Vitor-Avila commented on PR #43309: URL: https://github.com/apache/superset/pull/43309#issuecomment-5344617406
@aminghadersohi I might be wrong here, but I think query execution later would actually **_use_** the logged in user's email? At least the [Preset docs say](https://docs.preset.io/docs/google-sheets-private-connection#configure-the-google-sheet-connection) _"In order to create the connection, it is required that the email address associated with your Preset account has access to the Google Sheets file."_ If that's really true (might be worth manually testing) then this would either: - Allow the connection to be created, but then queries fail after; or - In case these changes also affect query execution, queries now bypass OAuth2 validation. Another important detail is that Superset has a "Impersonate logged in user" checkbox that typically controls OAuth2 enablement. If we want to support Service Account auth to bypass OAuth, we probably want to gate this behind this checkbox. I think in the past editing the GSheets connection wouldn't even allow you to disable the checkbox, so we might need to allow that. Now, a bigger question would be: do we even need to continue supporting OAuth2-type connection via Service Account? This feature was introduced before native support for DB OAuth2 was added to Superset (GSheets included, and it doesn't even require a Service Account). With that in mind, one possible outcome would be to create a SIP to deprecate this "OAuth2 validation" for Service Account auth, and keep only: * Public Sheets * Private Sheets via Service Account * Private Sheets via native OAuth2 This would be a breaking change as existing accounts with Service Account + Domain-wide delegation would have to migrate to OAuth2, but might make more sense long-term. Curious if @betodealmeida has any thoughts here as well. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
