the intended approach

Additional context

This is not a security issue, but a UX and configurability limitation that affects enterprise OAuth deployments.

[dosubot[bot]]

Hi @iilrgmv! I'm Dosu and I’m helping the superset team.

There isn't a built-in or documented configuration option in Superset 6.0.0 to auto-redirect from the login page to your sole OAuth provider (like Keycloak) and skip the intermediate login screen. This is due to architectural changes in Superset 6, which removed previous extension points for customizing the login flow via configuration alone. The recommended approach is to subclass AuthOAuthView, override the login() method to perform the redirect when only one provider is configured, and register this via a custom security manager in your superset_config.py—see this example implementation.

A feature flag, OAUTH_SKIP_PROVIDER_SELECTION, was introduced after 6.0.0 to address this use case. When enabled, and only one OAuth provider is configured, it will skip the provider selection screen and forward users directly to the OAuth provider. This flag is not available in 6.0.0, so upgrading to a newer version is required to use it details.

For now, in 6.0.0, the custom AuthOAuthView override is the supported pattern. Using an @app.before_request redirect is possible but not recommended for production, as it may break with future updates discussion.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[iilrgmv]

@dosu Thanks! Could you please confirm in which Superset version this PR will be released? And when will it be launched?
We are currently on 6.0.0 and cannot rely on unreleased functionality yet.

[rsaleev]

I use mutation in superset_config.py

def FLASK_APP_MUTATOR(app):
    """Modify Flask app after creation"""
    import logging

    from flask import g, redirect, request, url_for, session

    log = logging.getLogger(__name__)

    @app.before_request
    def require_login():
        if request.endpoint and (
            request.endpoint.startswith("static")
            or request.endpoint
            in {
                # custom
                "KeycloakOAuthView.login",
                "KeycloakOAuthView.oauth_authorized",
                "KeycloakOAuthView.logout",
                # FAB
                "security.logout",
                "SecurityApi.login",  # Add FAB API endpoints
                "SecurityApi.refresh",
                "AuthDBView.login",
                "SupersetAuthView.login",
                "SecurityApi.login",
                "SecurityApi.refresh",
                # system
                "health.health",
                "HealthView.show",
            }
        ):
            return None

        if g.user is None or not getattr(g.user, "is_authenticated", False):
            log.info(
                f"🔐 Redirecting unauthenticated access to {request.endpoint} → Keycloak"
            )
            session["next"] = request.url
            return redirect(
                url_for(
                    "KeycloakOAuthView.login",
                    provider="keycloak", 
                    _external=True,
                )
            )

    log.info("✅ FLASK_APP_MUTATOR registered - auth enforcement active")
    
    

use this mutator. Just check enpoints naming

class KeycloakOAuthView(AuthOAuthView):
    @expose("/login/")
    @expose("/login/<provider>")