Secure a session#

This feature is not part of the community edition: it needs to be unlocked.

By default, no authentication is required to query an Atoti session and the users have access to all the data in the session.

This shows how to configure:

An authentication mechanism to secure access to the session.
Restrictions to control the data each user is allowed to see.

Configuring authentication#

Atoti supports multiple authentication mechanisms.

Here we’ll use OpenID Connect:

[1]:

from pathlib import Path

resources_directory = Path().cwd().parent / "getting_started" / "tutorial" / "data"

[2]:

import os

import atoti as tt

session_config = tt.SessionConfig(
    security=tt.SecurityConfig(
        sso=tt.OidcConfig(
            access_token_format="opaque",  # noqa: S106
            client_id=os.environ["OIDC_CLIENT_ID"],
            client_secret=os.environ["OIDC_CLIENT_SECRET"],
            issuer_url=os.environ["OIDC_ISSUER_URL"],
            name_claim="preferred_username",
            provider_id="unused",
            roles_claims={("resource_access", os.environ["OIDC_CLIENT_ID"], "roles")},
            scopes={"openid", "profile", "roles"},
        ),
    ),
)

[3]:

session = tt.Session.start(session_config)

[4]:

sales_table = session.read_csv(
    resources_directory / "sales.csv", keys={"Sale ID"}, table_name="Sales"
)

[5]:

shops_table = session.read_csv(
    resources_directory / "shops.csv", keys={"Shop ID"}, table_name="Shops"
)

[6]:

sales_table.join(shops_table, sales_table["Shop"] == shops_table["Shop ID"])

[7]:

session.tables.schema

[7]:

erDiagram "Sales" { _ String PK "Sale ID" _ LocalDate "Date" _ String "Shop" _ String "Product" nullable double "Quantity" nullable double "Unit price" } "Shops" { _ String PK "Shop ID" _ String "City" _ String "State or region" _ String "Country" _ String "Shop size" } "Sales" }o--o| "Shops" : "`Shop` == `Shop ID`"

[8]:

cube = session.create_cube(sales_table)

The users configured in the OIDC provider are:

global-user with the role user.
french-user with the roles france and atoti.
parisian-user with the roles paris and atoti.

Configuring authorization#

Tables.restrictions can be used to limit access to the data within the session.

Let’s create restrictions and then assign roles so that:

global-user has access to everything.
french-user only has access to France data.
parisian-user only has access to Paris data.

Since by default users have access to all the data, we only need to create restrictions for the regional users:

[9]:

session.tables.restrictions.update(
    {
        "ROLE_PARIS": shops_table["City"] == "Paris",
        "ROLE_FRANCE": shops_table["Country"] == "France",
    },
)

We update the role mapping to create a mapping between the roles our users have in the OIDC provider, and the roles we want them to have in the Atoti application.

[10]:

session.security.oidc.role_mapping.update(
    {
        "atoti": {"ROLE_USER"},
        "france": {"ROLE_FRANCE"},
        "paris": {"ROLE_PARIS"},
    },
)

Querying the session#

When navigating to the URL of the session, users are redirected to the login page of the configured authentication provider.

Let’s connect using our different users and make sure they can only see the expected data subset.

[11]:

def query(session_url: str, /, *, impersonated_username: str):
    authentication = tt.OAuth2ResourceOwnerPasswordAuthentication(
        client_id=os.environ["OIDC_CLIENT_ID"],
        client_secret=os.environ["OIDC_CLIENT_SECRET"],
        issuer_url=os.environ["OIDC_ISSUER_URL"],
        # To keep things simple in this how-to, all the users share the same password.
        password=os.environ["OIDC_USER_PASSWORD"],
        scopes={"openid"},
        username=impersonated_username,
    )

    with tt.Session.connect(session_url, authentication=authentication) as session:
        cube = next(iter(session.cubes.values()))
        return cube.query(
            cube.measures["Quantity.SUM"],
            levels=[cube.levels["City"]],
            include_totals=True,
        )

First, we can check that parisian-user can only see data for shops in Paris:

[12]:

query(session.url, impersonated_username="parisian-user")

[12]:

	Quantity.SUM
City
Total	603.00
Paris	603.00

french-user can only see data for shops in France:

[13]:

query(session.url, impersonated_username="french-user")

[13]:

	Quantity.SUM
City
Total	3,027.00
Lyon	609.00
Marseille	603.00
Nice	609.00
Paris	603.00
Saint-Étienne	603.00

And finally, global-user can see data for all the shops:

[14]:

query(session.url, impersonated_username="global-user")

[14]:

	Quantity.SUM
City
Total	8,077.00
Chicago	603.00
Houston	606.00
Los Angeles	606.00
Lyon	609.00
Marseille	603.00
New York	808.00
Nice	609.00
Paris	603.00
Saint-Étienne	603.00
San Antonio	606.00
San Diego	606.00
San Francisco	612.00
San Jose	603.00