yves-renier opened a new pull request, #45984:
URL: https://github.com/apache/superset/pull/45984
### SUMMARY
Following #45673 this PR introduce a new configuration variable
`MCP_IGNORED_SCOPES` which allows to enable a RBAC-only behavior in the MCP
server while using an identity provider which force users to request a scope.
It is done by ignoring the scopes specified in `MCP_IGNORED_SCOPES` to be
able to reach the same code path as when the scope is empty.
I added a description in `MCP_IGNORED_SCOPES`.
I also added an empty default value in `superset/mcp_service/mcp_config.py`
, though I'm not sure it was required.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
-> no change in UI
### TESTING INSTRUCTIONS
1) Set a scope in the configuration of the app in your identity provider
2) set the same scopes in `superset_config.py`
f.e. `MCP_IGNORED_SCOPES = {"openid", "profile", "email",
"offline_access"}`
3) check you have set-up MCP RBAC and authentication in `superset_config.py`:
```
# Enable JWT authentication
MCP_AUTH_ENABLED = True
# Enable role based accreditations
MCP_RBAC_ENABLED = True
```
4) start the mcp server with `superset mcp run` and check there are no
errors anymore like
```
WARNING:superset.mcp_service.auth:Tool quickstart_prompt is
permission-protected but declares no class_permission_name; allowing access
without an RBAC check
WARNING:superset.mcp_service.auth:Scope denied for permission-less tool
quickstart_prompt: token lacks required scope for method read
```
### ADDITIONAL INFORMATION
- [x] Has associated issue: Fixes #45673
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
