Impersonation with webapps

Concepts

Webapps can be accessed by any user with the necessary permissions, such as “Read dashboards” or “Read project content” after successfully logging in. You can refer to the Public webapps page if you require further information.

Each time a user uses a webapp, the code is executed on behalf of a user, defined by the “Run backend as” parameter configured in the webapp settings, as illustrated in Figure 1. Therefore, the actions performed by the user are attributed to the user mentioned in the “Run backend as” parameter.

Figure 1: Backend configuration.

For example, if user U1 runs a webapp with the “Run backend as” parameter set to A1, the actions taken by U1 will be identified as actions taken by the user A1. If you need the actions being identified as actions taken by user U1, you must make an impersonation call.

It is essential to consider the security and permission aspects of impersonation while using webapps. You can refer to this documentation to learn more about these aspects.

Impersonation usage

Impersonation calls work on any web framework so that you can use your preferred web framework. Creating a simple webapp allows you to test, evaluate, and understand how impersonation works. When a job starts, Dataiku logs it. Then, you can observe impersonation by examining a Dataiku project’s interface and jobs section.

To test impersonation, you will create a web application that builds a dataset (i.e., starts a job). You can observe impersonation by examining a Dataiku project’s interface or the jobs section. To carry out this task, you will use the Dataiku TShirts project. To do so:

1. On the top left corner, click + New project > Sample project > Dataiku TShirts.

2. On the top navigation bar, navigate to the </> > Webapp section.

3. Click on + New Webapp and select Code Webapp.

4. Select the library with which you want to build your webapp.

The webapp aims to build a dataset present in the project; for example, you will build the web_history_prepared dataset.

Implementation

Codes presented show two ways of getting user information, but there is only one way to do impersonation. You can also get user information by using the impersonation mode.

StandardDashBokehStreamlit

HTML Code

<h1>Impersonation Demo</h1>

<h2>Welcome: <span id="identified_user"></span></h2>

<div class="build_dataset">
    <form id="form-dataset" novalidate>
        <button type="button" class="main-blue-button" id="build-button">Build the dataset</button>
    </form>
</div>

Javascript code

/*
 * For more information, refer to the "Javascript API" documentation:
 * https://doc.dataiku.com/dss/latest/api/js/index.html
 */

let buildButton = document.getElementById('build-button');
let identifiedUser = document.getElementById('identified_user')

buildButton.addEventListener('click', function (event) {
    datasetToBuild = "web_history_prepared"
    $.get(getWebAppBackendUrl("/buil_dataset"), {datasetToBuild: datasetToBuild});
});

// When loading, get the user information
$.getJSON(getWebAppBackendUrl('/get_user_name'), function (data) {
    identifiedUser.textContent = data;
});

Backend code

import dataiku
import pandas as pd
from flask import request, jsonify

import logging

logger = logging.getLogger(__name__)


# Example:
# As the Python webapp backend is a Flask app, refer to the Flask
# documentation for more information about how to adapt this
# example to your needs.
# From JavaScript, you can access the defined endpoints using
# getWebAppBackendUrl('first_api_call')

@app.route('/get_user_name')
def get_user_name():
    logger.info("In it")
    logger.info(request)
    # Get user information from the request (can be done with impersonation)
    headers = dict(request.headers)
    auth_info = dataiku.api_client().get_auth_info_from_browser_headers(headers)
    return (json.dumps(auth_info.get("associatedDSSUser")))

    # Example of impersonation usage


#    with dataiku.WebappImpersonationContext() as ctx:
#        logger.info('impersonation')
#        # Using this context, your actions here will be impersonated.
#        client = dataiku.api_client()
#        user = client.get_own_user()
#        settings = user.get_settings()
#        logger.info(settings.get_raw())
#        return json.dumps(settings.get_raw().get('displayName'))


@app.route('/buil_dataset')
def build_dataset():
    dataset = request.args.get('datasetToBuild')
    logger.info("Impersonation begins...")
    with dataiku.WebappImpersonationContext() as context:
        # Each time your need to do impersonation, you need to obtain a client.
        # Dash cannot store objects that are not in JSON format.
        local_client = dataiku.api_client()
        project = local_client.get_default_project()
        outdataset = project.get_dataset(dataset)
        outdataset.build()

    logger.info("Impersonation ends...")
    resp = jsonify(success=True)
    return resp

Wrapping Up

Congratulations! You know how to use and implement impersonation for web applications. Permissions and impersonation are critical points for web application security.