I’m trying to embed a superset dashboard into my React app using the REST APIs of the superset. Following is the given setup:

Superset hosted: HTTP://superset.example.com

React app hosted: HTTP://react.example.com

Both apps have private access and authorization is being handled by OneLogin and both work fine independently.

To make this integration work, I’m using the Embed SDK from Supertset. In the readme, it’s mentioned that guest_token can be used to embed the dashboard.

Following are the steps, I’m following to generate the guest_token:

1. use the /api/v1/security/login endpoint to authorize and get the JWT token for the same user who is logged into the REACT app via OneLogin. In my BE, I try to use the user’s auth cookie to get authorized into the superset as well and get the JWT access token.
2. use the JWT access token to generate the guest_token and pass it back to the REACT app

My payload to the login call is as follows:

"provider": "onelogin",
"refresh": true,
"username": "USER_NAME",
"password": "COOKIE_TOKEN"

Response to payload is:

{
“message”: {
“provider”: [
“Must be one of: db, ldap.”
]
}
}

Queries/ Questions:

1. When OneLogin is configured correctly as auth in a superset and is working fine as auth provider from the web interface, why REST say must be one of db, ldap?
2. What is the correct way of embedding superset dashboards into a SPA app given both apps are using SSO as auth mechanism?
3. superset guest_token requires additional access rights permissions as well for granting access to the data. In my case, since it’s the same user using both the apps and access right are configured for the user in the superset itself, can’t the guest_token take care of those permissions while generating the token?

Looking forward to your response!!!

Thanks,
Manish