GitHub user FrancescoCastaldi added a comment to the discussion: MCP server:
how to map the JWT identity to a Superset user? (MCP_USER_RESOLVER in docs, not
found in code)
To answer your questions directly:
1. **Does `MCP_USER_RESOLVER` exist?**
Yes, but it was introduced in pull request #38747 for the Superset 7.0
development cycle (`master` and 7.0 release candidates). In the 6.1.0 release
tag, `superset/mcp_service/auth.py` only implements authentication via `g.user`
or fallback to `MCP_DEV_USERNAME`. The documentation was updated ahead of the
code backport.
2. **Is there a supported way in 6.1.0 to map token identity without
upgrading?**
In 6.1.0 there is no native configuration key for user resolution. However, you
can inject the resolver dynamically in `superset_config.py` by monkeypatching
the MCP authentication function during startup:
```python
# superset_config.py
from superset.extensions import security_manager
from flask import g
def patch_mcp_auth():
try:
import superset.mcp_service.auth as mcp_auth
original_get_user = mcp_auth.get_user_from_request
def custom_get_user_from_request():
user = original_get_user()
if user:
return user
# Extract JWT from Authorization header
from fastmcp.server.dependencies import get_access_token
token = get_access_token()
if token and hasattr(token, "claims"):
username = token.claims.get("preferred_username") or
token.claims.get("sub")
if username:
resolved_user =
security_manager.find_user(username=username)
if resolved_user:
return resolved_user
return None
mcp_auth.get_user_from_request = custom_get_user_from_request
except (ImportError, AttributeError):
pass
# Execute during config evaluation
patch_mcp_auth()
```
3. **Recommended Multi-User Setup:**
If you cannot patch 6.1.0 or upgrade to the 7.0 release line:
- Keep `MCP_DEV_USERNAME = None` in production environments to avoid privilege
escalation.
- Run the MCP server behind an API gateway or reverse proxy that validates the
user session and proxies requests with user context.
- When migrating to 7.0, configure the native `MCP_USER_RESOLVER` function in
`superset_config.py` taking `(app, access_token)` and returning the
corresponding username from your directory.
GitHub link:
https://github.com/apache/superset/discussions/45457#discussioncomment-19164445
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
