GitHub user nicholas-greenwood edited a comment on the discussion: MCP server: how to map the JWT identity to a Superset user? (MCP_USER_RESOLVER in docs, not found in code)
the docs list `MCP_USER_RESOLVER`, but it is not wired up in 6.1.0. [6.1.0's `get_user_from_request()`](https://github.com/apache/superset/blob/6.1.0/superset/mcp_service/auth.py#L176-L230) only checks an existing `g.user` and `MCP_DEV_USERNAME`. adding a resolver to `superset_config.py` won't connect the validated jwt to a user in that version the resolver was added in [#38747](https://github.com/apache/superset/pull/38747). `MCP_USER_RESOLVER` is used on `master` and in [7.0.0rc2's auth code](https://github.com/apache/superset/blob/7.0.0rc2/superset/mcp_service/auth.py#L560-L690). [7.0.0rc2 is a prerelease](https://github.com/apache/superset/releases/tag/7.0.0rc2), so i'd test it in staging before considering an upgrade in that implementation, `MCP_USER_RESOLVER(app, access_token)` returns an existing superset username. the [default resolver](https://github.com/apache/superset/blob/7.0.0rc2/superset/mcp_service/mcp_config.py#L839-L870) checks `preferred_username`, `username`, `email`, then `sub`. if an opaque `sub` doesn't match your superset usernames, you'll need an explicit mapping the users must already exist. unknown identities are rejected for multi-user access: - leave `MCP_DEV_USERNAME` unset - set `MCP_RBAC_ENABLED = True` - bind jwt validation to your issuer and mcp audience if you trust multiple issuers, map using both `iss` and `sub`. otherwise, 2 issuers could resolve the same subject to the wrong account before exposing the service, test with 2 users who have different dataset permissions. include concurrent calls and check their audit user ids if you need to stay on stable 6.1.0, i'm afraid there's no configuration-only fix for multi-user identity in its mcp authentication code. i'd keep multi-user mcp disabled until you have a reviewed backport or a stable release containing the resolver. `MCP_DEV_USERNAME` would keep everyone acting as the same user cheers GitHub link: https://github.com/apache/superset/discussions/45457#discussioncomment-19042562 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
