Superset secondary login-free method based on Keycloak

Abstract

The application provides a Keycloak-based Superset secondary login-free method, which comprises the following steps: S1, a cookie of a web analysis application authenticated by Keycloak is requested to access a conversion service; S2, the cookie is converted into authentication content after Superset authentication; S3, the authentication content is returned to a browser in the form of http 302 redirection; and S4, the Superset address embedded in an iframe is accessed by the browser carrying the authentication content, and authentication is successful. The Keycloak-based Superset secondary login-free method provided by the application solves the problem that the Superset page embedded in the iframe cannot be logged in, reduces the overall login times from two times to one time, and greatly improves the user experience.

Description

Technical Field

[0001] This invention relates to the field of software application technology, and in particular to a method for Superset that eliminates the need for secondary login based on Keycloak. Background Technology

[0002] Superset is a modern enterprise-grade business intelligence web application that provides a lightweight data query and visualization solution for data analysis by creating and sharing dashboards. Superset offers many advantages, including: it comes with a built-in SQLite database and supports connections to almost all major data sources such as Hive, Impala, MySQL, and Oracle; it supports chord diagrams, event flow diagrams, heatmaps, view tables, and other common visualization charts; it supports controllable data display, allowing customization of display fields and data sources; it supports access control to meet the different user requirements for data and database permissions; and it includes an SQL query panel module and a user-friendly interface.

[0003] An iframe is an embedded frame that allows the content of a webpage to be embedded into an existing webpage. Currently, when embedding Superset reports using an iframe through a browser, due to browser security policies and Superset's own authentication implementation, the Superset page embedded in the iframe cannot obtain and use the authentication information of external web analytics applications. Therefore, Superset currently does not support login-free embedding via iframes. Summary of the Invention

[0004] The purpose of this invention is to provide a method for Superset to avoid secondary login based on Keycloak, which solves the problem that Superset currently does not support login-free access when embedding an iframe.

[0005] To achieve the above objectives, this invention provides a method for Superset without secondary login based on Keycloak, comprising the following steps:

[0006] S1. Request to access the conversion service with a cookie from a web analytics application that has been authenticated by Keycloak;

[0007] S2. Convert the cookie into authentication content after Superset authentication;

[0008] S3. Return the authentication content to the browser via an HTTP 302 redirect;

[0009] S4. Access the Superset address embedded in the iframe through the browser carrying the authentication content, and successfully authenticate.

[0010] Optionally, S1 specifically includes:

[0011] S11. Log in to the web analytics application in your browser using your Keycloak account and save the first cookie that has been successfully authenticated;

[0012] S12. Using the URL of the statistical analysis page of the Web analytics application as the network callback address parameter, the first Cookie access conversion service is carried.

[0013] Optionally, S11 specifically includes:

[0014] Access the web analytics application and verify whether the current user is logged in via cookie. If not logged in, redirect to the Keycloak login page.

[0015] If the entered username and password are correct, Keycloak determines that the user has successfully logged in, then redirects to the homepage of the web analytics application and saves the first successfully authenticated cookie under the Keycloak domain in the browser.

[0016] Optionally, S2 specifically includes:

[0017] S21. In the access conversion service, based on the first cookie, the current login information is obtained from the Keycloak, and the authentication address of the Superset is accessed with the first cookie.

[0018] S22. After the Superset authentication is successful, the second cookie returned by the Superset is obtained, a unique UUID is created, the mapping relationship between the UUID and the second cookie is generated and saved.

[0019] Optionally, S3 specifically includes:

[0020] S31. Return a 302 status code to the browser, and use the UUID and the URL of the statistical analysis page as parameters to redirect the request to the domain that obtained the second cookie;

[0021] S32. Obtain the second cookie after Superset authentication based on the UUID;

[0022] S33. Return the second cookie to the browser's cookies.

[0023] Optionally, S4 specifically includes:

[0024] S41. Return a 302 status code and redirect the browser's address to the analytics page in the web analytics application;

[0025] S42. Access the Superset address in the iframe through the browser carrying the second cookie, and successfully authenticate.

[0026] Optionally, prior to S11, the Superset login-free method based on Keycloak further includes:

[0027] Deploy the Keycloak and save all user information therein, with the Keycloak managing the user information.

[0028] Optionally, prior to S11, the Superset login-free method based on Keycloak further includes:

[0029] Deploy the Superset, and by modifying the Superset configuration file, combine the Keycloak with the Superset via the OAuth2 protocol, so that user login for the Superset is redirected to the Keycloak.

[0030] Optionally, Nginx can be used to specify the domain names of the web analytics application, the Keycloak, and the Superset, and to proxy HTTP requests.

[0031] Optionally, the main domain of the web analytics application, the Keycloak, and the Superset is the same.

[0032] In the Superset login-free method based on Keycloak provided by this invention, the problem of login failure when embedding a Superset page in an iframe is solved, reducing the total number of logins from 2 to 1, which greatly improves the user experience. Attached Figure Description

[0033] Those skilled in the art will understand that the accompanying drawings are provided to better understand the invention and do not constitute any limitation on the scope of the invention. Wherein:

[0034] Figure 1 This is a flowchart illustrating the steps of a Superset method for avoiding secondary login based on Keycloak, provided in an embodiment of the present invention.

[0035] Figure 2This is a flowchart of a Superset method for avoiding secondary login based on Keycloak, provided as an embodiment of the present invention. Detailed Implementation

[0036] To make the objectives, advantages, and features of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the drawings are in a very simplified form and use non-precise proportions, and are only used to facilitate and clearly illustrate the purpose of the embodiments of this invention. Please refer to the accompanying drawings to make the objectives, features, and advantages of this invention more apparent and understandable. It should be understood that the structures, proportions, sizes, etc., depicted in the accompanying drawings are only used to complement the content disclosed in the specification, for those skilled in the art to understand and read, and are not intended to limit the implementation conditions of this invention. Any modifications to the structure, changes in proportions, or adjustments to the size, if they are the same as or similar to the effects and objectives achieved by this invention, should still fall within the scope of the technical content disclosed in this invention.

[0037] As used herein, the singular forms “a,” “an,” and “the” include plural objects unless otherwise expressly indicated. As used herein, the term “or” is generally used to include “and / or” unless otherwise expressly indicated. As used herein, the term “a number” is generally used to include “at least one” unless otherwise expressly indicated. As used herein, the term “at least two” is generally used to include “two or more” unless otherwise expressly indicated. Furthermore, the terms “first,” “second,” and “third” are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as “first,” “second,” or “third” may explicitly or implicitly include one or at least two of that feature.

[0038] In the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0039] Please refer to Figures 1-2 , Figure 1This is a flowchart illustrating the steps of a Superset method for avoiding secondary login based on Keycloak, provided in an embodiment of the present invention. Figure 2 This is a flowchart illustrating a method for Superset without secondary login based on Keycloak, according to an embodiment of the present invention. This embodiment provides a method for Superset without secondary login based on Keycloak, including the following steps:

[0040] S1. Request to access the conversion service with a cookie from a web analytics application that has been authenticated by Keycloak;

[0041] S2. Convert the cookie into authentication content after Superset authentication;

[0042] S3. Return the authentication content to the browser via an HTTP 302 redirect;

[0043] S4. Access the Superset address embedded in the iframe through the browser carrying the authentication content, and successfully authenticate.

[0044] The Superset login-free method based on Keycloak provided in this embodiment solves the problem of login failure when embedding a Superset page in an iframe, reducing the total number of login attempts from 2 to 1, and greatly improving the user experience.

[0045] In this embodiment, the web analytics application refers to an application that integrates with Keycloak and embeds Superset using an iframe, serving as a carrier for displaying analytics content. Keycloak is an open-source IAM (Identity and Access Control) solution for modern applications and services, supporting SSO (Single Sign-On) and standard protocols such as OpenID Connect, OAuth 2.0, and SAML 2.0.

[0046] Preferably, Nginx is used to specify the domain names of the web analytics application, the Keycloak, and the Superset, and to proxy HTTP requests. Preferably, the main domain names of the web analytics application, the Keycloak, and the Superset are the same.

[0047] In this embodiment, the domain name of the Web analytics application is https: / / web.xx.cn, and the statistical analysis page that needs to be accessed is https: / / web.xx.cn / statistics; the domain name of Keycloak is https: / / keycloak.xx.cn; and the domain name of Superset is https: / / superset.xx.cn.

[0048] First, before executing step S1, the Keycloak-based Superset method for avoiding secondary login also includes:

[0049] Deploy the Keycloak and save all user information therein, with the Keycloak managing the user information.

[0050] The process involves deploying the Superset, enabling Superset access control by modifying its configuration file, and combining the Keycloak with the Superset via the OAuth2 protocol, redirecting Superset user logins to the Keycloak. It's important to understand that at this point, the Superset can log in using the user from the Keycloak. However, due to limitations imposed by browser security policies and Superset's own authentication implementation, Superset pages embedded in iframes cannot obtain and use authentication information from external web analytics applications, thus preventing login-free access for Supersets embedded in iframes.

[0051] Then, S1 is executed, requesting a cookie-based conversion service carrying the cookie of a web analytics application that has been authenticated by Keycloak. In this embodiment, S1 specifically includes:

[0052] S11. Log in to the web analytics application in your browser using your Keycloak account and save the first cookie that has been successfully authenticated;

[0053] S12. Using the URL of the statistical analysis page of the Web analytics application as the network callback address parameter, the first Cookie access conversion service is carried.

[0054] S11 specifically includes:

[0055] Access the web analytics application and verify whether the current user is logged in via cookie. If not logged in, redirect to the Keycloak login page.

[0056] If the entered username and password are correct, Keycloak determines that the user has successfully logged in, then redirects to the homepage of the web analytics application and saves the first successfully authenticated cookie under the Keycloak domain in the browser.

[0057] In S12, the domain name of the conversion service is, for example:

[0058] https: / / keycloak.xx.cn / substitution?redirectUri=https: / / web.xx.cn / statistics

[0059] Next, step S2 is executed to convert the Cookie into authentication content after Superset authentication. In this embodiment, step S2 specifically includes:

[0060] S21. In the access conversion service, based on the first cookie, the current login information is obtained from the Keycloak, and the authentication address of the Superset is accessed with the first cookie.

[0061] S22. After the Superset authentication is successful, the second cookie returned by the Superset is obtained, a unique UUID is created, the mapping relationship between the UUID and the second cookie is generated and saved.

[0062] Then, step S3 is executed, returning the authentication content to the browser via an HTTP 302 redirect. In this embodiment, step S3 specifically includes:

[0063] S31. Return a 302 status code to the browser, and use the UUID and the URL of the statistical analysis page as parameters to redirect the request to the domain that obtained the second cookie;

[0064] S32. Obtain the second cookie after Superset authentication based on the UUID;

[0065] S33. Return the second cookie to the browser's cookies.

[0066] Specifically, a "substitution" interface can be added to Keycloak. This interface is responsible for converting the received Keycloak authentication information into Superset authentication information. After a user logs in, accessing keycloak.xxx.com will carry the authenticated first cookie. At this time, accessing the "substitution" interface will synchronously access the Superset login interface, exchange the carried Keycloak authentication information for the Superset login cookie (i.e., the second cookie), and save the information of the second cookie in Keycloak's memory. Simultaneously, a UUID-second cookie mapping is generated and saved. The UUID value is assigned to the status variable, and the "substitution" interface returns a 302 redirect, redirecting the URL to "http: / / superset.xxx.com / get?status={status}".

[0067] Meanwhile, a "get" interface is added to Keycloak. This interface receives the UUID from the status, retrieves the second cookie in memory based on the UUID, and writes it into the Set-Cookie header of the response. The browser then saves the second cookie to the Superset.xxx.com URL. In this embodiment, through an Nginx proxy, the URL http: / / superset.xxx.com / get can be redirected to Keycloak.

[0068] In step S31, the domain name of the second cookie is, for example:

[0069] https: / / superset.xx.cn / get?redirectUri=https: / / web.xx.cn / statistics&status={uuid}

[0070] Finally, step S4 is executed, whereby the browser accesses the Superset address embedded in the iframe carrying the authentication content, and authentication is successful. In this embodiment, step S4 specifically includes:

[0071] S41. Return a 302 status code and redirect the browser's address to https: / / web.xx.cn / statistics to access the analysis page in the web analytics application;

[0072] S42. Access the Superset address in the iframe through the browser carrying the second cookie, and after successful authentication, display the statistical analysis content.

[0073] In summary, this invention provides a method for Superset without requiring a second login based on Keycloak, which solves the problem of being unable to log in when embedding a Superset page in an iframe, reducing the total number of login attempts from 2 to 1, and greatly improving the user experience.

[0074] The above description is merely a description of preferred embodiments of the present invention and is not intended to limit the scope of the invention in any way. Any changes or modifications made by those skilled in the art based on the above disclosure are within the protection scope of the present invention. Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the present invention and its equivalents, the present invention also intends to include these modifications and variations.

Claims

1. A Superset login-free method based on Keycloak, characterized in that, Includes the following steps: S1. Request to access the conversion service with a cookie from a web analytics application that has been authenticated by Keycloak; S2. Convert the cookie into authentication content after Superset authentication; S3. Return the authentication content to the browser via an HTTP 302 redirect; S4. Access the Superset address embedded in the iframe through the browser carrying the authentication content, and successfully authenticate; The web analytics application refers to the application that accesses the Keycloak, which is combined with the Superset via the OAuth2 protocol, and the Superset is embedded in the business page of the web analytics application via an iframe. S1 specifically includes: S11. Log in to the web analytics application in your browser using your Keycloak account and save the first cookie that has been successfully authenticated; S12. Using the URL of the statistical analysis page of the Web analysis application as the network callback address parameter, the first Cookie access conversion service is carried. S2 specifically includes: S21. In the access conversion service, based on the first cookie, the current login information is obtained from the Keycloak, and the authentication address of the Superset is accessed with the first cookie. S22. After the Superset authentication is successful, the second Cookie returned by the Superset is obtained, a unique UUID is created, the mapping relationship between the UUID and the second Cookie is generated and saved; S3 specifically includes: S31. Return a 302 status code to the browser, and use the UUID and the URL of the statistical analysis page as parameters to redirect the request to the domain that obtained the second cookie; S32. Obtain the second cookie after Superset authentication based on the UUID; S33. Return the second cookie to the browser's cookies.

2. The Superset method for avoiding secondary login based on Keycloak according to claim 1, characterized in that, S11 specifically includes: Access the web analytics application and verify whether the current user is logged in via cookie. If not logged in, redirect to the Keycloak login page. If the entered username and password are correct, Keycloak determines that the user has successfully logged in, then redirects to the homepage of the web analytics application and saves the first successfully authenticated cookie under the Keycloak domain in the browser.

3. The Superset method for avoiding secondary login based on Keycloak according to claim 1, characterized in that, S4 specifically includes: S41. Return a 302 status code and redirect the browser's address to the analytics page in the web analytics application; S42. Access the Superset address in the iframe through the browser carrying the second cookie, and successfully authenticate.

4. The Superset method for avoiding secondary login based on Keycloak according to claim 1, characterized in that, Prior to S11, the Superset login-free method based on Keycloak further includes: Deploy the Keycloak and save all user information therein, with the Keycloak managing the user information.

5. The Superset method for avoiding secondary login based on Keycloak according to claim 1, characterized in that, Prior to S11, the Superset login-free method based on Keycloak further includes: Deploy the Superset, and by modifying the Superset configuration file, combine the Keycloak with the Superset via the OAuth2 protocol, so that user login for the Superset is redirected to the Keycloak.

6. The Superset method for avoiding secondary login based on Keycloak according to claim 1, characterized in that, Use Nginx to specify the domain names of the web analytics application, the Keycloak, and the Superset, and to proxy HTTP requests.

7. The Superset method for avoiding secondary login based on Keycloak according to claim 6, characterized in that, The main domain of the web analytics application, the Keycloak, and the Superset is the same.

Images