dosubot[bot] commented on issue #41209: URL: https://github.com/apache/superset/issues/41209#issuecomment-4745655108
<!-- Answer --> This is likely a configuration issue rather than a bug. When using LDAP authentication, Flask-AppBuilder (which Superset delegates auth to) has a setting called **`AUTH_ROLES_SYNC_AT_LOGIN`** that controls whether roles are re-synced from LDAP groups on every login [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/docs/docs/configuration/configuring-superset.mdx#L508). If `AUTH_ROLES_SYNC_AT_LOGIN` is set to `True` (or defaults to `True`), then on each login the user's roles get overwritten based on their LDAP group membership via `AUTH_ROLES_MAPPING`. Any manually assigned roles (like your `custom_role`) will be wiped out. **To fix this**, set in your `superset_config.py`: ```python AUTH_ROLES_SYNC_AT_LOGIN = False ``` This will sync roles from LDAP only during initial user registration and allow manually assigned roles to persist across logins. Alternatively, if you *do* want roles synced from LDAP on every login, you should manage role assignments through LDAP groups using `AUTH_ROLES_MAPPING` [[2]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/docs/docs/configuration/configuring-superset.mdx#L498-L501): ```python AUTH_ROLES_MAPPING = { "cn=custom_role_group,ou=groups,dc=example,dc=com": ["custom_role"], "cn=gamma_group,ou=groups,dc=example,dc=com": ["Gamma"], } ``` This way the roles are driven by LDAP group membership rather than manual UI assignments. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).* --- Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset). [](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=a2fd86ce-8527-4aff-ba0a-7537a1ccd973) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
