GitHub user yves-renier created a discussion: RBAC-only with a non-empty scope for the MCP server
### Bug description Hello, I Have set up RBAC for the MCP server, but I get errors on tools which declare no permissions (attached bellow). I understand the problem comes from my Identity provider which does not accept an empty scope and that a token with a non-empty scope enable scope checks. I'm able to bypass that problem by modifying the `_get_token_scopes()` function in `superset/mcp_service/auth.py` and would like to propose a PR, but I'm not sure what would be preferred: - limiting the scopes to valid superset scopes (as in _METHOD_TO_REQUIRED_SCOPE.values()) - or adding a variable to exclude specific scopes (for example MCP_IGNORED_SCOPES=[...]) The idea being that if the only scopes present in the token are discarded by the chosen criteria above, then _get_token_scopes() function return None disabling scope checks. Would that be acceptable and if yes, what is the preferred solution ? ### Screenshots/recordings _No response_ ### Superset version master / latest-dev ### Python version 3.12 ### Node version 18 or greater ### Browser Firefox ### Additional context `superset_config.py` ```python # Enable JWT authentication MCP_AUTH_ENABLED = True # Enable role based accreditations MCP_RBAC_ENABLED = True ``` error in logs: > WARNING:superset.mcp_service.auth:Tool quickstart_prompt is > permission-protected but declares no class_permission_name; allowing access > without an RBAC check > WARNING:superset.mcp_service.auth:Scope denied for permission-less tool > quickstart_prompt: token lacks required scope for method read ### Checklist - [x] I have searched Superset docs and Slack and didn't find a solution to my problem. - [x] I have searched the GitHub issue tracker and didn't find a similar bug report. - [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section. GitHub link: https://github.com/apache/superset/discussions/45673 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
