From 47489165f121033391df9a4d737b789dbe8be638 Mon Sep 17 00:00:00 2001
From: wbsong111 <wbsong@paasup.io>
Date: Wed, 12 Feb 2025 12:22:06 +0900
Subject: [PATCH] Update custom-values.yaml for oidc login wit dip-api

---
 charts/superset/custom-values.yaml | 71 +++++++++++++++++++++++++-----
 1 file changed, 60 insertions(+), 11 deletions(-)

diff --git a/charts/superset/custom-values.yaml b/charts/superset/custom-values.yaml
index 2f2e44e..3b7bf1e 100644
--- a/charts/superset/custom-values.yaml
+++ b/charts/superset/custom-values.yaml
@@ -1,11 +1,59 @@
 
 configOverrides: 
-  # Generate your own secret key for encryption. Use `openssl rand -base64 42` to generate a good key
   secret: |
-    SECRET_KEY = '{openssl rand -base64 42 실행 값}'
+   SECRET_KEY = '{openssl rand -base64 42 실행 값}'
+  log_level: |
+   LOG_LEVEL = logging.INFO
   enable_oauth: |
     from flask_appbuilder.security.manager import (AUTH_DB, AUTH_OAUTH)
+    from superset.security import SupersetSecurityManager
+    from flask import request
+
+    import requests
+    import logging
+
+    class CustomSsoSecurityManager(SupersetSecurityManager):
+        def oauth_user_info(self, provider, response=None):  # noqa: ARG002
+            me = self.appbuilder.sm.oauth_remotes[provider].get("openid-connect/userinfo")
+            me.raise_for_status()
+            data = me.json()
+
+            logging.debug("User info from Keycloak: %s", data)
+
+            # 변수 정의
+            role = []
+            username = data.get("preferred_username", "")
+            host = request.host
+            dip_api_url =  "https://dip-api.example.org"    ## dip api url 수정 필요
+            # URL과 데이터 정의
+            url = f"{dip_api_url}/gwapi/v1/projectusers/{username}"
+            request_data = {"url": f"https://{host}"}
+            response = requests.post(url, json=request_data, headers={"Content-Type": "application/json"}, verify=False)
+
+            # 응답 출력
+            if response.status_code == 200:
+                logging.info(f"API 요청 성공: {response.status_code}, {response.text}")
+                role.append(response.json().get("roleName",""))
+            else:
+                logging.info(f"API 요청 실패: {response.status_code}, {response.text}")
+                role.append("")
+
+            return {
+                "username": data.get("preferred_username", ""),
+                "first_name": data.get("given_name", ""),
+                "last_name": data.get("family_name", ""),
+                "email": data.get("email", ""),
+                "role_keys": role,
+            }
+
+    # OIDC 설정
     AUTH_TYPE = AUTH_OAUTH
+    AUTH_USER_REGISTRATION = True
+    AUTH_USER_REGISTRATION_ROLE = "Public"  # 매핑되지 않은 사용자는 기본적으로 'Public'으로 설정
+    AUTH_ROLES_SYNC_AT_LOGIN = True
+    CUSTOM_SECURITY_MANAGER = CustomSsoSecurityManager # Custom Security Manager 활성화
+
+    ## OIDC provider 정보 설정
     OAUTH_PROVIDERS = [
         {
             "name": "keycloak",
@@ -18,18 +66,19 @@ configOverrides:
                   "scope": "openid email profile",
                   'verify': False
                 },
-                'server_metadata_url': 'https://keycloak.example.org/auth/realms/paasxpert/.well-known/openid-configuration',
-                'api_base_url': 'https://keycloak.example.org/auth/realms/paasxpert/protocol/'
+                'server_metadata_url': 'https://keycloak.example.org/auth/realms/paasup/.well-known/openid-configuration',
+                'api_base_url': 'https://keycloak.example.org/auth/realms/paasup/protocol/'
             }
         }
     ]
-    # Map Authlib roles to superset roles
-    AUTH_ROLE_ADMIN = 'Admin'
-    AUTH_ROLE_PUBLIC = 'Public'
-    # Will allow user self registration, allowing to create Flask users from Authorized User
-    AUTH_USER_REGISTRATION = True
-    # The default user self registration role
-    AUTH_USER_REGISTRATION_ROLE = "Gamma"
+
+    # OIDC 권한 맵핑
+    AUTH_ROLES_MAPPING = {
+    'root': ['Admin'],
+    'admin': ['Admin'],
+    'manager': ['Admin'],
+    'member': ['Alpha'],
+    }
     
 
 # 접속할 DB에 대한 드라이버를 별도 설치해야함.