This PR is a significant refactor for AUTH_LDAP and AUTH_OAUTH.

Aside adding significant unit testing, and resolving many issues, it implements a feature with AUTH_ROLES_MAPPING to allow mapping LDAP/OAUTH groups to FAB Roles.

For more information, please see the updated docs/security.rst

Resolves:

• #518
• #956
• #1123
• https://github.com/apache/airflow/issues/8179
• https://github.com/apache/incubator-superset/issues/3419

Superseeds these PRs:

• #770

Thought I'd start working on a way to map LDAP groups to FAB roles (discussion started in #518). The proposal would be as follows: In the config file one could define a dict with mappings from FAB role to LDAP group. During login there would be two ways of checking membership: either gathering all membersOf from the user result, or iterating over all groups in the dict and checking if the user is a member (whichever the admin deems more economical or appropriate). Finally the results would be compared to the existing roles, and the diff would be sent to the backend, removing roles that have been removed and adding those that had been added. Thoughts?

Ping @bolkedebruin @periscube

I'm trying to figure out doing REST queries to edit data and not finding a lot of documentation / examples. I can do a GET on https://localhost/contactmodelview/json to get a dump of the table in json. But if I want to delete an entry, it seems I need to use the action option. When I try:

http://localhost/contactmodelview/action/delete/1

I get permission denied. Looking at the code, it seems the action needs to match a permission in the permissions table, so I tried

http://localhost/contactmodelview/action/can_delete/1

but that gives me an error:

2014-10-28 14:02:22,673:ERROR:app:Exception on /contactmodelview/action/can_delete/1 [GET]
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1817, in wsgi_app
    response = self.full_dispatch_request()
  File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1477, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1381, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1475, in full_dispatch_request
    rv = self.dispatch_request()
  File "/usr/lib/python2.7/dist-packages/flask/app.py", line 1461, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/usr/lib/python2.7/dist-packages/flask_appbuilder/views.py", line 278, in action
    return action.func(self.datamodel.get(pk))
AttributeError: 'NoneType' object has no attribute 'func'
[pid: 28451|app: 0|req: 127/127] 192.168.0.178 () {52 vars in 1917 bytes} [Tue Oct 28 14:02:22 2014] GET /app/contactmodelview/action/can_delete/1 => generated 291 bytes in 213 msecs (HTTP/1.1 500) 2 headers in 84 bytes (1 switches on core 0)

When I view a table, I get blue hyperlinks on many column that allow me to sort on that view (toggling on click between ascending and descending). But some columns don't have the blue hyperlinks. It seems that String columns are the ones I can't sort, while Date, Boolean and Integer columns are sorta-able. Is this known behavior? If so, what would it take to be able to sort on strings?

Maybe I am not really understanding edit_form_query_rel_fields, but this is a pretty important feature. Build a filter to the drop down list based on the selection of previous drop down lists.

Usecase user select category A from form field 1. User can then only select subsets of category A from form field 2.

Is there an easy way of doing this

PS 0.10 looks rad

I reported this on a side note in #432, but I feel, it would be more appropriate to file a new issue:

Versions

• Python 3.4.5

Flask==0.12.1
Flask-AppBuilder==1.8.1
Flask-Babel==0.11.1
Flask-Cache==0.13.1
Flask-Login==0.2.11
Flask-Migrate==1.5.1
Flask-OpenID==1.2.5
Flask-Script==2.0.5
Flask-SQLAlchemy==2.0
Flask-Testing==0.6.1
Flask-WTF==0.14.2
superset==0.17.3

Expected results

Logging in with a previously not registered user results in a new user account created from the information gathered from LDAP with all corresponding fields (fisrt name, last name,…) filled out correctly.

Actual results

Login works and so does the creation of the user account. However, while the username field is filled out correctly, other fields, such as first_name or last_name:

It should be noted that this behavior is only present in a python 3 environment. When run in a python 2.7 venv, everything works as expected.

Thanks very much for the framework released, i have read lot of interesting parts and play around with it, it's very handy for fast application development

However i have a little question to ask,

I have to defined ModelView classes, I want to add and edit new items inherited from the master Class as shown here. but while editing the sub model, how do I pass the the parent value to the child class? how do i render that in the template?

class ChildView(ModelView):
    datamodel = SQLAInterface(Child)
    add_template = 'child_add.html'

    list_columns = ['child_id', 'parent_id' 'name']
    list_widget = ListThumbnail
    add_widget = FormWidget
    include_cols =  ['child_id', 'parent_id' 'name']
    value_columns =  ['child_id', 'parent_id' 'name']
    add_columns =  ['child_id', 'parent_id' 'name']

class ParentView(ModelView):

    datamodel = SQLAInterface(Parent)
    list_widget = ListItem

    list_columns = ['parent']
    related_views = [ChildView]

Unfortunately, there is nothing displaying in my child_add.html template as indicated in the tutorial as follow. can you suggest what's the best approach of rendering elements in the templates?

{% import 'appbuilder/general/lib.html' as lib %}
{% extends 'appbuilder/general/widgets/base_list.html' %}

{% block list_header %}
   {{ super() }}
   <a href="url_for('Class.method for my control')" class="btn btn-sm btn-primary"
        <i class="fa fa-rocket"></i>
   </a>
{% endblock %}

{% block begin_loop_values %}
    {% for item in value_columns %}
        {% set pk = pks[loop.index-1] %}
        {% if actions %}
            <input id="{{pk}}" class="action_check" name="rowid" value="{{pk}}" type="checkbox">
        {% endif %}
        {% if can_show or can_edit or can_delete %}
            {{ lib.btn_crud(can_show, can_edit, can_delete, pk, modelview_name, filters) }}
        {% endif %}
        </div>

        {% for value in include_columns %}
            <p {{ item[value]|safe }}</p>
        {% endfor %}

        {% for value in list_columns %}
            <p {{ item[value]|safe }}</p>
        {% endfor %}


        {% for value in value_columns %}
            <p {{ item[value]|safe }}</p>
        {% endfor %}


        {% for value in add_columns %}
            <p {{ item[value]|safe }}</p>
        {% endfor %}



    {% endfor %}
{% endblock %}

Adds new mapping table to link users with multiple roles. Tested and works, however, because it changes the ab_user table (removes the role_id column) and needs another table for role mapping, it breaks FAB when used with already existing database.

This is not ready to be merged in yet, but I did a pull request to keep comments and code in a central place. Hopefully I can add migration stuff and then we can do a merge if everything looks good.

Migration should be easy (drop column, add mapping table and do insert based on user's role_id) but I'm not sure where / how to put that.

Help me, plz! Make MultipleView with search. https://flask-appbuilder.readthedocs.io/en/latest/quickhowto.html?highlight=multiple We need an independent search for every list on the page. How to do it?

If you select filters at the top and click search, then they are reset to the bottom sheet. And vice versa.

I am having a problem working with related views. An Event has many Attendees. You can see a snapshot of the models here:

class Attendee(db.Model):
    __bind_key__ = 'WILL_DB'
    __tablename__ = 'attendee'

    id = Column(INTEGER, primary_key=True)
    event_id = Column(INTEGER, index=True)
    ...

    Event = relationship('Event', primaryjoin="Attendee.event_id == foreign(Event.id)")


class Event(db.Model):
    __bind_key__ = 'WILL_DB'
    __tablename__ = 'event'

    id = Column(INTEGER, primary_key=True)
    rep_id = Column(String(50), nullable=False, server_default=text("''"))
    ...

My view functions are as follows

class AttendeeView(ModelView):
    datamodel = SQLAInterface(Attendee)
    list_columns = [x.name for x in Attendee.__table__.columns]
    list_columns.remove("signature")
    list_columns.remove("hcp_data")

    show_columns = [x.name for x in Attendee.__table__.columns]
    show_columns.remove("signature")
    show_columns.remove("hcp_data")


class EventView(ModelView):
    datamodel = SQLAInterface(Event)
    related_views = [AttendeeView]
    show_template = 'appbuilder/general/model/show_cascade.html'

...and registering:

appbuilder.add_view(
    EventView,
    "Events",
    icon="fa-calendar",
    category="WILL Support",
    category_icon="fa-wheelchair"
)
appbuilder.add_view(
    AttendeeView,
    "Attendees",
    icon="fa-user",
    category="WILL Support",
    category_icon="fa-wheelchair"
)

When navigating to a /eventview/show/10 page for example, I get this output

  File "<project_root>/app/templates/appbuilder/general/model/show_cascade.html", line 15, in template
    {{ widgets.get('related_views')[loop.index - 1](pk = pk)|safe }}
TypeError: 'NoneType' object is not callable

When debugging it seems that in this block which in in the file show_cascade.html and similarly in the other show htmls files.

{% block related_views %}
    {% if related_views is defined %}
        {% for view in related_views %}
            {% call lib.accordion_tag(view.__class__.__name__,view.title, False) %}
                {{ widgets.get('related_views')[loop.index - 1](pk = pk)|safe }}
            {% endcall %}
        {% endfor %}
    {% endif %}
{% endblock related_views %}

The variable related_views contains the appropriate AttendeeView however, widgets['related_views'] has nothing.

Is there an issue with my relationship? This is an old database that doesn't have the correct key setups so I need to do the relationship this way : Event = relationship('Event', primaryjoin="Attendee.event_id == foreign(Event.id)")

Same data as this issue #973

Say an item is clicked in row, how to take user to new page and populate it and showing more detailed view associated with that row?

Correction:

Expanded view of the selected row underneath clicked row with more details about that particular row, NOT navigating away from it.

Environment

Flask-Appbuilder version: Flask-AppBuilder==3.4.5

Describe the expected results

I expected the ability for users to filter on additional fields on top of the parent ID in a related list view, similar to the usual list modelview. Is this possible in any way? Main reason is for select-all and and multiple item actions it would be useful when you have lots of child items.

Right now it seems to need leaving the related view and navigating to the child item's own list view and then manually configuring the same parent ID filter along with the extra filters - which is a bit unfriendly when everything else already accessible from the related_view.

Is this behaviour supported in any way or on the roadmap?

Describe the actual results

Any filtering queries via GET do not filter the related_view items, and the search accordion isn't present for related_views.

Steps to reproduce

Description

Release 4.2.0 for early testing

ADDITIONAL INFORMATION

• [ ] Has associated issue:
• [ ] Is CRUD MVC related.
• [ ] Is Auth, RBAC security related.
• [ ] Changes the security db schema.
• [ ] Introduces new feature
• [ ] Removes existing feature

In the following example, API_BASE_URL is an https:// URL with self-signed certificates.

Requests fail with

[2022-12-20T18:17:49.363+0000] {views.py:659} ERROR - Error authorizing OAuth access token: HTTPSConnectionPool(host='keycloak.redacted.redacted, port=443): Max retries exceeded with url: /auth/realms/redacted/protocol/openid-connect/token (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1129)')))

How can we either:

• Set TLS verification to false, or
• Preferably, point FAB OAUTH_PROVIDERS config to a CA bundle to validate the cert?

OAUTH_PROVIDERS = [
    {
        "name": "keycloak",
        "token_key": "access_token",
        "icon": "fa-key",
        "remote_app": {
            "api_base_url": API_BASE_URL,
            "client_kwargs": {"scope": "email profile"},
            "access_token_url": f"{API_BASE_URL}/token",
            "authorize_url": f"{API_BASE_URL}/auth",
            "request_token_url": None,
            "client_id": CLIENT_ID,
            "client_secret": CLIENT_SECRET,
        },
    }
]

Environment

Flask-Appbuilder version: 4.1.6

pip freeze output:

alembic==1.8.1
apispec==3.3.2
attrs==22.1.0
Babel==2.11.0
certifi==2022.12.7
charset-normalizer==2.1.1
click==8.1.3
colorama==0.4.6
dnspython==2.2.1
email-validator==1.3.0
Flask==2.2.2
Flask-AppBuilder==4.1.6
Flask-Babel==2.0.0
Flask-JWT-Extended==4.4.4
Flask-Login==0.6.2
Flask-Migrate==4.0.0
Flask-SQLAlchemy==2.5.1
Flask-WTF==1.0.1
greenlet==2.0.1
idna==3.4
itsdangerous==2.1.2
Jinja2==3.1.2
jsonschema==4.17.3
Mako==1.2.4
MarkupSafe==2.1.1
marshmallow==3.19.0
marshmallow-enum==1.5.1
marshmallow-sqlalchemy==0.26.1
packaging==22.0
prison==0.2.1
PyJWT==2.6.0
pyrsistent==0.19.2
python-dateutil==2.8.2
pytz==2022.6
PyYAML==6.0
requests==2.28.1
six==1.16.0
SQLAlchemy==1.4.45
SQLAlchemy-Utils==0.38.3
urllib3==1.26.13
Werkzeug==2.2.2
WTForms==3.0.1

Describe the expected results

I would like to be able to show, edit or delete the resources from this model inside the GUI

class Company(Model, dict):
    """ Tag """
    id = Column(Integer, primary_key=True)
    name = Column(String(50), unique=True, nullable=False)
    code_name = Column(String(10), unique=True, nullable=False)
    subscription_expiration = Column(Date(), nullable=False)

    tags = relationship(
        "Tag", secondary=association_company_tag_table, backref="companies")
    employees = relationship("Recipient", back_populates="company", cascade="all, delete-orphan")


    def __repr__(self):
        return self.name

Describe the actual results

When I try to show, edit or delete a model that inherits from dict it returns a 404 with a valid pk

Steps to reproduce

Using the model above in a model view

Solution

On the BaseCRUDView class (file baseviews.py: L1185, L1239 and L1294) The checking for existing record is done like this

item = self.datamodel.get(pk, self._base_filters)
if not item:
    abort(404)

By doing it this way, it is working and does not abort with my model

item = self.datamodel.get(pk, self._base_filters)
if item is None:
    abort(404)

Was the first way implemented purposely or is it possible to make pull request to fix this issue? Thank you for your time

i deployed Superser with Docker-Compose,and want to login in and authory with ldap. there is my superset_confug.py

#AUTHENTICATION FONFIG
104 AUTH_TYPE = AUTH_LDAP
105 AUHT_USER_REGISTRATION = True
106 AUTH_USER_REGISTRATION_ROLE = "Alpha"
107 AUTH_LDAP_UID_FIELD = "cn"
108 AUTH_LDAP_FIRSTNAME_FIELD = "givenName"
109 AHTU_LDAP_LASTNAME_FIELD= "sn"
110 AUTH_LDAP_EMAIL_FIELD = "mail"
112 AUTH_LDAP_SERVER = "ldap://xxxxxx:389"
114 AUTH_LDAP_SEARCH = "cn=%s,ou=groups,dc=xx,dc=xx"

With the above configuration,I can login wiht ldap user，but already in Superset.It is Seem that `AUHT_USER_REGISTRATION = True' not working.Because when login with the user both in ldap and Superset, ldap can verify the password. If the user not in Superset,it can not login.

Users in Superset

Users in ldap

The user test3 can not login in Superset,but others is ok.

If you'd like to report a bug in Flask-Appbuilder, fill out the template below. Provide any extra information that may be useful

Responsible disclosure: We want to keep Flask-AppBuilder safe for everyone. If you've discovered a security vulnerability please report to [email protected].

Environment

Flask-Appbuilder version:

pip freeze output: Flask-Appbuilder version==4.1.4

Describe the expected results

We are currently running Airflow 2.4.3 on Kubernetes with the Airflow Community helm chart version 8.6.1 (located here: https://github.com/airflow-helm/charts).

We have enabled Azure OAuth authentication for our webserver. This should bring up our webserver with an "login with azure" button and we should be able to click it and log in just fine. This is our webserver_config that we are using:

from flask_appbuilder.security.manager import AUTH_OAUTH
from airflow.www.security import AirflowSecurityManager
import logging
from typing import Dict, Any, List, Union
import os
import sys

#Add this as a module to pythons path
sys.path.append('/opt/airflow')

log = logging.getLogger(__name__)
log.setLevel(os.getenv("AIRFLOW__LOGGING__FAB_LOGGING_LEVEL", "DEBUG"))

class AzureCustomSecurity(AirflowSecurityManager):
    # In this example, the oauth provider == 'azure'.
    # If you ever want to support other providers, see how it is done here:
    # https://github.com/dpgaspar/Flask-AppBuilder/blob/master/flask_appbuilder/security/manager.py#L550
    def get_oauth_user_info(self, provider, resp):
        # Creates the user info payload from Azure.
        # The user previously allowed your app to act on their behalf,
        #   so now we can query the user and teams endpoints for their data.
        # Username and team membership are added to the payload and returned to FAB.
        if provider == "azure":
            log.debug("Azure response received : {0}".format(resp))
            id_token = resp["id_token"]
            log.debug(str(id_token))
            me = self._azure_jwt_token_parse(id_token)
            log.debug("Parse JWT token : {0}".format(me))
            return {
                "name": me.get("name", ""),
                "email": me["upn"],
                "first_name": me.get("given_name", ""),
                "last_name": me.get("family_name", ""),
                "id": me["oid"],
                "username": me["oid"],
                "role_keys": me.get("roles", []),
            }

# Adding this in because if not the redirect url will start with http and we want https
os.environ["AIRFLOW__WEBSERVER__ENABLE_PROXY_FIX"] = "True"
WTF_CSRF_ENABLED = False
CSRF_ENABLED = False
AUTH_TYPE = AUTH_OAUTH
AUTH_ROLES_SYNC_AT_LOGIN = True  # Checks roles on every login
# Make sure to replace this with the path to your security manager class
FAB_SECURITY_MANAGER_CLASS = "webserver_config.AzureCustomSecurity"
# a mapping from the values of `userinfo["role_keys"]` to a list of FAB roles
AUTH_ROLES_MAPPING = {
    "airflow_dev_admin": ["Admin"],
    "airflow_dev_op": ["Op"],
    "airflow_dev_user": ["User"],
    "airflow_dev_viewer": ["Viewer"]
    }
# force users to re-auth after 30min of inactivity (to keep roles in sync)
PERMANENT_SESSION_LIFETIME = 1800
# If you wish, you can add multiple OAuth providers.
OAUTH_PROVIDERS = [
    {
        "name": "azure",
        "icon": "fa-windows",
        "token_key": "access_token",
        "remote_app": {
            "client_id": "CLIENT_ID",
            "client_secret": 'AZURE_DEV_CLIENT_SECRET',
            "api_base_url": "https://login.microsoftonline.com/TENANT_ID",
            "request_token_url": None,
            'request_token_params': {
                'scope': 'openid email profile'
            },
            "access_token_url": "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token",
            "access_token_params": {
                'scope': 'openid email profile'
            },
            "authorize_url": "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize",
            "authorize_params": {
                'scope': 'openid email profile',
            },
            'jwks_uri':'https://login.microsoftonline.com/common/discovery/v2.0/keys',
        },
    },
]

Describe the actual results

Instead, we are getting this error after we click the Azure button:

[2022-11-28 22:04:58,744] {views.py:659} ERROR - Error authorizing OAuth access token: mismatching_state: CSRF Warning! State not equal in request and response. airflow-web [2022-11-28 22:04:58,744] {views.py:659} ERROR - Error authorizing OAuth access token: mismatching_state: CSRF Warning! State not equal in request and response.

Steps to reproduce

Running Airflow 2.4.3 on Kubernetes with the Airflow Community helm chart version 8.6.1 and using the webserver_config file like above. When the webserver is running, you click on the "login to azure" button.

Additional Comments

I already posted an issue like this in the Airflow repo, and they said this could more then likely be a Flask problem, which is why I am making this issue here. If any other information is needed please let me know