MikolajBalcerek commented on PR #45391:
URL: https://github.com/apache/superset/pull/45391#issuecomment-6222341153
Tested via:
- forked off 7.0.0 rc1
- added my changes
-
```
from typing import Any
from fastmcp.server.auth import AccessToken
from fastmcp.server.auth.providers.google import GoogleProvider
class MyCompanyGoogleProvider(GoogleProvider):
"""GoogleProvider that grants Superset scopes to Google tokens.
Google tokens only carry Google scopes (openid, userinfo.email).
Superset 7.0 checks a token's
scopes per tool whenever it has any, against `superset:read` /
`superset:write` /
`superset:<resource>:<action>`, so Google scopes alone would deny every
tool. We add the
Superset scopes given to the constructor; the user's FAB roles still
decide what each call may do.
Who may log in is decided outside this class: the Google OAuth client's
consent screen is
INTERNAL (my_company.com Workspace accounts only), and the token's email
must match an existing,
active Superset user (created by the my_company.com-only web login),
else Superset refuses the call.
"""
def __init__(self, *, superset_scopes: list[str], **kwargs: Any) -> None:
super().__init__(**kwargs)
self._superset_scopes = superset_scopes
async def load_access_token(self, token: str) -> AccessToken | None: #
type: ignore[override]
access_token = await super().load_access_token(token)
if access_token is None:
return None
return access_token.model_copy(
update={"scopes": [*access_token.scopes, *self._superset_scopes]}
)
- superset_config.py:
```
import os
from typing import Any
_MCP_PUBLIC_URL = "https://superset.my_company.com";
_MCP_SUPERSET_SCOPES = ["superset:read", "superset:write"]
def MCP_AUTH_FACTORY(app: Any) -> Any:
"""Native OAuth for MCP clients (Claude Code: /mcp -> Authenticate), via
browser redirect to Google OAuth."""
from mcp_support.google_auth import MyCompanyGoogleProvider
return MyCompanyGoogleProvider(
superset_scopes=_MCP_SUPERSET_SCOPES,
client_id=os.environ["OAUTH_CLIENT_ID"],
client_secret=os.environ["OAUTH_CLIENT_SECRET"],
base_url=_MCP_PUBLIC_URL,
required_scopes=["openid", "email"],
extra_authorize_params={"hd": "my_company.com"},
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
