apache/superset · error · UserNotFoundInSessionError

Could not validate the user in the current session.

Error message

Could not validate the user in the current session.

What it means

UserNotFoundInSessionError is raised in validate() when the username argument is empty or security_manager.get_user_by_username() cannot resolve it. The sync command needs a concrete user to impersonate (notably for OAuth2 connections), so an unresolvable username aborts validation.

Source

Thrown at superset/commands/database/sync_permissions.py:110

        )

    def validate(self) -> None:
        self._db_connection = (
            self._db_connection
            if self._db_connection
            else DatabaseDAO.find_by_id(self.db_connection_id)
        )
        if not self._db_connection:
            raise DatabaseNotFoundError()

        # Need user info to impersonate for OAuth2 connections. The id is
        # captured here, at validation/enqueue time, so that an async run of
        # this command binds to whoever held the username right now, rather
        # than re-resolving the (mutable) username at execution time.
        if not self.username or not (
            user := security_manager.get_user_by_username(self.username)
        ):
            raise UserNotFoundInSessionError()
        self._user_id = user.id

        with self.db_connection.get_sqla_engine() as engine:
            try:
                alive = ping(engine)
            except Exception as err:
                if (
                    self.db_connection.is_oauth2_enabled()
                    and self.db_connection.db_engine_spec.needs_oauth2(err)
                ):
                    raise MissingOAuth2TokenError() from err
                raise DatabaseConnectionFailedError() from err

        if not alive:
            raise DatabaseConnectionFailedError()

    def run(self) -> None:
        """

View on GitHub (pinned to f4587218dd)

Solutions

1. Pass the current authenticated user's username: flask.g.user.username or current_user.username
2. Verify the user exists: security_manager.get_user_by_username(name) is not None
3. If the user was renamed/deleted, use a valid admin username

Example fix

// before
 SyncPermissionsCommand(db_id, username=old_username).run()

// after
 user = security_manager.get_user_by_username(old_username)
 if user is None:
     raise ValueError(f"unknown user {old_username}")
 SyncPermissionsCommand(db_id, username=user.username).run()

from flask import g

username = getattr(g, "user", None) and g.user.username
if not username or not security_manager.get_user_by_username(username):
    raise PermissionError("no valid session user for permission sync")

try:
    cmd.run()
except UserNotFoundInSessionError:
    # re-run from a live authenticated request
    ...

When it happens

Trigger: Calling SyncPermissionsCommand with an empty/None username; passing a username of a user that was deleted or renamed; invoking from a background context where the session user is absent.

Common situations: User account deleted or username changed between the API request and command execution; scripts running outside a request context passing a hardcoded username that no longer exists.

Related errors

• Cannot convert node type: ${node.type}
• User does not have permission to update the theme
• Failed to load chart data
• A chart already exists and user doesn't have permissions to
• Chart {existing.slice_name!r} (uuid {config['uuid']}) was de

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/7a82f732eddd844d. Report an issue: GitHub.