GitHub user zuhairhalawa added a comment to the discussion: RBAC-only with a non-empty scope for the MCP server
One correction on the second suggestion: giving `quickstart_prompt` a `class_permission_name` would not avoid the scope denial. In `check_tool_permission` the scope check also applies to tools that have a class permission: the call is rejected when `has_permission and not _token_scope_allows(method_permission_name, class_permission_name)`. `_token_scope_allows` accepts either the flat scope (`superset:read` or `superset:write`) or the per-resource scope for a class listed in `RESOURCE_SCOPE_NAME` in `api_key_scopes.py`, and a name like `Superset` is not in that map. So a token that only carries `openid` is still denied; only the log line changes, from "Scope denied for permission-less tool" to "Scope denied for user". For a scoped token the ways around it are adding the `superset:*` scope on the IdP side, or changing how scopes are filtered. GitHub link: https://github.com/apache/superset/discussions/45673#discussioncomment-19166869 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
