How to implement SSO functionality in admin backend (currently I'm unable to redirect to authorisation_url)

[simonsax]

I have a simple fastapi app with the sqladmin backend for which I'd like to enable a SSO login functionality. But somehow I'm unable to redirect to the authentication_url of my OIDC provider. I'm using authlib as oauth client

From my understanding when accessing /admin the authenticate function is run. In this function I would check for a token or the session and if the user is not logged in yet, I would call the login endpoint (which redirects to the auth_url of my OICD provider) or call the OICD authentication method directly. But somehow I'm not redirected to the corresponding url, probably because the function expects a boolean return value? Any idea how to solve that problem? Otherwise this could be a cool feature :-)

If I call the /sso_login endpoint directly auth flow works fine.

Thanks a lot for your valuable inputs.

...
class MyBackend(AuthenticationBackend) -> bool::
    async def login(self, request: Request):
        #not used as it is only used for the admin form (which I try not to use -> SSO instead)
        pass

    async def logout(self, request: Request) -> bool:
        # Usually you'd want to just clear the session
        request.session.clear()
        return True

    async def authenticate(self, request: Request) -> bool::
        token = request.session.get("token")
        if not token:
            redirect_uri = request.url_for('sso_login')
            return RedirectResponse(url="/sso_login")
            #return await oauth.OIDC.authorize_redirect(request, redirect_uri) -> 2nd Option: call auth_url direclty
            #return False -> according to doc boolean return value
        # token = await oauth.OIDC.authorize_access_token(request)
        # Check the token -> e.g. oauth.OIDC.authorize_access_token(request)
        return True

#add sqladmin to app
admin_backend = Admin(app=app,engine=engine, authentication_backend=MyBackend("dfkdvdfsd"))

@app.get('/sso_login')
async def sso_login(request: Request):
    redirect_uri = request.url_for('auth_callback')
    return await oauth.OIDC.authorize_redirect(request, redirect_uri)

[aminalaee]

Hi @simonsax ,
First point is that I had not considered this at all, so there so there might be some missing pieces.
And second point is that you can check here: https://github.com/aminalaee/sqladmin/blob/main/sqladmin/authentication.py#L54
that for each request the AuthenticationBackend .authenticate method is called, and as you said it expects a boolean.
I suppose you are using a Authlib, right? https://docs.authlib.org/en/latest/client/

I'll work on the sample to see what changes are needed.

[aminalaee]

I have created an MR with minor modifications to handle this:
#440

[simonsax]

awesome! Thanks a lot!