Natural-Language Querying on Apache Superset: Build Text-to-SQL Yourself or Use a Managed AI Layer

 

The question usually arrives in a steering meeting, phrased as if it were small: now that everyone has used a chatbot, can people not just ask Superset a question and get the chart? The honest answer is yes, but the Friday demo is not what you can give four hundred people on Monday.

Turning “revenue by region last quarter” into SQL is an afternoon’s work. A layer that picks the right dataset, respects every permission you have built, refuses what it cannot answer, and stays accurate after someone renames a column is a small product with an owner.

This post breaks the layer into its parts, describes what building each on Apache Superset involves, and explains where a managed option fits.

We build Superset platforms and also a managed AI product on Superset, so we state that product’s limits as plainly as its strengths.

Read the full guide

Building a Custom Filter or Control-Panel Component for Apache Superset

 

Not all Apache Superset filters work the same way. Chart controls, native dashboard filters, and cross-filtering serve different purposes—and each requires a different implementation approach.

This guide explains how to build all three, from configuring chart-specific controls in controlPanel.ts to implementing dashboard-wide native filters and interactive cross-filtering. Discover where each component belongs, how they differ, and which approach best fits your requirements.

Start with the simplest solution and build smarter Superset filtering experiences without unnecessary frontend modifications.

Build Interactive Filters → 

Superset Plugin Performance: Rendering 100k-Row Datasets Without Freezing the Dashboard

 

The complaint arrives as “the dashboard is slow”, and the first instinct is to look at the database. 

Check the query time in Superset’s chart data response and it is often under a second.

The other nine seconds are in the browser: parsing the response, transforming it, and drawing a hundred thousand DOM nodes.

Custom plugins are especially prone to this because they are written against a sample dataset and shipped before anyone tries them on the real one. (If you have not built one yet, start with how to build a custom chart plugin for Apache Superset; this post assumes that structure.) 

This post is about finding where the time goes and fixing it, in the order that gives the most improvement for the least rework. 

Read More

Superset Plugin Performance: Rendering 100k-Row Datasets Without Freezing the Dashboard

Is your Apache Superset dashboard slow even when database queries finish in under a second? The

bottleneck might be your browser—not your database. Parsing large responses, transforming data, and

rendering thousands of DOM nodes can turn a fast query into a sluggish dashboard.

Custom chart plugins are especially vulnerable when tested only with sample datasets. This guide shows you how to identify and fix performance bottlenecks in the right order, using three essential tools: Superset's query timing, Chrome Performance panel, and React Profiler.

Discover how to pinpoint expensive transformations, reduce unnecessary renders, and optimize rendering performance. Measure first, optimize smarter, and make your dashboards faster.

Already building custom charts? Start with our guide to building a custom chart plugin for Apache Superset.

Find Your Dashboard's Bottleneck → 

How to Set Up Google Workspace SSO for Apache Superset

For organisations running on Google Workspace, Google SSO is the login experience users already

know. Flask-AppBuilder includes a built-in Google OAuth handler, making the initial Apache Superset

integration possible in just 15 minutes.

But there are two common pitfalls. First, Google OAuth can authenticate personal Gmail accounts unless access is explicitly restricted. Second, Google’s user info response provides names and email addresses but no group memberships by default, leaving Superset’s AUTH_ROLES_MAPPING without the information it needs. The result? Users silently fall into the default role.

This guide tackles both challenges in superset_config.py, exploring three increasingly powerful approaches to role mapping.

Already familiar with Superset OAuth? Our Okta guide covers the shared essentials, including proxy settings and break-glass access. Here, we focus on what makes Google SSO different.

Unlock Google SSO for Superset → 

How to Set Up Keycloak SSO for Apache Superset (OpenID Connect)

When organisations need full control over identity, Keycloak is a natural fit—whether for on-premise

deployments, regulated environments, multiple upstream directories, or an entirely open-source stack.

Apache Superset fits right in, with Flask-AppBuilder providing a built-in Keycloak handler that makes

integration a configuration task, not a coding project.

But there’s one silent trap to watch for. 🔍 Keycloak’s default client configuration doesn’t include the groups claim that FAB uses to map users to Superset roles. The result? Logins succeed, but everyone gets the default role. No obvious error—just incorrect access.

This guide fixes that in Step 1, before it catches you off guard.

Already familiar with Superset SSO? Our Okta guide covers the shared essentials, including authentication, reverse-proxy settings, and break-glass access. Here, we focus exclusively on what makes Keycloak integration different.

Tested with Superset 4.x and Keycloak 24, with compatibility for Keycloak 17 and later—the versions that no longer use the /auth URL prefix.

Read The Complete Technical Guide

How to Set Up Microsoft Entra ID (Azure AD) SSO for Apache Superset

 

Apache Superset SSO with Microsoft Entra ID

If your organisation uses Microsoft 365, Microsoft Entra ID (formerly Azure Active Directory) already manages employee identities and access. Integrating Superset with Entra ID lets you centralise authentication instead of maintaining separate passwords. Flask-AppBuilder provides a built-in Azure OAuth handler, making configuration possible without custom code.

This guide complements our Okta SSO guide, focusing on Entra-specific app registration, role mapping, and common authentication errors. General authentication mechanics, reverse-proxy settings, and break-glass procedures remain unchanged.

The configuration covers Apache Superset 2.1 through 4.x, with examples based on version 4.x.

Groups or app roles?

Entra can put either the user’s group memberships or their app roles into the token. Flask-AppBuilder’s Azure handler reads the roles claim, which is app roles, and uses it as the list of keys to match against AUTH_ROLES_MAPPING.

App roles are also the better design for Superset:

• No overage problem. Entra stops emitting the groups claim when a user is in more than a couple of hundred groups and replaces it with an overage indicator. Large organisations hit this routinely. App roles are specific to your application and never overflow.

• Assignment lives on the application. You assign a group or a user to an app role in the Superset enterprise application. The Entra admin sees exactly who can reach Superset and as what, without decoding group names.

• Role names are yours. Superset.Admin, Superset.Analyst, Superset. Viewer are clearer than a security group created five years ago for something else.

So this guide uses app roles. If you must use groups, the section near the end explains what to change.

Curious How It Works? →