mirror of
https://github.com/apache/superset.git
synced 2026-07-27 09:02:29 +00:00
3b2b7609a8
Implement comprehensive JWT authentication system for production deployments: • Add BearerAuthProvider integration with FastMCP for RS256 token validation • Support both static public keys and JWKS endpoints for enterprise key rotation • Implement scope-based authorization (dashboard:read, chart:write, etc.) • Extract user identity from JWT sub claim for proper audit trails • Maintain backward compatibility with admin fallback when auth disabled • Add comprehensive test coverage for authentication flows • Update documentation with human-friendly security setup guide Authentication is disabled by default for development convenience. Configure via environment variables for production use.