GitHub user nicholas-greenwood added a comment to the discussion: MCP server: how to map the JWT identity to a Superset user? (MCP_USER_RESOLVER in docs, not found in code)
your 6.1.0 result matches the tagged code. the docs list `MCP_USER_RESOLVER`, but [6.1.0's `get_user_from_request()`](https://github.com/apache/superset/blob/6.1.0/superset/mcp_service/auth.py#L176-L230) only checks an existing `g.user` and `MCP_DEV_USERNAME`. adding a resolver to `superset_config.py` won't connect the validated jwt to a user in that version that connection was added in [#38747](https://github.com/apache/superset/pull/38747). `MCP_USER_RESOLVER` is used on `master` and in [7.0.0rc2's auth code](https://github.com/apache/superset/blob/7.0.0rc2/superset/mcp_service/auth.py#L560-L690). [7.0.0rc2 is a prerelease](https://github.com/apache/superset/releases/tag/7.0.0rc2), so i'd test it in staging before considering an upgrade in that implementation, `MCP_USER_RESOLVER(app, access_token)` returns an existing superset username. the [default resolver](https://github.com/apache/superset/blob/7.0.0rc2/superset/mcp_service/mcp_config.py#L839-L870) checks `preferred_username`, `username`, `email`, then `sub`. an opaque `sub` therefore needs an explicit mapping if it doesn't match your superset usernames. users must already exist, and an unknown identity is rejected for multi-user access, use that per-request identity path with `MCP_DEV_USERNAME` unset, `MCP_RBAC_ENABLED = True`, and jwt validation bound to your issuer and mcp audience. if you trust multiple issuers, the custom mapping needs to use both `iss` and `sub` so 2 issuers can't resolve the same subject to the wrong account. check with 2 users who have different dataset permissions, including concurrent calls, and confirm their audit user ids before exposing it if you need to stay on stable 6.1.0, i'm afraid there is no configuration-only fix in its native mcp path. i'd keep multi-user mcp disabled until you have a reviewed backport or a stable release containing the resolver. `MCP_DEV_USERNAME` would keep everyone acting as the same user cheers GitHub link: https://github.com/apache/superset/discussions/45457#discussioncomment-19042562 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
