Having trouble setting up the database connection to trino on superset

[anushreegawdeAP]

I asked sometime ago some questions about setting up OAuth2.0 integration for Trino with Okta in Superset, following the guidance from this PR (#30081). We have got past the username part and now superset recognizes email as username. I am having trouble now setting up the database connection. It keeps throwing unauthorized error.
My current setup looks like this:

trino_oauth
DATABASE_OAUTH2_REDIRECT_URI = "http://localhost:8088/api/v1/database/oauth2/"
DATABASE_OAUTH2_JWT_ALGORITHM = "RS256"
DATABASE_OAUTH2_CLIENTS = {
'HSH Trino Oauth': {
'id': '<trino_app_client_id>',
'secret': '<trino_app_client_secret>',
'scope': 'openid email offline_access roles profile',
'redirect_uri': 'http://localhost:8088/api/v1/database/oauth2/',
'authorization_request_uri': 'https://example.okta.com/oauth2/v1/authorize',
'token_request_uri': 'https://example.okta.com/oauth2/v1/token'
'request_content_type': 'json'
}
}

{"connect_args":{"http_scheme":"https"}}

Impersonate: true is in place as well and UI shows the correct configs. Any guidance or insights on further troubleshooting would be greatly appreciated!

The redirect uri gives 500 error. So not sure what should be changed in that case.

Thank you!

[anushreegawdeAP]

@joaoferrao @betodealmeida any pointers would be highly appreciated!

[dosubot[bot]]

Hey @anushreegawdeAP! I'm here to help you with any bugs, questions, or contributions while you wait for a human maintainer. Let me know how I can assist you! Dosu

I found some similar discussions that might be relevant to your issue:

1. superset not able to connect to Trino with Keycloak Oauth2? - This discussion is still open and might provide some insights into similar OAuth2.0 integration issues with Trino ^[1].

2. OAuthError: invalid_client : The client MUST NOT use more than one authentication method in each request - This is another open discussion that might be related to your unauthorized error issue ^[2].

Regarding your setup, here are a few things you might want to check:

• Ensure that the redirect_uri in your DATABASE_OAUTH2_CLIENTS configuration matches exactly with what is registered in your Okta application settings.
• Double-check the client_id and client_secret to ensure they are correct and correspond to the Okta application you are using.
• Verify that the scopes you are requesting (openid email offline_access roles profile) are correctly configured in Okta and that your user has the necessary permissions.
• The 500 error on the redirect URI might indicate a server-side issue. Check the Superset logs for more detailed error messages that could provide further clues.

If these steps don't resolve the issue, reviewing the discussions linked above might offer additional troubleshooting steps or insights.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}