User Info and List Users getting permission denied after enabled SSO with O365

[murugesanthirumal]

User Info and List Users getting permission denied after enabled SSO with Microsoft O365, tested with Gamma/Public/Admin roles.
The user registration is happen and other features also able to accessible.

Is there any way to fix this?

Superset Version: 4.1.1

[dosubot[bot]]

Hey @murugesanthirumal, I'm here to help you with your Superset issue! Let's tackle this together. 🤖

The "User Info" and "List Users" actions in Superset require specific permissions. For "User Info," the resource accessed is UserDBModelView with the permission can userinfo, which is available to Admin, Alpha, and Gamma roles. For "List Users," the resource accessed is UserDBModelView with the permission can list, which is only available to the Admin role ^[1].

If you're experiencing permission issues after enabling SSO with Microsoft O365, it might be due to improper role mapping or permission settings in your SSO configuration. Here are a few steps you can take to troubleshoot and potentially resolve the issue:

1. Verify Role Mapping: Ensure that the roles assigned to users in Superset are correctly mapped to the roles in your SSO provider. This might require checking the SSO configuration settings to ensure that the correct roles are being assigned upon user login.

2. Check Superset Logs: Review the Superset logs for any error messages or warnings related to SSO authentication or permission issues. This can provide more insight into what might be going wrong.

3. Review SSO Configuration: Double-check the SSO configuration settings in Superset to ensure that they are correctly set up for Microsoft O365. This includes verifying any custom claims or attributes that might be used for role assignment.

4. Manual Role Assignment: If automatic role assignment via SSO is not working as expected, consider manually assigning the necessary roles to users within Superset to ensure they have the correct permissions.

If these steps do not resolve the issue, you may need to further investigate the integration settings between Superset and Microsoft O365 to ensure compatibility and correct configuration.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[murugesanthirumal]

@dosu
where to run this code snippet in superset, pls share the steps.

[dosubot[bot]]

To run the code snippet in Superset, you can follow these steps:

1. Access the Superset Environment: Ensure you have access to the environment where Superset is running. This could be a local development environment or a server where Superset is deployed.

2. Create a Custom Script: Create a new Python script file, for example, add_permission.py, and paste the code snippet into this file.

3. Modify the Script: Ensure the script imports the necessary modules and initializes the Superset application context. Here's an example of how the complete script might look:

   from flask_appbuilder.security.sqla.models import Role
   from superset import app, create_app
   
   # Initialize the Superset app
   app = create_app()
   
   with app.app_context():
       # Get the security manager
       security_manager = app.appbuilder.sm
   
       # Find the Gamma role
       gamma_role = security_manager.find_role("Gamma")
   
       # Add the "can_userinfo" permission to the Gamma role
       security_manager.add_permission_role(gamma_role, "can_userinfo")
   
       print("Permission added successfully.")

4. Run the Script: Execute the script in the environment where Superset is running. You can do this by navigating to the directory containing the script and running the following command:

   python add_permission.py

5. Verify the Changes: After running the script, check the Superset UI to ensure that the "Gamma" role now includes the "can_userinfo" permission.

By following these steps, you should be able to add the "can_userinfo" permission to the "Gamma" role in your Superset instance.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[murugesanthirumal]

@dosu

not accepting the str value, is there any specific numeric value?

python add_permission.py
Loaded your LOCAL configuration at [/root/.superset/superset_config.py]
CustomSecurityManager initialized!
2025-02-19 18:54:13,149:ERROR:flask_appbuilder.security.sqla.manager:Add Permission to Role Error: 'str' object has no attribute '_sa_instance_state'
Permission added successfully.

[dosubot[bot]]

The error message you're encountering suggests that the add_permission_role method is expecting a PermissionView object rather than a string. Here's how you can modify the script to correctly add the permission:

1. Find or Create the PermissionView: You need to ensure that the PermissionView object is created or retrieved before associating it with the role.

Here's an updated version of the script:

from superset import app, create_app

# Initialize the Superset app
app = create_app()

with app.app_context():
    # Get the security manager
    security_manager = app.appbuilder.sm

    # Find the Gamma role
    gamma_role = security_manager.find_role("Gamma")

    # Define the permission and view menu names
    permission_name = "can_userinfo"
    view_menu_name = "UserDBModelView"  # Adjust this to the correct view menu if needed

    # Add the permission view menu if it doesn't exist
    security_manager.add_permission_view_menu(permission_name, view_menu_name)

    # Find the PermissionView object
    perm_view = security_manager.find_permission_view_menu(permission_name, view_menu_name)

    # Add the PermissionView to the Gamma role
    security_manager.add_permission_role(gamma_role, perm_view)

    print("Permission added successfully.")

2. Run the Script Again: Execute the updated script in the same way as before:

python add_permission.py

This should correctly add the can_userinfo permission to the "Gamma" role by associating it with the appropriate PermissionView object.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[murugesanthirumal]

Thanks for your support! The issue has been identified and resolved.

We were using SQLite for the metadata database, which caused role changes in the frontend to not reflect in the SQLite role tables. We have now migrated the metadata database to MySQL, applied the necessary role table changes and it is working fine this table was keeps old deleted user role entry as same in SQLite.

Additionally, O365 SSO registration is now working properly with the defined roles.