You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "sssuckmyblood (via GitHub)" <gi...@apache.org> on 2026/05/18 15:24:51 UTC
[I] MCP user resolution not working in release 6.1.0 [superset]
sssuckmyblood opened a new issue, #40225:
URL: https://github.com/apache/superset/issues/40225
> I'm getting the same error message on 6.1.0 with Keycloak.
>
> 2026-05-18 12:27:22,599:ERROR:superset.mcp_service.middleware:MCP tool error: tool=health_check, user_id=None, duration_ms=62, error_type=ToolError, error=Error calling tool 'health_check': No authenticated user found. Tried:
> - g.user was not set by JWT middleware (MCP_AUTH_ENABLED=True, JWT keys configured=True)
> - MCP_DEV_USERNAME is not configured
_Originally posted by @sssuckmyblood in [#38899](https://github.com/apache/superset/issues/38899#issuecomment-4478087659)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] MCP user resolution not working in release 6.1.0 [superset]
Posted by "Ilya0527 (via GitHub)" <gi...@apache.org>.
Ilya0527 commented on issue #40225:
URL: https://github.com/apache/superset/issues/40225#issuecomment-4482589823
The phrasing "g.user was not set by JWT middleware" is misleading — it doesn't mean the middleware ran and failed, it means it never executed for this request. In 6.1.0 the MCP routes are served by a sub-app (FastMCP/ASGI mount), and Flask's `@before_request` JWT handler only fires for routes in Flask's own URL map. `/mcp/*` requests bypass it, so by the time the tool dispatcher reaches `flask.g` there's no `user` populated — or no Flask request context at all. The MCP_AUTH_ENABLED + JWT-keys-configured branch passes because both are static config reads; the failure is structural, not a Keycloak token problem. Your token's `aud`/`iss`/signature are never inspected.
Two cheap checks before chasing Keycloak specifics (audience claim, JWKS rotation, RS256 vs HS256):
1. Add `log.info("jwt mw path=%s", request.path)` at the top of the JWT `before_request`. If `/mcp/*` calls don't appear, the middleware isn't being invoked.
2. Set `MCP_DEV_USERNAME=admin` and retry `health_check`. If it succeeds, the resolver chain works end-to-end; only the JWT→g.user bridge for MCP is missing.
If both confirm, the fix is registering auth on the MCP dispatcher itself (or an ASGI auth middleware on the FastMCP app), not Keycloak realm tuning.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] MCP user resolution not working in release 6.1.0 [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #40225: MCP user resolution not working in release 6.1.0
URL: https://github.com/apache/superset/issues/40225
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] MCP user resolution not working in release 6.1.0 [superset]
Posted by "onionhammer (via GitHub)" <gi...@apache.org>.
onionhammer commented on issue #40225:
URL: https://github.com/apache/superset/issues/40225#issuecomment-5005637377
@rusackas is there a PR that fixes this? I assume so because it was closed as complete?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] MCP user resolution not working in release 6.1.0 [superset]
Posted by "priotto-dss (via GitHub)" <gi...@apache.org>.
priotto-dss commented on issue #40225:
URL: https://github.com/apache/superset/issues/40225#issuecomment-4736534985
> 6.1 doesn't yet support access token authentication. So in 6.1.0 you need to delegate to a user account with broad access by setting `MCP_DEV_USERNAME=<username>` in your `superset_config.py`
Please, what version support?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] MCP user resolution not working in release 6.1.0 [superset]
Posted by "villebro (via GitHub)" <gi...@apache.org>.
villebro commented on issue #40225:
URL: https://github.com/apache/superset/issues/40225#issuecomment-4483347948
6.1 doesn't yet support access token authentication. So in 6.1.0 you need to delegate to a user account with broad access by setting `MCP_DEV_USERNAME=<username>` in your `superset_config.py`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] MCP user resolution not working in release 6.1.0 [superset]
Posted by "sssuckmyblood (via GitHub)" <gi...@apache.org>.
sssuckmyblood commented on issue #40225:
URL: https://github.com/apache/superset/issues/40225#issuecomment-4479234632
To use corporate Keycloak SSO with Superset MCP, we had to patch the Docker image by replacing `auth.py` and `mcp_config.py` with the versions from the `master` branch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] MCP user resolution not working in release 6.1.0 [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #40225:
URL: https://github.com/apache/superset/issues/40225#issuecomment-4748563466
As @villebro noted, 6.1.0 (the newest release) doesn't yet support MCP access-token authentication. The supported path there is to delegate to an account via MCP_DEV_USERNAME in superset_config.py. Access-token auth is being added separately, so I'll close this, but please reopen or comment if the documented workaround doesn't unblock you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] MCP user resolution not working in release 6.1.0 [superset]
Posted by "Ilya0527 (via GitHub)" <gi...@apache.org>.
Ilya0527 commented on issue #40225:
URL: https://github.com/apache/superset/issues/40225#issuecomment-4483356322
That clarifies the 6.1.0 contract — MCP_DEV_USERNAME is the only supported path, and per-request JWT→user mapping lands later. The follow-on for multi-tenant deployments: every MCP tool call now executes as that single delegated account, which collapses row-level security, dataset permissions, and the audit trail to one principal. Is there a recommended pattern for limiting blast radius — a dedicated `mcp_service` role with narrowed schema/database grants — or is the expectation that operators only enable MCP in single-tenant setups until access-token support arrives?
Two things that would help 6.1.0 users immediately: documenting the minimum FAB roles MCP_DEV_USERNAME needs for `health_check` to pass (Public + Gamma seems under-privileged), and whether per-request identity in the next release will arrive via ASGI middleware on the FastMCP mount or a Flask→ASGI bridge. That structural choice determines how external IdPs like Keycloak plug in, so even a rough direction would help downstream integrators plan.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org