AUTH_REMOTE_USER is not working after upgrade Apache superset 6.0.0rc4/3

[alex1404]

Hi All,
Has anyone encountered this issue? I couldn’t find any documentation regarding AUTH_REMOTE_USER in version 6.0.0. I’m aware that Flask App Builder was updated to version 5.0.

[dosubot[bot]]

AUTH_REMOTE_USER is still supported in Superset 6.0.0rc3/rc4, but there are multiple reports that it stopped working after the upgrade, even though it worked in 5.0.0. This appears to be a regression or breaking change—no official fix or migration note exists yet, and some users have reverted to 5.0.0 as a workaround [source].

The most common causes for failures are: the REMOTE_USER environment variable not being set (either by the proxy or by missing middleware), the proxy not forwarding the correct header, or issues with subpath/app root configuration (SUPERSET_APP_ROOT) and middleware ordering. Superset expects either the proxy to inject the username into REMOTE_USER, or for you to use ADDITIONAL_MIDDLEWARE in superset_config.py to copy a custom header into REMOTE_USER [source].

Here’s a quick checklist:

• Confirm AUTH_TYPE = AUTH_REMOTE_USER and AUTH_REMOTE_USER_ENV_VAR are set in your superset_config.py.
• If your proxy sets a custom header (like HTTP_X_PROXY_REMOTE_USER), add a middleware to copy it to REMOTE_USER and register it in ADDITIONAL_MIDDLEWARE.
• Make sure your proxy is forwarding the correct header and not stripping it.
• If you’re deploying under a subpath, check your SUPERSET_APP_ROOT and proxy settings—bugs in this area can break authentication and some endpoints may need proxy rewrites as a workaround [source].

Sample middleware for copying a proxy header:

class RemoteUserMiddleware(object):
    def __init__(self, app):
        self.app = app
    def __call__(self, environ, start_response):
        user = environ.pop('HTTP_X_PROXY_REMOTE_USER', None)
        if user:
            environ['REMOTE_USER'] = user
        return self.app(environ, start_response)

ADDITIONAL_MIDDLEWARE = [RemoteUserMiddleware]

If you’re still stuck, check the open issues and consider sharing your config and logs in the relevant threads. For now, reverting to 5.0.0 is the only confirmed workaround [source].

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[alex1404]

@dosu, This is custom code that previously worked in Apache Superset v5. Part of configOverrides in values.yaml. Were there any changes introduced in Apache Superset v6 that could potentially affect this implementation?

user_manager.py: |
      from flask_appbuilder.security.views import expose
      from superset.security import SupersetSecurityManager
      from flask_appbuilder.security.manager import BaseSecurityManager
      from flask_appbuilder.security.manager import AUTH_REMOTE_USER
      from flask import  redirect,  request
      from flask_login import login_user
      from flask_appbuilder._compat import as_unicode
      import logging
      import jwt
      log = logging.getLogger(__name__)
      
      # Create a custom view to authenticate the user
      AuthRemoteUserView=BaseSecurityManager.authremoteuserview
      class MuseAuthRemoteUserView(AuthRemoteUserView):
          @expose('/login/')
          def login(self):      
            user = self.appbuilder.sm.auth_user_db("xxxx", "xxxx")
            login_user(user, remember=False)
            return redirect('/dashboard/list/')
      
      
      
      # Create a custom Security manager that override the authremoteuserview with the one I've created
      class CustomSecurityManager(SupersetSecurityManager):
            authremoteuserview = MuseAuthRemoteUserView
      
      # Use my custom authenticator
      CUSTOM_SECURITY_MANAGER = CustomSecurityManager
      # User remote authentication
      AUTH_TYPE = AUTH_REMOTE_USER

[dosubot[bot]]

Yes, there are a few changes in Superset v6 (and Flask App Builder v5) that could affect your custom AUTH_REMOTE_USER implementation:

• Your custom security manager must inherit from SupersetSecurityManager, not Flask AppBuilder's SecurityManager. This is now enforced at startup—if your class doesn't subclass SupersetSecurityManager, Superset will raise an exception and refuse to start. Double-check your inheritance chain to avoid silent failures or denied access on admin views. See details and migration notes.

• Middleware order is critical. If you use a proxy header (like HTTP_X_PROXY_REMOTE_USER), you must add a middleware to copy it to REMOTE_USER and register it in ADDITIONAL_MIDDLEWARE. This is still required in v6, and the middleware stack is applied in order. See docs.

• If you deploy under a subpath (using SUPERSET_APP_ROOT), bugs in URL prefixing or middleware order can break authentication flows. AppRootMiddleware must run before ProxyFix for correct SCRIPT_NAME/path handling. See discussion.

• User objects returned by your custom login logic must have all required attributes (like active and is_authenticated) and eager-loaded roles. Missing these can cause silent access denial. See example.

If your implementation fails after upgrade, check inheritance, middleware, user attributes, and run superset init to sync roles. No direct breaking changes to AUTH_REMOTE_USER were documented, but these indirect changes can impact custom setups.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}