You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@superset.apache.org by "gabriel-korbato (via GitHub)" <gi...@apache.org> on 2025/11/01 03:27:33 UTC

[I] List users does not work with custom security [superset]

gabriel-korbato opened a new issue, #35939:
URL: https://github.com/apache/superset/issues/35939

### Bug description

When I log in to Superset an an Admin and I try to access the list of users from the menu, I get an "Access is denied" notification, and no logged errors in the server's console logs. This feature was working correctly with version 4 but stopped working when I used the same security configuration for version 5. We have Superset installed with pip in a virtual environment, and we have a remote user middleware and a custom SecurityManager that overrides the login() function. I have verified with log messages that the user is correctly authenticated and has the Admin role.

### Screenshots/recordings

_No response_

### Superset version

5.0.0

### Python version

Not applicable

### Node version

Not applicable

### Browser

Chrome

### Additional context

I found a similar issue #29505 but the solution there didn't work.
python version 3.12.3.

### Checklist

- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] List users does not work with custom security [superset]

Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.

dosubot[bot] commented on issue #35939:
URL: https://github.com/apache/superset/issues/35939#issuecomment-3475685196

   <!-- Answer -->
   In Superset 5.0.0, custom SecurityManager implementations must now extend `SupersetSecurityManager` (not Flask AppBuilder's SecurityManager). If your custom class doesn't inherit from `SupersetSecurityManager`, admin-only views like "List Users" will always deny access, even if the user appears to have the Admin role. This is a breaking change from previous versions and is enforced at app startup—see the check and error message in the initialization code ([source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/initialization/__init__.py#L303-L620)).
   
   Also, Superset expects user objects to have certain attributes (like `active` and `is_authenticated`) for permission checks. If your custom SecurityManager or user class doesn't provide these, access can be denied without clear errors ([example](https://github.com/apache/superset/issues/35282)).
   
   To restore access to the user list:
   - Make sure your custom SecurityManager inherits from `SupersetSecurityManager`.
   - Confirm your user objects implement all required attributes (`active`, `is_authenticated`, etc.).
   - Double-check that your Admin role assignment logic is compatible with Superset's expectations in v5.
   
   Issue #29505 is unrelated; it addresses a different security config problem and does not resolve this specific regression. 
   
   If you update your custom SecurityManager to inherit from `SupersetSecurityManager` and ensure all required user attributes are present, the "List Users" page should work as expected for Admins in Superset 5.0.0 ([reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/initialization/__init__.py#L303-L620)).
   
   
   <!-- Dosu Comment Footer -->
   *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
   
   ---
   <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/0a348160-373b-461e-aed0-557cbe6b141e?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/0a348160-373b-461e-aed0-557cbe6b141e?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/0a348160-373b-461e-aed0-557cbe6b141e?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/0a348160-373b-461e-aed0-557cbe6b141e?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/0a348160-373b-461e-aed0-557cbe6b141e?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/0a348160-373b-461e-aed0-557cbe6b141e?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/0a348160-373b-461e-aed0-557cbe6b141e?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=githu
 b)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/35939)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] List users does not work with custom security [superset]

Posted by "gabriel-korbato (via GitHub)" <gi...@apache.org>.

gabriel-korbato commented on issue #35939:
URL: https://github.com/apache/superset/issues/35939#issuecomment-3475722635

   Running `superset init` again solved the issue. I had already tried this without success but maybe something got updated in my testing.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] List users does not work with custom security [superset]

Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.

dosubot[bot] commented on issue #35939:
URL: https://github.com/apache/superset/issues/35939#issuecomment-3475719071

   <!-- Answer -->
   This issue is almost always caused by the remote user middleware assigning a user object to `g.user` that is not a fully loaded SQLAlchemy User model with roles eagerly loaded from the database. Superset’s permission checks for admin-only views like "List Users" require that the user object (on `g.user`) has a complete `.roles` relationship; if roles are missing or not loaded, access is denied—even if `active` and `is_authenticated` are `True` and the user appears to have the Admin role in logs. This is a silent failure and won’t show up in logs by default [reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/manager.py).
   
   To debug, add a log statement in your middleware or just before the permission check to print out the user object and its roles, for example:
   
   ```python
   import logging
   logging.warning("User: %r, roles: %r", g.user, getattr(g.user, "roles", None))
   ```
   
   If `roles` is empty or not a list of Role objects, you need to fetch the user from the database on every request, making sure to eager-load roles. For example:
   
   ```python
   from superset.extensions import db, security_manager
   user = db.session.query(security_manager.user_model).filter_by(username=username).first()
   # Optionally: db.session.refresh(user)
   ```
   
   Make sure your middleware always sets `g.user` to this fully loaded user object, not a stub or partial object. This pattern is required for all custom/remote user setups in Superset 5.0.0 [reference](https://github.com/apache/superset/discussions/33877).
   
   Also, after any upgrade or role mapping change, run `superset init` to sync permissions and roles in the database [reference](https://github.com/apache/superset/blob/master/docs/docs/configuration/configuring-superset.mdx).
   
   If you’re using external authentication (OIDC, LDAP, etc.), double-check your `AUTH_ROLES_MAPPING` and `AUTH_ROLES_SYNC_AT_LOGIN` settings to ensure the Admin role is actually assigned in the backend database, not just in the frontend or session [reference](https://github.com/apache/superset/discussions/34659).
   
   Let me know if you want a code snippet for a robust remote user loader!
   
   
   <!-- Dosu Comment Footer -->
   *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
   
   ---
   <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/092c2eec-8f6c-41bf-9119-251dd28ba909?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/092c2eec-8f6c-41bf-9119-251dd28ba909?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/092c2eec-8f6c-41bf-9119-251dd28ba909?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/092c2eec-8f6c-41bf-9119-251dd28ba909?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/092c2eec-8f6c-41bf-9119-251dd28ba909?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/092c2eec-8f6c-41bf-9119-251dd28ba909?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/092c2eec-8f6c-41bf-9119-251dd28ba909?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=githu
 b)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/35939)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] List users does not work with custom security [superset]

Posted by "gabriel-korbato (via GitHub)" <gi...@apache.org>.

gabriel-korbato commented on issue #35939:
URL: https://github.com/apache/superset/issues/35939#issuecomment-3475716105

   @dosu My custom security manager extends `SupersetSecurityManager`, and I checked with log messages that my Admin user has the `active` and `is_authenticated` attributes set to `True`. I still have the problem. Can you help?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [I] List users does not work with custom security [superset]

Posted by "gabriel-korbato (via GitHub)" <gi...@apache.org>.

gabriel-korbato closed issue #35939: List users does not work with custom security
URL: https://github.com/apache/superset/issues/35939


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org