codeant-ai-for-open-source[bot] commented on code in PR #42935:
URL: https://github.com/apache/superset/pull/42935#discussion_r3744939682
##########
superset/mcp_service/mcp_config.py:
##########
@@ -568,6 +570,41 @@ def _is_mcp_guest_auth_enabled(app: Flask) -> bool:
return True
+def validate_multi_issuer_user_resolver(app: Flask) -> None:
+ """Reject a multi-issuer JWT trust config that has no issuer-aware
resolver.
+
+ ``default_user_resolver`` maps token claims to Superset users by
+ username/email without binding the token's ``iss`` claim. When more than
+ one issuer is trusted (``MCP_JWT_ISSUER`` configured as a list/tuple/set),
+ that lookup is not issuer-scoped: distinct issuers minting the same
+ username or email claim would resolve to the identical Superset user.
+ Single-issuer deployments are unaffected — the issuer is already pinned
+ by the verifier, so the username space is unambiguous.
+
+ Operators trusting more than one issuer must supply an issuer-aware
+ ``MCP_USER_RESOLVER`` (e.g. one that derives a compound iss+sub identity)
+ before the service will consider that configuration usable.
+ """
+ configured_issuer = app.config.get("MCP_JWT_ISSUER")
+ if (
+ isinstance(configured_issuer, (list, tuple, set))
+ and len(configured_issuer) > 1
+ and not app.config.get("MCP_USER_RESOLVER")
Review Comment:
✅ **Customized review instruction saved!**
**Instruction:**
> Do not require config-time verification that an operator-supplied
MCP_USER_RESOLVER derives an issuer-scoped identity; the resolver receives the
full access token and enforcing its behavior is the operator's responsibility.
**Applied to:**
- `superset/mcp_service/mcp_config.py`
---
💡 *To manage or update this instruction, visit: [CodeAnt AI
Settings](https://app.codeant.ai/org/settings/learnings)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
