Zitadel support as an SSO option

[rinshadka]

Any plan to add support to Zitadel for SSO integrations?

[daniils-keyos]

I've managed to integrate Superset with the Zitadel based on docs here https://superset.apache.org/docs/configuration/configuring-superset/#custom-oauth2-configuration.
Here is my setup:

Zitadel part

• Create a Zitadel app with the type "Web" and authentication method "Code"
• For the authtoken type feel free to select "Bearer token" or "JWT". There is no need to insert user info and roles in the token, as Supersecret will call userinfo Zitadel endpoint to get user info
• Keep client id and generate client secret, as these are required in the steps below

Supersecret part

• Create file custom_sso_security_manager.py with the following content:

iimport logging
from superset.security import SupersetSecurityManager

class CustomSsoSecurityManager(SupersetSecurityManager):
    def oauth_user_info(self, provider, response=None):
        logging.debug("Oauth2 provider: {0}.".format(provider))
        if provider == 'zitadel':
            me = self.appbuilder.sm.oauth_remotes[provider].get('oidc/v1/userinfo').json()
            logging.debug("user_data: {0}".format(me))
            return {
                'name' : me['name'],
                'email' : me['email'],
                'id' : me['preferred_username'],
                'username' : me['preferred_username'],
                'first_name':me['given_name'],
                'last_name':me['family_name']
            }

You may change the mapping between Zitadel-returned user properties and Supersecret-expected, but the above works great for me.
If Zitadel is not the only provider, create condition like

• Update your superset_config.py with this block (they way you update it depends on the deployment):

from flask_appbuilder.security.manager import AUTH_OAUTH
from custom_sso_security_manager import CustomSsoSecurityManager

CUSTOM_SECURITY_MANAGER = CustomSsoSecurityManager
AUTH_TYPE = AUTH_OAUTH
OAUTH_PROVIDERS = [
    {
        "name": "zitadel",
        "token_key": "access_token",
        "icon": "fa-key",
        "remote_app": {
            "client_id": '<client id from Zitadel>',
            "client_secret": '<client secret from Zitadel>',
            "client_kwargs": {
              "scope": "openid profile email",
            },
            "api_base_url": "<zitadel base URL, like https://zitadel.your-domain.com>",
            "server_metadata_url": '<zitadel metadata URL, like  https://zitadel.your-domain.com/.well-known/openid-configuration>',
        },
    }
]


# Map Authlib roles to superset roles
AUTH_ROLE_ADMIN = 'Admin'
AUTH_ROLE_PUBLIC = 'Public'

# Will allow user self registration, allowing to create Flask users from Authorized User
AUTH_USER_REGISTRATION = True

# The default user self registration role
AUTH_USER_REGISTRATION_ROLE = "Public"

• Make sure the pip package Authlib is installed, e.g. where you are installing DB drivers