GitHub user FrancescoCastaldi added a comment to the discussion: Can the Host
Application’s SSO Access Token Be Used for Superset Embedded Guest Token
Generation?
Passing the ZITADEL access token directly to `/api/v1/security/csrf_token`
fails with Bad Request because Superset's REST endpoints expect a Superset
Flask-AppBuilder session cookie or a Superset JWT minted by
`/api/v1/security/login`. A third-party IdP token cannot authenticate directly
against Superset's internal API endpoints without custom middleware.
### Recommended Architecture: Direct BFF Signing (No Service Account Needed)
You do not need a Superset service account to generate guest tokens. Superset
supports offline guest token verification.
In this architecture:
1. The user logs into Angular via ZITADEL.
2. Angular sends the user's request (carrying the ZITADEL token) to your
Node.js/Go/Python backend (BFF).
3. Your BFF validates the ZITADEL token to identify the user and determine
their permissions.
4. Your BFF creates and signs the guest token directly using the shared secret
`GUEST_TOKEN_JWT_SECRET` configured in Superset:
```python
# superset_config.py
GUEST_TOKEN_JWT_SECRET = "your-high-entropy-random-secret"
GUEST_TOKEN_JWT_ALGO = "HS256"
GUEST_ROLE_NAME = "Public"
```
In your backend:
```typescript
import jwt from 'jsonwebtoken';
// In your BFF endpoint: /api/embedded-token
const guestToken = jwt.sign(
{
user: {
username: zitadelUser.preferred_username,
first_name: zitadelUser.given_name,
last_name: zitadelUser.family_name,
},
resources: [{ type: 'dashboard', id: dashboardId }],
rls_rules: [{ clause: `tenant_id = '${zitadelUser.tenant_id}'` }],
type: 'guest',
aud: 'superset',
},
process.env.GUEST_TOKEN_JWT_SECRET!,
{ algorithm: 'HS256', expiresIn: '5m' }
);
```
5. Your BFF returns this `guestToken` string to Angular.
6. Angular provides it to `@superset-ui/embedded-sdk` via `fetchGuestToken`.
This completely eliminates the need for a Superset admin service account,
eliminates login/csrf API round-trips, and ensures that user permissions and
Row Level Security rules remain under your application backend's control.
GitHub link:
https://github.com/apache/superset/discussions/44205#discussioncomment-19164455
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
