Azure SSO

[KodakMaciel]

How to resolv?

LOG

2025/12/30 11:53:45 [error] 783#783: *3 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.168.XX.XX, server: _, request: "GET /oauth-authorized/azure?code=1XXXXXXXXXXXXXXXXXXXXXXX&state=XXXXXXXX&session_state=xxxxxxxxx HTTP/2.0", upstream: "http://127.0.0.1:8080/oauth-authorized/azure?code=xxxxxxxxxx

superset_config.py

SECRET_KEY = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXX'
LANGUAGES = {
    'pt_BR': {'flag': 'br', 'name': 'Português'},
    'en': {'flag': 'us', 'name': 'English'},
    'es': {'flag': 'es', 'name': 'Español'},
                                                }
CONTENT_SECURITY_POLICY_WARNING = False
ENABLE_PROXY_FIX = True

import os
import logging
from flask_appbuilder.security.manager import AUTH_OAUTH
from superset.security import SupersetSecurityManager

AUTH_TYPE = AUTH_OAUTH
AUTH_USER_REGISTRATION = True
AUTH_USER_REGISTRATION_ROLE = "Public"

OAUTH_PROVIDERS = [{
    "name": "azure",
    "icon": "fa-windows",
    "token_key": "access_token",
    "remote_app": {
        "client_id": "XXXXXXXXXXXXXXXXXXXXXXXXXXXX",  # Set via env or secret
        "client_secret": "XXXXXXXXXXXXXXXXXXXXXXXXXXXX",  # Set via env or secret
        "api_base_url": "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/",
        "access_token_url": "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token",
        "authorize_url": "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize",
        "client_kwargs": {
            "scope": "openid profile email User.Read"
        }
    }
}]

# Optional: Map Azure AD group IDs to Superset roles
AUTH_ROLES_MAPPING = {
    "Azure-Group-Object-ID-1": ["Admin"],
    "Azure-Group-Object-ID-2": ["Gamma"],
    # Add more as needed
}

AUTH_ROLES_SYNC_AT_LOGIN = True
ENABLE_PROXY_FIX = True  # Important if behind a proxy/load balancer

# Optional: Custom security manager for advanced role mapping or user info extraction
class CustomSsoSecurityManager(SupersetSecurityManager):
    def oauth_user_info(self, provider, response=None):
        if provider == "azure":
            me = self.appbuilder.sm.oauth_remotes[provider].get("https://graph.microsoft.com/v1.0/me").json()
            groups = me.get("groups", [])
            group_role_map = {
                "Azure-Group-Object-ID-1": "Admin",
                "Azure-Group-Object-ID-2": "Gamma",
            }
            user_roles = [group_role_map[g] for g in groups if g in group_role_map]
            return {
                "username": me.get("userPrincipalName"),
                "first_name": me.get("givenName", ""),
                "last_name": me.get("surname", ""),
                "email": me.get("mail"),
                "role_keys": user_roles,
            }
        return super().oauth_user_info(provider, response)

CUSTOM_SECURITY_MANAGER = CustomSsoSecurityManager

[dosubot[bot]]

Hi @KodakMaciel! I'm Dosu and I’m helping the superset team.

The "upstream timed out" error during Azure SSO in Superset is usually caused by a network or configuration issue during the OAuth callback. Here’s how to troubleshoot and resolve it:

1. Check network connectivity: Make sure nginx can reach Superset at http://127.0.0.1:8080, and that Superset can access Azure endpoints (login.microsoftonline.com and graph.microsoft.com). Any firewall or DNS issue can cause timeouts.

2. Review Superset logs: Look for errors or stack traces in the Superset logs at the time of the timeout. This can reveal if the problem is with the token exchange, user info retrieval, or something else.

3. Validate Azure app registration: The redirect URI in Azure must match exactly what Superset uses (including protocol, domain, and path, e.g., https://your-domain/oauth-authorized/azure). Mismatches can cause the OAuth flow to hang or fail example.

4. Proxy headers and ENABLE_PROXY_FIX: You already have ENABLE_PROXY_FIX = True, which is correct. Ensure nginx forwards X-Forwarded-Proto and Host headers so Superset generates the correct redirect URIs.

5. OAuth scopes and group claims: Your scopes should include openid email profile User.Read GroupMember.Read.All upn to ensure Azure returns all necessary user and group info for role mapping example. Missing scopes or group claims can cause the callback to hang while waiting for a response.

6. Test endpoint directly: From the Superset host, try accessing the Azure endpoints (e.g., with curl) to confirm there’s no outbound network block.

7. Custom security manager: If your oauth_user_info method makes a slow or blocked request (like to https://graph.microsoft.com/v1.0/me), it can cause the timeout. Add logging/timing to this method to see if it’s the bottleneck.

If you follow these steps, you should be able to pinpoint whether the timeout is due to network, configuration, or code. Most commonly, it’s a network/firewall issue or a misconfigured redirect URI or scope reference.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}