yves-renier opened a new issue, #45661: URL: https://github.com/apache/superset/issues/45661
### Bug description Hello, I Have set up RBAC for the MCP server, but I get errors on tools which declare no permissions (attached bellow). I understand the problem comes from my Identity provider which does not accept an empty scope and that a token with a non-empty scope enable scope checks. I'm able to bypass that problem by modifying the `_get_token_scopes()` function in `superset/mcp_service/auth.py` and would like to propose a PR, but I'm not sure what would be preferred: - limiting the scopes to valid superset scopes (as in _METHOD_TO_REQUIRED_SCOPE.values()) - or adding a variable to exclude specific scopes (for example MCP_IGNORED_SCOPES=[...]) The idea being that if the only scopes present in the token are discarded by the chosen criteria above, then _get_token_scopes() function return None disabling scope checks. Would that be acceptable and if yes, what is the preferred solution ? ### Screenshots/recordings _No response_ ### Superset version master / latest-dev ### Python version 3.12 ### Node version 18 or greater ### Browser Firefox ### Additional context `superset_config.py` ```python # Enable JWT authentication MCP_AUTH_ENABLED = True # Enable role based accreditations MCP_RBAC_ENABLED = True ``` error in logs: > WARNING:superset.mcp_service.auth:Tool quickstart_prompt is permission-protected but declares no class_permission_name; allowing access without an RBAC check > WARNING:superset.mcp_service.auth:Scope denied for permission-less tool quickstart_prompt: token lacks required scope for method read ### Checklist - [x] I have searched Superset docs and Slack and didn't find a solution to my problem. - [x] I have searched the GitHub issue tracker and didn't find a similar bug report. - [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
