GitHub user zuhairhalawa added a comment to the discussion: RBAC-only with a non-empty scope for the MCP server
This is the scope check layered on top of RBAC in `superset/mcp_service/auth.py`. `_get_token_scopes()` returns `None` (scope checks skipped) only when the token carries no scopes at all. As soon as the token has any scope, `_token_scope_allows()` requires the flat scope for the tool's method: `superset:read` for `read`/`get`, `superset:write` for `write`/`update`/`delete`/`execute_sql_query`. Tools that declare a class permission can alternatively be satisfied by a per-resource scope such as `superset:dashboard:read`, but tools without `class_permission_name`, like `quickstart_prompt`, only have the flat scope to fall back on. That matches the "Scope denied for permission-less tool ... required scope for method read" line for a token that only carries something like `openid`. So there is a way to get this working without changing Superset: have the IdP put `superset:read` (and `superset:write` if the write tools should be usable) on the token. That also gives the IdP the non-empty scope it insists on. The names come from `METHOD_PERMISSION_SCOPE_ACTION` in `superset/security/api_key_scopes.py`. `MCP_REQUIRED_SCOPES` is a different thing: it is passed to the JWT verifier as `required_scopes`, so it rejects tokens that lack those scopes, but it doesn't grant anything. Which of the two PR shapes is preferred isn't stated in the code or docs, so that is a call for the maintainers. One consequence of the filtering approach worth noting: a token whose scopes are all unrecognised (or a mistyped `superset:*` scope) would be treated as unscoped and fall back to RBAC-only, so the restriction would be dropped instead of denied. GitHub link: https://github.com/apache/superset/discussions/45673#discussioncomment-19161961 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
