When running on HTTPS the sso doesn't work due to redirect URL

[bmtcril]

When running on HTTPS the sso doesn't work because the redirect uri is taken as http:{{LMS_HOST}}/...

Any ideas?

Checking the application configuration shows the correct information:

Originally posted by @Ian2012 in #15 (comment)

[mariajgrimaldi]

I did some digging in the Flask-AppBuilder and found the redirect URI parameter is generated here using a function called url_for defined by flask itself. Take in mind one of the parameters is _external=True. Now, the url_for docs say:

In some cases, such as email messages, you want URLs to include the scheme and domain, like https://example.com/hello. When not in an active request, URLs will be external by default, but this requires setting SERVER_NAME so Flask knows what domain to use. APPLICATION_ROOT and PREFERRED_URL_SCHEME should also be configured as needed.

https://flask.palletsprojects.com/en/2.3.x/api/#flask.Flask.url_for

Should we configure PREFERRED_URL_SCHEME (HTTP by default) for our superset application? I haven't tested or even know if this is the right path. I could try it later though.

[bmtcril]

@mariajgrimaldi thanks for digging into this, that seems like a good place to start!

[mariajgrimaldi]

I found this:

k exec -it pod/superset-7955b5465-bzxqq -- bash
flask shell
>>> app.config["PREFERRED_URL_SCHEME"]
'http'

So that might be the reason. I'll keep researching :)!

[mariajgrimaldi]

Useful references:
dpgaspar/Flask-AppBuilder#1666
apache/airflow#17536 (comment)
apache/superset#8117

[mariajgrimaldi]

We figured that this config PREFERRED_URL_SCHEME is used when there is not a request context which there is in our case. So that wasn't the solution. After some digging, we found the issues I mentioned above with some suggestions and possible explanations. After trying some stuff out we managed to make it work with this:
https://github.com/apache/superset/blob/master/superset/config.py#L273-L277

# tutorsuperset/templates/superset/apps/pythonpath/superset_config_docker.py
ENABLE_PROXY_FIX = True
FEATURE_FLAGS = {
    "DYNAMIC_PLUGINS": True
}

So we should add that config when using https!

I tested this on k8s installation, now I'll need to do it on our docker-compose one.

[bmtcril]

Great, I look forward to hearing how it goes!

[mariajgrimaldi]

We have a fix! I already linked the PR.

[mariajgrimaldi]

assign me

[Ian2012]

@bmtcril this one is resolved