Feature: redirect after login/register with OAuth #910

betodealmeida · 2019-02-12T19:23:20Z

Currently, after a user goes through the authentication flow they are sent to the index page, instead of the page they tried to visit initially.

I improved the flow by storing the initial URL in a state parameter, that is signed and sent to the OAuth provider [see docs]. One the user has been authenticated, the state parameter received back from the provider is used to redirect them to the initial URL.

Note that the state is signed, to avoid a malicious provider of redirecting the user to a URL they control.

I tested the workflow with Superset, and it works as expected. I only tested with Google OAuth.

mistercrunch

This LGTM though I'm not an expert on auth/oauth/jwt, @dpgaspar should have the final word

coveralls · 2019-02-12T22:20:26Z

Coverage decreased (-0.1%) to 70.224% when pulling 7d80f7e on betodealmeida:VIZ-237 into c665558 on dpgaspar:master.

betodealmeida · 2019-02-12T23:29:31Z

flask_appbuilder/templates/appbuilder/general/security/login_oauth.html

@@ -5,8 +5,9 @@

 <script type="text/javascript">

-var baseLoginUrl = {{url_for('AuthOAuthView.login')}};
-var baseRegisterUrl = {{url_for('AuthOAuthView.login')}};
+var baseLoginUrl = "{{url_for('AuthOAuthView.login')}}";


This was interesting... we're missing the quotes, so this actually gets translated to:

var baseLoginUrl = /login/;

Which works because it defines a regular expression that later gets cast to a string when it's concatenated to currentSelection!

It's ok, I blame Javascript. :)

Hello @dpgaspar @betodealmeida ,
I have following test case scenario , is it taken care in testing or not?

If some one logged in to FlaskAppBuilder using twitter account and in between someone delete/disable his twitter account then is user still able to use FlaskAppBuilder app (if he did not logout manually) or get Access Denied Error and How we are validating user authenticity in running application.

dpgaspar · 2019-02-13T00:03:53Z

Looks good, I'll test it with some other providers.

dpgaspar · 2019-02-16T17:51:02Z

Hi,

Testing with google oauth provider, using a simple login I get redirected to http://localhost:8080/None

Can you help?

betodealmeida · 2019-02-20T19:10:34Z

Yeah, let me take a look.

dpgaspar · 2019-02-20T20:38:23Z

thks!

…Z-237

betodealmeida · 2019-02-28T21:57:36Z

@dpgaspar I fixed the None issue. I tested with the Flask-AppBuilder-Skeleton repo and it works as expected now.

betodealmeida · 2019-03-04T16:58:56Z

Ping @dpgaspar

dpgaspar · 2019-03-04T19:26:22Z

It fails on twitter:

2019-03-04 19:18:51,910:DEBUG:flask_appbuilder.security.views:User info retrieved from twitter: {'username': 'twitter_danielvazgaspar'}
2019-03-04 19:18:51,910:DEBUG:flask_appbuilder.security.views:No whitelist for OAuth provider
2019-03-04 19:18:52,013:INFO:flask_appbuilder.security.sqla.manager:Added user twitter_danielvazgaspar
2019-03-04 19:18:52,074:INFO:flask_appbuilder.security.sqla.manager:Updated user  
2019-03-04 19:18:52,098:INFO:werkzeug:127.0.0.1 - - [04/Mar/2019 19:18:52] "GET /oauth-authorized/twitter?oauth_token=XXX&oauth_verifier=YYYY HTTP/1.1" 500 -
Traceback (most recent call last):
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/app.py", line 2309, in __call__
    return self.wsgi_app(environ, start_response)
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/app.py", line 2295, in wsgi_app
    response = self.handle_exception(e)
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/app.py", line 1741, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/_compat.py", line 35, in reraise
    raise value
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/app.py", line 2292, in wsgi_app
    response = self.full_dispatch_request()
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/app.py", line 1815, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/app.py", line 1718, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/_compat.py", line 35, in reraise
    raise value
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/app.py", line 1813, in full_dispatch_request
    rv = self.dispatch_request()
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask-1.0.2-py3.6.egg/flask/app.py", line 1799, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Flask_AppBuilder-1.12.3-py3.6.egg/flask_appbuilder/security/views.py", line 563, in oauth_authorized
    request.args['state'],
  File "/home/dpgaspar/workarea/YYYY/venv3/lib/python3.6/site-packages/Werkzeug-0.14.1-py3.6.egg/werkzeug/datastructures.py", line 431, in __getitem__
    raise exceptions.BadRequestKeyError(key)
werkzeug.exceptions.HTTPException.wrap.<locals>.newcls: 400 Bad Request: KeyError: 'state'

As you can see auth works ok, and self registers the user, but there is no state on the request.args

betodealmeida · 2019-03-05T09:45:47Z

Looks like state is not supported by Twitter (https://twittercommunity.com/t/is-the-state-parameter-supported/1889). The thread suggests using a callback, I'll have to read more about it to get it working.

betodealmeida · 2019-03-05T10:25:27Z

@dpgaspar I fixed the Twitter redirect. It doesn't accept the state payload, but unlike Google/Facebook it allows it in the URL, so all I had to do was change the call to authorize.

I also fixed the Twitter registration: the returned user info has only the username.

ankursinghal2005 · 2019-03-05T15:24:23Z

flask_appbuilder/security/decorators.py

@@ -27,7 +27,7 @@ def wraps(self, *args, **kwargs):
        else:
            log.warning(LOGMSG_ERR_SEC_ACCESS_DENIED.format(permission_str, self.__class__.__name__))
            flash(as_unicode(FLAMSG_ERR_SEC_ACCESS_DENIED), "danger")
-        return redirect(url_for(self.appbuilder.sm.auth_view.__class__.__name__ + ".login"))
+        return redirect(url_for(self.appbuilder.sm.auth_view.__class__.__name__ + ".login", next=request.url))


I see this fix for only AuthOAuthView, but how do ensure this next=request.url variable will be utilized in AuthDBView, AuthLDAPView,
AuthRemoteUserView and they are sent to the index page, instead of the page they tried to visit initially.

True @ankursinghal2005, One would have to replicate the same logic to all child classes.

Hey @betodealmeida are willing to do it?

I'm not the right person to do it, since I don't have access to an LDAP auth server. Maybe @ankursinghal2005 can do it for the auth system they're using?

@betodealmeida
I have tested below LDAP test server. It is working fine. You can see it for your reference. I can further work on remaining child classes after this PR gets merged into master.

Online LDAP Test Server Link
https://www.forumsys.com/tutorials/integration-how-to/ldap/online-ldap-test-server/

When using LDAP Auth, setup the ldap server

AUTH_TYPE = AUTH_LDAP
AUTH_LDAP_SERVER = "ldap://ldap.forumsys.com:389"
AUTH_LDAP_SEARCH = "dc=example,dc=com"
AUTH_LDAP_BIND_USER = "uid=riemann,dc=example,dc=com"
AUTH_LDAP_BIND_PASSWORD = "password"

dpgaspar · 2019-03-08T19:23:31Z

Looks good, nice work!

dpgaspar · 2019-03-09T11:18:27Z

Just released 1.12.4 with this

Redirect after login/register

e971558

mistercrunch approved these changes Feb 12, 2019

View reviewed changes

betodealmeida commented Feb 12, 2019

View reviewed changes

dpgaspar added the enhancement label Feb 12, 2019

dpgaspar added the pending label Feb 16, 2019

betodealmeida added 2 commits February 28, 2019 13:55

Fix no next page

8aee1ad

Merge branch 'master' of github.com:dpgaspar/Flask-AppBuilder into VI…

60fef9f

…Z-237

betodealmeida mentioned this pull request Mar 5, 2019

Redirection to shared url after login apache/superset#6921

Closed

Fix Twitter redirect and registration

7d80f7e

ankursinghal2005 reviewed Mar 5, 2019

View reviewed changes

dpgaspar approved these changes Mar 8, 2019

View reviewed changes

dpgaspar merged commit 2ac6a87 into dpgaspar:master Mar 8, 2019

dpgaspar removed the pending label Mar 9, 2019

paulvic mentioned this pull request Aug 27, 2019

Custom OAuth issue apache/superset#7739

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature: redirect after login/register with OAuth #910

Feature: redirect after login/register with OAuth #910

betodealmeida commented Feb 12, 2019

mistercrunch left a comment

coveralls commented Feb 12, 2019 •

edited

betodealmeida Feb 12, 2019

dpgaspar Feb 12, 2019

betodealmeida Feb 13, 2019

jitendra-kumawat Mar 7, 2019 •

edited

dpgaspar commented Feb 13, 2019

dpgaspar commented Feb 16, 2019

betodealmeida commented Feb 20, 2019

dpgaspar commented Feb 20, 2019

betodealmeida commented Feb 28, 2019

betodealmeida commented Mar 4, 2019

dpgaspar commented Mar 4, 2019

betodealmeida commented Mar 5, 2019

betodealmeida commented Mar 5, 2019

ankursinghal2005 Mar 5, 2019

dpgaspar Mar 5, 2019

betodealmeida Mar 5, 2019

ankursinghal2005 Mar 6, 2019 •

edited

dpgaspar Mar 6, 2019

dpgaspar commented Mar 8, 2019

dpgaspar commented Mar 9, 2019

Feature: redirect after login/register with OAuth #910

Feature: redirect after login/register with OAuth #910

Conversation

betodealmeida commented Feb 12, 2019

mistercrunch left a comment

Choose a reason for hiding this comment

coveralls commented Feb 12, 2019 • edited

betodealmeida Feb 12, 2019

Choose a reason for hiding this comment

dpgaspar Feb 12, 2019

Choose a reason for hiding this comment

betodealmeida Feb 13, 2019

Choose a reason for hiding this comment

jitendra-kumawat Mar 7, 2019 • edited

Choose a reason for hiding this comment

dpgaspar commented Feb 13, 2019

dpgaspar commented Feb 16, 2019

betodealmeida commented Feb 20, 2019

dpgaspar commented Feb 20, 2019

betodealmeida commented Feb 28, 2019

betodealmeida commented Mar 4, 2019

dpgaspar commented Mar 4, 2019

betodealmeida commented Mar 5, 2019

betodealmeida commented Mar 5, 2019

ankursinghal2005 Mar 5, 2019

Choose a reason for hiding this comment

dpgaspar Mar 5, 2019

Choose a reason for hiding this comment

betodealmeida Mar 5, 2019

Choose a reason for hiding this comment

ankursinghal2005 Mar 6, 2019 • edited

Choose a reason for hiding this comment

When using LDAP Auth, setup the ldap server

dpgaspar Mar 6, 2019

Choose a reason for hiding this comment

dpgaspar commented Mar 8, 2019

dpgaspar commented Mar 9, 2019

coveralls commented Feb 12, 2019 •

edited

jitendra-kumawat Mar 7, 2019 •

edited

ankursinghal2005 Mar 6, 2019 •

edited