Aspects Reports (embedded Superset dashboards): internal authentication error for staff and superusers

[pkolyvas]

Issue

I followed the instructions on a bone-stock 17.0.6 tutor install (due to two different bugs in 18.0 - 18.1.3). My installation is scripted and parameterized here, so it was easy to get to a repeatable, stock install.

As per my thread here there is an internal authentication error when an educator or staff member tries to view the embedded reports dashboards on the LMS Instructor Reports tab.

Affected versions

I've run tutor 17.0.6 and every version of 18 from 18.0.0 to 18.1.3. The issue persists across all versions.

Expected behaviour

Pretty straightforward here. Following the instructions for installation should result in the reports (embedded superset dashboards) loading.

Additional details

• Ubuntu 24.04 Server
• amd64 arch
• No additional customization

Originally I was worried that installing aspects before tutor had be launched the first time was causing the issue, so I experiment with installing it both during initial config and after tutor had been running with courses and users for a bit, however the authentication issue persists irrespective of the order in which it's installed.

[Ian2012]

Hi @pkolyvas, can you leave the following information:

• Configured dashboard locales: tutor config printvalue SUPERSET_DASHBOARD_LOCALES
• Logs related to platform-plugin-aspects when you load the Aspects instructor tab.
• Check in the requests what's returned for the guest token URL, you should see something similar to this:
  

[bmtcril]

Hi @pkolyvas have you been able to sort out your issue, or can you reply to @Ian2012 's comment above? We haven't been able to reproduce this, so will have to close the issue if we don't hear back.

[pkolyvas]

Hey - sorry we had moved on, but the issue persists. I'll try to set aside some time this week to gather the required information and update the issue. Still persistent on multiple installs with Tutor/Redwood.

[bmtcril]

I'm not sure if the gist is up to date, but I don't see anywhere in your setup script where you're installing or initializing Aspects. I do see Cairn in there, and if you're installing both that may be your problem. As far as I know they don't both work together.

[ghassanmas]

I stumbled upon here while encountering similar problem.

The problem for us was, that we are using multi-tenant/Site configuration, such that the instructor dashboard could be accessed from a domain different than LMS_ROOT_URL . Thus request to fetch token, would fail if the origin of the page != LMS_ROOT_URL.

To fix it for us, rather than using LMS_ROOT_URL, I relied on LMS_ROOT_URL that is realted to course org. I am not sure if this would be accepted in such case. This the patch that fixes it nonetheless.

Note: applying the above patch, you need to ensure that course is being accessed from a microsite of which the org belongs to, however you could get away from that restriction, by using the origin of the request to build the guest_token_url, but probably other security measure need to be taken into consdiration such that it's accssed from a knowen host/origin i.e. ALLOWED_HOSTS.

[ghassanmas]

Also there is a simpler solutoin if microsite is just a subdomain of LMS_ROOT_URL, then this patch shall do it

diff --git a/platform_plugin_aspects/static/js/embed_dashboard.js b/platform_plugin_aspects/static/js/embed_dashboard.js
index 5555c62..1b169d0 100644
--- a/platform_plugin_aspects/static/js/embed_dashboard.js
+++ b/platform_plugin_aspects/static/js/embed_dashboard.js
@@ -30,6 +30,7 @@ async function fetchGuestToken() {
     headers: {
       "X-CSRFToken": getCookie("csrftoken"),
     },
+    credentials: 'include',
     body: body,
   }); 

This beacuse fetch by default is strict and won't include cross-domain cookies even if cookie is LAX, or cross-domain.
I just made this PR for fixing it:

• fix: include credentials when cookie across subdomains platform-plugin-aspects#106

I would assume this is acceptable, since in any case in MFE ecosystem RESTful requests do incldue cross-site cookie. or when ajax is being used instead of native fetch.