Azure AD B2C authentication in superset

[Harshit-sharma-117]

I am trying to integrate azure ad b2c auth in my superset app.

we did the azure ad using this code.

AUTH_USER_REGISTRATION = True
AUTH_USER_REGISTRATION_ROLE = "Admin"
AUTH_ROLES_SYNC_AT_LOGIN = False
from flask_appbuilder.security.manager import AUTH_OAUTH
AUTH_TYPE = AUTH_OAUTH
OAUTH_PROVIDERS = [
{'name': 'azure',
'icon': 'fa-windows',
'token_key': 'access_token',
'remote_app': {
'client_id': 'XXXXXX-93d3-1814003c71ea',
'client_secret': 'XXXXXXX~e0e9rXms11p9slc28',
'api_base_url': 'https://login.microsoftonline.com/XXXXXXXX8c32-3475d2381555/oauth2',
'client_kwargs': {
'scope': 'User.read givenName sn email profile upn'
},
'request_token_url': None,
'access_token_url': 'https://login.microsoftonline.com/XXXXXXXX-8c32-3475d2381555/oauth2/token',
'authorize_url': 'https://login.microsoftonline.com/XXXXXXX-8c32-3475d2381555/oauth2/authorize',
}
}
]

 this is the code we found on this documentation https://flask-appbuilder.readthedocs.io/en/latest/security.html
 
 but we couldn't find anything for integrating ad b2c in our app.
 
 if anybody could help us with these thing. Please

[dosubot[bot]]

Hey there, @Harshit-sharma-117! I'm here to help you with your Azure AD B2C integration in Superset. Let's work on solving this together!

I found a similar closed issue that might help you with integrating Azure AD B2C authentication in Superset. The issue suggests including upn in the scope, which resolved the problem for another user. Here's the configuration they used:

OAUTH_PROVIDERS = [
    {
        "name": "azure",
        "icon": "fa-windows",
        "token_key": "access_token",
        "remote_app": {
            "client_id": [client_id],
            "client_secret": [secret],
            "api_base_url": "https://login.microsoftonline.com/[tenantid]/oauth2",
            "client_kwargs": {
                "scope": "User.read name preferred_username email profile upn groups",
                "resource": client_id,
            },
            "request_token_url": None,
            "access_token_url": "https://login.microsoftonline.com/[tenantid]/oauth2/token",
            "authorize_url": "https://login.microsoftonline.com/[tenantid]/oauth2/authorize",
        },
    },
]

Additionally, ensure that upn is added as an optional claim for the access token in the Azure AD app registration view ^[1].

To continue talking to Dosu, mention @dosu.

[onionhammer]

This works for AAD, but not AAD B2C, which is a subtly different product