Update custom-values.yaml for oidc login wit dip-api

charts/superset/custom-values.yaml

@@ -1,11 +1,59 @@
 
 configOverrides: 
-  # Generate your own secret key for encryption. Use `openssl rand -base64 42` to generate a good key
   secret: |
    SECRET_KEY = '{openssl rand -base64 42 실행 값}'
+  log_level: |
+   LOG_LEVEL = logging.INFO
   enable_oauth: |
     from flask_appbuilder.security.manager import (AUTH_DB, AUTH_OAUTH)
+    from superset.security import SupersetSecurityManager
+    from flask import request
+
+    import requests
+    import logging
+
+    class CustomSsoSecurityManager(SupersetSecurityManager):
+        def oauth_user_info(self, provider, response=None):  # noqa: ARG002
+            me = self.appbuilder.sm.oauth_remotes[provider].get("openid-connect/userinfo")
+            me.raise_for_status()
+            data = me.json()
+
+            logging.debug("User info from Keycloak: %s", data)
+
+            # 변수 정의
+            role = []
+            username = data.get("preferred_username", "")
+            host = request.host
+            dip_api_url =  "https://dip-api.example.org"    ## dip api url 수정 필요
+            # URL과 데이터 정의
+            url = f"{dip_api_url}/gwapi/v1/projectusers/{username}"
+            request_data = {"url": f"https://{host}"}
+            response = requests.post(url, json=request_data, headers={"Content-Type": "application/json"}, verify=False)
+
+            # 응답 출력
+            if response.status_code == 200:
+                logging.info(f"API 요청 성공: {response.status_code}, {response.text}")
+                role.append(response.json().get("roleName",""))
+            else:
+                logging.info(f"API 요청 실패: {response.status_code}, {response.text}")
+                role.append("")
+
+            return {
+                "username": data.get("preferred_username", ""),
+                "first_name": data.get("given_name", ""),
+                "last_name": data.get("family_name", ""),
+                "email": data.get("email", ""),
+                "role_keys": role,
+            }
+
+    # OIDC 설정
     AUTH_TYPE = AUTH_OAUTH
+    AUTH_USER_REGISTRATION = True
+    AUTH_USER_REGISTRATION_ROLE = "Public"  # 매핑되지 않은 사용자는 기본적으로 'Public'으로 설정
+    AUTH_ROLES_SYNC_AT_LOGIN = True
+    CUSTOM_SECURITY_MANAGER = CustomSsoSecurityManager # Custom Security Manager 활성화
+
+    ## OIDC provider 정보 설정
     OAUTH_PROVIDERS = [
         {
             "name": "keycloak",
@@ -18,18 +66,19 @@ configOverrides:
                   "scope": "openid email profile",
                   'verify': False
                 },
-                'server_metadata_url': 'https://keycloak.example.org/auth/realms/paasxpert/.well-known/openid-configuration',
-                'api_base_url': 'https://keycloak.example.org/auth/realms/paasxpert/protocol/'
+                'server_metadata_url': 'https://keycloak.example.org/auth/realms/paasup/.well-known/openid-configuration',
+                'api_base_url': 'https://keycloak.example.org/auth/realms/paasup/protocol/'
             }
         }
     ]
-    # Map Authlib roles to superset roles
-    AUTH_ROLE_ADMIN = 'Admin'
-    AUTH_ROLE_PUBLIC = 'Public'
-    # Will allow user self registration, allowing to create Flask users from Authorized User
-    AUTH_USER_REGISTRATION = True
-    # The default user self registration role
-    AUTH_USER_REGISTRATION_ROLE = "Gamma"
+
+    # OIDC 권한 맵핑
+    AUTH_ROLES_MAPPING = {
+    'root': ['Admin'],
+    'admin': ['Admin'],
+    'manager': ['Admin'],
+    'member': ['Alpha'],
+    }
     
 
 # 접속할 DB에 대한 드라이버를 별도 설치해야함.