How to Set Up Google Workspace SSO for Apache Superset

For organisations running on Google Workspace, Google SSO is the login experience users already

know. Flask-AppBuilder includes a built-in Google OAuth handler, making the initial Apache Superset

integration possible in just 15 minutes.

But there are two common pitfalls. First, Google OAuth can authenticate personal Gmail accounts unless access is explicitly restricted. Second, Google’s user info response provides names and email addresses but no group memberships by default, leaving Superset’s AUTH_ROLES_MAPPING without the information it needs. The result? Users silently fall into the default role.

This guide tackles both challenges in superset_config.py, exploring three increasingly powerful approaches to role mapping.

Already familiar with Superset OAuth? Our Okta guide covers the shared essentials, including proxy settings and break-glass access. Here, we focus on what makes Google SSO different.

Unlock Google SSO for Superset →