feat(auth): integrate Keycloak authentication with SLO and configurable user roles

[miguel-saca]

SUMMARY

This PR integrates Keycloak authentication into Superset. The changes include:

• Modification of configuration files in docker/pythonpath_dev/ (i.e. superset_config.py and keycloak_security_manager.py) to support Keycloak integration.
• Implementation of Single Logout (SLO) by retrieving the ID token after authentication and using it during logout.
• Adjustment of new user role assignment: Instead of hardcoding the role to "Gamma", new users are now assigned the role defined in the environment variable AUTH_USER_REGISTRATION_ROLE. This allows production settings (e.g., setting AUTH_USER_REGISTRATION_ROLE=Admin) to be used without changing code.
• Updates to various Docker Compose manifests (docker-compose.yml, docker-compose-non-dev.yml, and docker-compose-image-tag.yml) and the .env file to properly reflect the changes for production deployment.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A (no UI changes)

TESTING INSTRUCTIONS

1. Run pre-commit run --all-files locally to ensure no linting or type-check errors occur.
2. Using the development environment:
   • Spin up the Superset stack via docker-compose -f docker-compose-image-tag.yml up -d.
   • Authenticate through Keycloak and verify that:
     • Upon first login, the new user is created with the role defined in the AUTH_USER_REGISTRATION_ROLE environment variable.
     • The ID token is correctly stored in the session and used during logout.
     • Logout correctly logs the user out on both Superset and Keycloak (i.e., the session is cleared).
3. Verify logs and check that the application behaves as expected regarding role assignment and logout flow.

ADDITIONAL INFORMATION

• Has associated issue: <if applicable, include issue reference, e.g., Fixes Adding a color factory #123>
• Required feature flags: None
• Changes UI: No
• Includes DB Migration (follow approval process in SIP-59):
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API: Yes – Keycloak integration with Single Logout and configurable role assignment
• Removes existing feature or API: No

[github-actions]

Congrats on making your first PR and thank you for contributing to Superset! 🎉 ❤️

We hope to see you in our Slack community too! Not signed up? Use our Slack App to self-register.

[korbit-ai]

Review by Korbit AI

Korbit automatically attempts to detect when you fix issues in new commits.

Category	Issue	Fix Detected
	Hardcoded secret and encryption keys found. ▹ view
	Non-configurable OIDC Client Secrets Path ▹ view

Files scanned

​

File Path	Reviewed
docker/pythonpath_dev/superset_config.py	✅
docker/pythonpath_dev/keycloak_security_manager.py	✅

Explore our documentation to understand the languages and file types we support and the files we ignore.

Need a new review? Comment /korbit-review on this PR and I'll review your latest changes.

Korbit Guide: Usage and Customization

Interacting with Korbit

• You can manually ask Korbit to review your PR using the /korbit-review command in a comment at the root of your PR.
• You can ask Korbit to generate a new PR description using the /korbit-generate-pr-description command in any comment on your PR.
• Too many Korbit comments? I can resolve all my comment threads if you use the /korbit-resolve command in any comment on your PR.
• Chat with Korbit on issues we post by tagging @korbit-ai in your reply.
• Help train Korbit to improve your reviews by giving a 👍 or 👎 on the comments Korbit posts.

Customizing Korbit

• Check out our docs on how you can make Korbit work best for you and your team.
• Customize Korbit for your organization through the Korbit Console.

Current Korbit Configuration

General Settings

​

Setting	Value
Review Schedule	Automatic excluding drafts
Max Issue Count	10
Automatic PR Descriptions	❌

Issue Categories

​

Category	Enabled
Naming	✅
Database Operations	✅
Documentation	✅
Logging	✅
Error Handling	✅
Systems and Environment	✅
Objects and Data Structures	✅
Readability and Maintainability	✅
Asynchronous Processing	✅
Design Patterns	✅
Third-Party Libraries	✅
Performance	✅
Security	✅
Functionality	✅

Feedback and Support

• Tell us what you think of Korbit
• Schedule a call with our team
• Email us @ [email protected]

Note

Korbit Pro is free for open source projects 🎉

Looking to add Korbit to your team? Get started with a free 2 week trial here

[korbit-ai]

Hardcoded secret and encryption keys found.

Tell me more

​

Security Issue: Hardcoded Secret Key and Encryption Key

The SECRET_KEY and ENCRYPTION_KEY are hardcoded with default values in the superset_config.py file. Hardcoding sensitive information like secret keys is a security risk because if the codebase is compromised, an attacker can easily obtain these keys and use them for malicious purposes.

To resolve this issue, remove the hardcoded default values and ensure the secret key and encryption key are loaded from environment variables or a secure secrets management system at runtime. Do not commit the actual key values in the codebase.

Chat with Korbit by mentioning @korbit-ai, and give a 👍 or 👎 to help Korbit improve your reviews.

[korbit-ai]

Non-configurable OIDC Client Secrets Path

Tell me more

What is the issue?

Hardcoded path to client secrets file could cause authentication failures if the file location changes or in different environments.

Why this matters

A non-configurable secrets file location reduces deployment flexibility and could break authentication if the file is stored elsewhere.

Suggested change ∙ Feature Preview

Make the client secrets path configurable via environment variable:

OIDC_CLIENT_SECRETS = os.getenv("OIDC_CLIENT_SECRETS", "/app/docker/pythonpath_dev/client_secret.json")

Chat with Korbit by mentioning @korbit-ai, and give a 👍 or 👎 to help Korbit improve your reviews.