apache/superset · error · OAuth2Error

OAUTH2_REDIRECT_ERROR

OAUTH2_REDIRECT_ERROR

Error message

Something went wrong while doing OAuth2

What it means

OAuth2Error raised at oauth2.py:57 when Database.get_oauth2_config() returns None for the database being authenticated. get_oauth2_config resolves the OAuth2 client credentials from the database's extra JSON (engine-specific OAuth2 settings); None means the engine spec supports OAuth2 but this database has no usable configuration. The class-level message ('Something went wrong while doing OAuth2') and code OAUTH2_REDIRECT_ERROR are what the API surfaces.

Source

Thrown at superset/commands/database/oauth2.py:57

class OAuth2StoreTokenCommand(BaseCommand):
    """
    Command to store OAuth2 tokens in the database.
    """

    def __init__(self, parameters: OAuth2ProviderResponseSchema):
        self._parameters = parameters
        self._state: OAuth2State | None = None
        self._database: Database | None = None

    @transaction(on_error=partial(on_error, reraise=OAuth2Error))
    def run(self) -> DatabaseUserOAuth2Tokens:
        self.validate()
        self._database = cast(Database, self._database)
        self._state = cast(OAuth2State, self._state)

        oauth2_config = self._database.get_oauth2_config()
        if oauth2_config is None:
            raise OAuth2Error("No configuration found for OAuth2")

        # Look up PKCE code_verifier from KV store (RFC 7636)
        code_verifier = None
        tab_id = self._state["tab_id"]
        try:
            tab_uuid = UUID(tab_id)
        except ValueError:
            tab_uuid = None

        if tab_uuid:
            kv_value = KeyValueDAO.get_value(
                resource=KeyValueResource.PKCE_CODE_VERIFIER,
                key=tab_uuid,
                codec=JsonKeyValueCodec(),
            )
            if kv_value:
                code_verifier = kv_value.get("code_verifier")
                KeyValueDAO.delete_entry(KeyValueResource.PKCE_CODE_VERIFIER, tab_uuid)

View on GitHub (pinned to f4587218dd)

Solutions

1. Open the database settings (PUT /api/v1/database/<id>, extra JSON) and configure the OAuth2 block your engine spec expects — see the engine's documentation for the exact keys (client_id, client_secret, authorization_url, token_url, etc.).
2. Verify the engine actually supports OAuth2 in your Superset version (db_engine_spec.get_oauth2_token exists).
3. Re-trigger the OAuth2 flow from SQL Lab after fixing the configuration.
4. Check server logs for get_oauth2_config resolution details if the block looks correct.

Example fix

# before: database.extra has no oauth2 block -> OAuth2Error at redirect
# after: PUT /api/v1/database/<id>
{"extra": "{\"engine_params\": {}, \"metadata_params\": {}, \"oauth2_client_info\": {\"client_id\": \"...\", \"client_secret\": \"...\", \"authorize_url\": \"https://provider/oauth/authorize\", \"token_url\": \"https://provider/oauth/token\"}}"}

db_model = DatabaseDAO.find_by_id(database_id)
if db_model.get_oauth2_config() is None:
    # configure the engine's OAuth2 block in extra before starting the flow
    raise ConfigError("OAuth2 not configured for this database")

from superset.exceptions import OAuth2Error

try:
    OAuth2StoreTokenCommand(params).run()
except OAuth2Error as ex:
    if "No configuration found" in str(ex):
        send_admin_notice("configure OAuth2 for database", database_id)

When it happens

Trigger: Completing the OAuth2 redirect (GET /oauth2/authorize with the provider's code) for a database whose extra lacks configured OAuth2 client_id/client_secret/authorize/token URLs, or whose configured provider does not match the engine spec's expectations.

Common situations: Engine spec OAuth2 introduced/changed across versions (configuration key names changed); database extra JSON edited and the OAuth2 block dropped/malformed; copying a database configuration without the OAuth2 section; provider config present but for the wrong engine.

Related errors

• Database not found
• Missing OAuth2 token
• Token not preset
• Failed to parse token
• Error: %(error)s

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/2afd3e874474e1e5. Report an issue: GitHub.