How to Set Up Okta Single Sign-On for Apache Superset

Password logins are the first thing an auditor asks about and the last thing anyone wants to manage by hand. If your team already uses Okta for everything else, Superset should not be the exception: one identity, one place to offboard, and roles that follow the person rather than the login.

Apache Superset supports this out of the box through Flask-AppBuilder (FAB), the framework Superset is built on. The pieces are all there. What is missing is a single, current walkthrough that covers the Okta side, the Superset side, the role mapping, and the handful of reverse-proxy and cookie settings that turn a working configuration into a redirect loop. This is that walkthrough.

By the end, you will have:

  • Okta as the only login path for Superset, with the local password form gone.
  • Users created automatically on first login, with their Okta groups mapped to Superset roles.
  • Role changes in Okta reflected in Superset at next login.
  • A troubleshooting table for the errors this setup produces in practice.

The configuration shown here applies to Superset 2.1 through 4.x. The examples were written against Superset 4.x with the Flask-AppBuilder 4 series it ships with.

How Superset authentication actually works

Superset does not implement authentication itself. FAB does, through its SecurityManager, and Superset extends that with SupersetSecurityManager. FAB supports five authentication types, selected with AUTH_TYPE in superset_config.py:

AUTH_TYPE What it does Typical use
AUTH_DB Username and password stored in Superset’s metadata database Default, small teams, demos
AUTH_LDAP Bind against an LDAP or Active Directory server On-premises corporate directories
AUTH_OAUTH OAuth 2.0 / OpenID Connect against one or more providers Okta, Azure AD, Google, Keycloak, Auth0
AUTH_OID Legacy OpenID 2.0 Rarely used today
AUTH_REMOTE_USER Trust a header set by an upstream proxy Behind an SSO-terminating gateway

Okta is an AUTH_OAUTH provider. Under the hood, FAB uses the Authlib client library to run the authorization-code flow, fetch the user’s profile from the provider’s userinfo endpoint, and hand the result to a method called oauth_user_info. FAB ships a handler for Okta, so a standard setup works without a custom security manager — though as Step 2 explains, there is one good reason to write one anyway.

Prerequisites

  • Admin access to your Okta org, or someone who has it and twenty minutes.
  • A running Superset instance reachable over HTTPS on a stable hostname. OAuth callbacks to localhost work for testing; callbacks to plain HTTP in production do not.
  • The ability to edit superset_config.py and restart Superset.
  • Authlib installed in the Superset environment. The official Docker image includes it. For a pip install, run pip install authlib if python -c "import authlib" fails.
  • A short list of Okta groups you want to map to Superset roles. Three is a good start: administrators, analysts who can write SQL, and viewers.

Step 1: Create the Okta application integration

In the Okta Admin Console:

  1. Go to Applications, then Applications, and click Create App Integration.
  2. Choose OIDC – OpenID Connect as the sign-in method and Web Application as the application type.
  3. Name it something your users will recognise, for example “Superset BI”.
  4. Under Grant type, leave Authorization Code ticked. Superset does not need implicit or hybrid flows.
  5. Set the Sign-in redirect URI to https://superset.example.com/oauth-authorized/okta. The last path segment must match the provider name you will use in superset_config.py, which in this guide is okta.
  6. Set the Sign-out redirect URI to https://superset.example.com/login/.
  7. Under Assignments, assign the groups that should be allowed to log in. Anyone not assigned will be refused by Okta before Superset ever sees them, which is the behaviour you want.
  8. Save, then copy the Client ID and Client secret from the General tab.

Choose the authorization server and expose groups

Okta has two kinds of authorization servers. The org authorization server at https://<your-org>.okta.com issues tokens for Okta’s own APIs and does not let you add custom claims. The default custom authorization server at https://<your-org>.okta.com/oauth2/default does, and it is what you need if you want group-based role mapping. Every URL in this guide uses the custom server.

To make Okta include the user’s groups in the response Superset reads:

  1. Go to Security, then API, open the default authorization server, and select the Claims tab.
  2. Click Add Claim. Name it groups, set the value type to Groups, filter Matches regex with the value .*, and include it in Any scope.
  3. Add the claim for both the ID Token and the Access Token, with type Always. FAB does not read the ID token; it calls Okta’s userinfo endpoint with the access token and maps roles from that payload. Configuring only the ID token is the most common reason group mapping silently does nothing.
  4. On the Scopes tab, confirm a groups scope exists, or add one. Superset will request it.

The regex .* returns every group the user belongs to. In large orgs, that can be a long list. Filter by a prefix such as ^superset_ if you want to keep the token small; everything else in this guide still works.

Step 2: Configure Superset

Add the following to superset_config.py. Keep the client secret out of the file and read it from the environment or your secrets manager.

python
import os
from flask_appbuilder.security.manager import AUTH_OAUTH

OKTA_BASE_URL = os.environ["OKTA_BASE_URL"]  # e.g. https://acme.okta.com
OKTA_ISSUER = f"{OKTA_BASE_URL}/oauth2/default"

AUTH_TYPE = AUTH_OAUTH

OAUTH_PROVIDERS = [
    {
        "name": "okta",
        "icon": "fa-circle-o",
        "token_key": "access_token",
        "remote_app": {
            "client_id": os.environ["OKTA_CLIENT_ID"],
            "client_secret": os.environ["OKTA_CLIENT_SECRET"],
            "api_base_url": f"{OKTA_ISSUER}/v1/",
            "client_kwargs": {"scope": "openid profile email groups"},
            "server_metadata_url": f"{OKTA_ISSUER}/.well-known/openid-configuration",
            "access_token_url": f"{OKTA_ISSUER}/v1/token",
            "authorize_url": f"{OKTA_ISSUER}/v1/authorize",
            "jwks_uri": f"{OKTA_ISSUER}/v1/keys",
        },
    }
]

# Create a Superset user the first time someone signs in through Okta.
AUTH_USER_REGISTRATION = True

# Role for users whose groups match nothing in AUTH_ROLES_MAPPING.
AUTH_USER_REGISTRATION_ROLE = "Gamma"

# Okta group name -> list of Superset roles.
AUTH_ROLES_MAPPING = {
    "superset_admins": ["Admin"],
    "superset_analysts": ["Alpha", "sql_lab"],
    "superset_viewers": ["Gamma"],
}

# Re-evaluate roles from the groups claim on every login, so a change in
# Okta takes effect the next time the user signs in.
AUTH_ROLES_SYNC_AT_LOGIN = True

What each block does:

  • name is the provider key. It appears in the login button and, more importantly, in the callback path /oauth-authorized/okta. It must match the redirect URI you registered in Okta.
  • server_metadata_url lets Authlib discover the token endpoint, signing keys and supported scopes from Okta’s OpenID configuration document. The explicit access_token_url, authorize_url and jwks_uri entries are belt and braces; they let the flow keep working if discovery is ever blocked by an egress firewall.
  • api_base_url is where FAB fetches the user profile from. FAB’s built-in Okta handler calls userinfo relative to this URL, which resolves to https://acme.okta.com/oauth2/default/v1/userinfo.
  • client_kwargs.scope must include groups, or the claim you created in Step 1 will never arrive.
  • AUTH_USER_REGISTRATION is what turns a successful Okta login into a Superset user record. Without it, only users you created by hand can log in.
  • AUTH_ROLES_MAPPING keys are Okta group names, exactly as they appear in the token. Values are lists of Superset role names. Admin, Alpha, Gamma, sql_lab and Public are the roles Superset creates by default; any custom role you have created works too.
  • AUTH_ROLES_SYNC_AT_LOGIN is the setting most people miss. Without it, roles are assigned once, at registration, and removing someone from an Okta group has no effect on what they can see in Superset. Note the flip side: with sync on, Okta is the only source of truth, so a role you grant by hand in Superset’s UI is wiped at that user’s next login.

When you need a custom security manager

FAB’s built-in Okta handler works, but it derives the username from the token’s sub claim and prefixes it, so your user list fills up with entries like okta_00u1a2b3c4d5e6f7g8h9. That is unpleasant to administer and impossible to eyeball against an audit request. Overriding oauth_user_info is also the fix if your Okta org names the groups claim differently, nests it, or you want usernames to be email addresses regardless of what preferred_username says:

python
import logging

from superset.security import SupersetSecurityManager

log = logging.getLogger(__name__)


class OktaSecurityManager(SupersetSecurityManager):
    def oauth_user_info(self, provider, response=None):
        if provider != "okta":
            return super().oauth_user_info(provider, response)

        me = self.appbuilder.sm.oauth_remotes[provider].get("userinfo").json()

        # Logs which claims arrived without dumping personal data.
        log.debug("Okta userinfo claims: %s", sorted(me.keys()))

        return {
            "username": me["email"].lower(),
            "first_name": me.get("given_name", ""),
            "last_name": me.get("family_name", ""),
            "email": me["email"].lower(),
            "role_keys": me.get("superset_roles", me.get("groups", [])),
        }


# Also in superset_config.py, after the class is importable:
CUSTOM_SECURITY_MANAGER = OktaSecurityManager

The role_keys list is what FAB matches against AUTH_ROLES_MAPPING. Using the email address as the username is a deliberate choice: it is stable, unique, and survives a rename in Okta better than preferred_username does. Pick one convention before the first login, because changing it later creates duplicate user records.

That debug line is also your diagnostic for Step 1: if groups is missing from the logged claim list, the problem is the Okta claim configuration, not Superset.

Step 3: Settings that matter behind a reverse proxy

Almost every production Superset sits behind a load balancer, an ingress controller, or an Nginx proxy that terminates TLS. That changes what Superset thinks its own URL is, and OAuth is unforgiving about URLs.

python
from datetime import timedelta

# Trust X-Forwarded-* headers from the proxy so Superset builds https:// URLs.
ENABLE_PROXY_FIX = True
PROXY_FIX_CONFIG = {"x_for": 1, "x_proto": 1, "x_host": 1, "x_port": 1, "x_prefix": 1}

# Cookies must be sent on the callback from Okta.
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = "Lax"  # "Strict" breaks the OAuth callback

# Log people out after a working day; Okta deactivation does not end live sessions.
PERMANENT_SESSION_LIFETIME = timedelta(hours=10)

Three points worth underlining:

  • Without ENABLE_PROXY_FIX, Superset sees the request as plain HTTP and constructs a redirect_uri starting with http://. Okta compares it to the https:// value you registered and rejects the login with a redirect URI mismatch.
  • SESSION_COOKIE_SAMESITE = "Strict" looks like the secure choice, and it is the one that breaks OAuth. The callback from Okta is a cross-site navigation. With Strict, the browser withholds the session cookie, Superset cannot find the state it stored before redirecting, and you get a mismatching_state error. Use Lax.
  • Deactivating someone in Okta stops new logins immediately but does not touch sessions Superset has already issued. PERMANENT_SESSION_LIFETIME bounds how long that window can be. For sensitive data, make it shorter.

Step 4: Restart and test

Restart Superset. The login page now shows a single “Sign in with Okta” button and no username or password fields.

  1. Sign in with a user who is in superset_admins. You should land on the welcome page with the Admin menu visible.
  2. Go to Settings, then List Users, and confirm the user was created with the expected username, email, and roles.
  3. Sign in as a user in superset_viewers from a private window. Confirm they see dashboards they are permitted to see and nothing else. Row-level security rules, if you have them, still apply exactly as before; SSO changes how people authenticate, not what the roles allow.
  4. Move that user into superset_analysts in Okta, sign them out and back in, and confirm SQL Lab appears. This proves AUTH_ROLES_SYNC_AT_LOGIN is working.
  5. Remove the user from every Superset group in Okta and sign in again. They should now hold only the AUTH_USER_REGISTRATION_ROLE. If you would rather they be refused entirely, remove them from the Okta application assignment instead.

Keep a break-glass path. Switching to AUTH_OAUTH removes the password form, so if Okta is unavailable, nobody can log in. Document the rollback: a copy of the previous superset_config.py with AUTH_DB, a known-good admin account in the metadata database, and the restart command. Test it once before you need it.

Troubleshooting

Symptom Likely cause Fix
Okta shows “The redirect_uri parameter must be a Login redirect URI” The callback URL Superset sent does not match Okta exactly Check the provider name, the scheme (http vs https), and trailing slashes. Enable ENABLE_PROXY_FIX behind a proxy.
mismatching_state: CSRF Warning! State not equal in request and response Session cookie not sent on the callback Set SESSION_COOKIE_SAMESITE = "Lax" and make sure SESSION_COOKIE_SECURE matches the scheme in use.
Login succeeds, but every user gets the Gamma role only Groups claim missing from the userinfo response Confirm the groups claim is configured for the Access Token as well as the ID Token, the groups scope is requested, and you are not using the org authorization server URLs.
“Access is Denied” after signing in User created without roles, or registration disabled Set AUTH_USER_REGISTRATION = True and a valid AUTH_USER_REGISTRATION_ROLE.
invalid_client in Superset logs Wrong client ID or secret, or the app is not a Web Application type Re-copy the credentials; recreate the integration as an OIDC Web Application if needed.
Usernames look like okta_00u1a2b3... FAB’s built-in handler derives the username from the sub claim Add the custom security manager from Step 2 before the first production login.
Two accounts for the same person Username convention changed between logins Pick one of preferred_username or email in oauth_user_info and keep it. Merge or delete the duplicate in List Users.
Roles do not update when Okta groups change Sync disabled Set AUTH_ROLES_SYNC_AT_LOGIN = True and have the user sign out and in.
Login button missing; password form still shown Config not loaded Confirm SUPERSET_CONFIG_PATH points to the file, or the file is on PYTHONPATH, and that Superset was actually restarted.

To see exactly what Okta returned, run Superset with debug logging for a single login using the log.debug line in the custom security manager above. If you need the claim values and not just their names, log the full payload once and remove it immediately afterwards; the response contains personal data.

Operational notes

  • Onboarding is now an Okta task. Add the person to the right group and assign them the application. There is nothing to do in Superset.
  • Offboarding is two steps. Deactivate in Okta, then either wait for PERMANENT_SESSION_LIFETIME to expire or, for immediate effect, set the user to inactive in Superset’s List Users.
  • Role grants must happen in Okta. With AUTH_ROLES_SYNC_AT_LOGIN enabled, editing a user’s roles in the Superset UI lasts only until their next login. Change the Okta group instead.
  • Service accounts and API clients that authenticate with a username and password against Superset’s REST API will stop working under AUTH_OAUTH. Move them to a token-based approach or keep a separate, restricted provider for them.
  • Multiple providers are allowed. OAUTH_PROVIDERS is a list. Some teams keep Okta for staff and a second provider for contractors or an embedded-analytics tenant.
  • Audit trail. Superset’s own logs record the username on each request. With SSO, those usernames are guaranteed to be real identities, which is what your auditor was after in the first place.

Where this fits in a hardened deployment

SSO is one control in a production Superset setup. It sits alongside role design, row-level security, network exposure, metadata database backups, and a patching cadence. If you are putting Superset in front of a wider audience, or an audit is on the calendar, it is worth reviewing all of those together rather than one at a time.

Our Superset Architecture Review is a fixed-scope, five-day review of exactly that: authentication and SSO, RBAC and RLS, caching and async queries, upgrade readiness and dashboard performance, delivered as a written report with prioritised fixes. If you would rather someone else kept the platform patched and monitored, that is what Managed Support is for.

For the wider set of controls, see our earlier post on data governance and security best practices for Superset deployments.

How to Build a Custom Chart Plugin for Apache Superset 4.x

Apache Superset ships with more than fifty chart types, and for most dashboards that is plenty. Then someone asks for a bullet chart against a target band, a Sankey with a custom node order, a map layer the built-in deck.gl charts do not offer, or a KPI tile that colours itself against three thresholds instead of one. At that point you have two options: bend an existing chart until it almost fits, or write a plugin.Plugins are how Superset itself is built. Every chart in the Explore view, from the humble table to the ECharts time series, is a plugin registered through the same ChartPlugin API you are about to use. Nothing about a custom plugin is second-class. It gets the same query layer, the same control panel framework, the same dashboard filters and cross-filters, and the same theming.

This guide builds a small but complete plugin for Superset 4.x. The chart is deliberately simple, a bar per category with a configurable highlight threshold, so that the plugin mechanics stay in focus. Swap the rendering for ECharts, D3, or deck.gl once the plumbing is in place.

What a plugin is made of

A Superset chart plugin is an npm package that exports a class extending ChartPlugin from @superset-ui/core. The class wires together five things:

Piece File Job
Metadata index.ts Name, description, thumbnail, category, tags, and behaviours shown in the chart picker
Query builder buildQuery.ts Turns the form data from the control panel into one or more query objects for Superset’s backend
Control panel controlPanel.ts Declares which controls appear in Explore and how they are grouped
Props transformer transformProps.ts Converts raw query results and form data into the props your component needs
Component HelloChart.tsx The React component that draws the chart

The flow at runtime is: the user changes a control, Superset runs buildQuery, sends the query to the backend, receives rows, calls transformProps with those rows plus the form data, and renders your component with the result. Controls flagged as renderTrigger skip the query and go straight to transformProps, which is how colour and label changes stay instant.

Prerequisites

  • Node.js at the version your Superset release pins. Read the engines field in superset-frontend/package.json at the tag you deploy rather than trusting a blog post: the 4.x line started on Node 18 and later releases accept Node 20 as well. Use nvm or fnm; a mismatched Node version is the most common cause of a build that fails for no obvious reason.
  • A checkout of the Superset repository at the exact tag you run in production, for example git clone --branch 4.1.1 https://github.com/apache/superset.git. You will run the frontend dev server from it and, later, build the production image from it.
  • A running Superset backend to develop against. The repo’s docker-compose setup works, or a local superset run -p 8088 --with-threads --reload --debugger.
  • Working knowledge of React and TypeScript. Plugins are TypeScript by default and there is no reason to fight that.

Step 1: Scaffold the plugin

Superset maintains a Yeoman generator that produces a working plugin skeleton. Install it and run it in a new directory next to, not inside, your Superset checkout:

bash
npm install -g yo @superset-ui/generator-superset

mkdir superset-plugin-chart-hello
cd superset-plugin-chart-hello
yo @superset-ui/superset

Answer the prompts: choose Chart plugin, accept the package name, add a one-line description, and pick Regular as the chart type (choose Time-series if your chart has a time axis; it changes the default controls). The generator writes a package.json, TypeScript config, Jest setup, a src/ folder with the five files above, and a src/images/thumbnail.png placeholder.

If the published generator lags behind the Superset version you are targeting, run it from your checkout instead:

bash
cd superset/superset-frontend/packages/generator-superset
npm install
npm link
cd ../../../../superset-plugin-chart-hello
yo @superset-ui/superset

Open package.json and check the peerDependencies. The generator pins @superset-ui/core and @superset-ui/chart-controls to the versions in the checkout you ran it from. These must match the Superset you deploy, or the plugin will compile against one API and run against another.

Step 2: The five files

The generated code works as-is. The point of walking through each file is to know what to change when your chart needs something different.

index.ts: metadata and wiring

typescript
import { t, ChartMetadata, ChartPlugin } from '@superset-ui/core';
import buildQuery from './buildQuery';
import controlPanel from './controlPanel';
import transformProps from './transformProps';
import thumbnail from './images/thumbnail.png';

export default class HelloChartPlugin extends ChartPlugin {
  constructor() {
    const metadata = new ChartMetadata({
      name: t('Hello Chart'),
      description: t('One bar per category, with bars above a threshold highlighted.'),
      thumbnail,
      category: t('Custom'),
      tags: [t('Comparison'), t('Custom')],
    });

    super({
      buildQuery,
      controlPanel,
      loadChart: () => import('./HelloChart'),
      metadata,
      transformProps,
    });
  }
}

loadChart is a dynamic import so the component is code-split and only downloaded when someone opens a dashboard that uses it. Wrap every user-visible string in t() so it goes through Superset’s translation layer.

Note what is not here: a behaviors array. Adding Behavior.InteractiveChart tells Superset the chart emits cross-filters, and it does put cross-filter controls in the UI, but the affordance does nothing until your component actually calls setDataMask, which Superset passes in through chartProps.hooks. Declaring the behaviour before you wire the hook produces a menu item that silently fails. Add the behaviour and the hook together, or neither. Dashboard native filters apply to your chart either way; they arrive as part of the query, not through this flag.

buildQuery.ts: from form data to a query

typescript
import { buildQueryContext, QueryFormData } from '@superset-ui/core';

export default function buildQuery(formData: QueryFormData) {
  const { cols: groupby } = formData;
  return buildQueryContext(formData, baseQueryObject => [
    {
      ...baseQueryObject,
      groupby,
    },
  ]);
}

buildQueryContext assembles a query object from the standard controls (metrics, filters, row limit, time range) and hands it to your callback. You return an array of query objects; one is normal, two or more is how charts like the big number with trendline fetch both a total and a series. The generator names the group-by control cols and maps it onto the query’s groupby. Recent Superset versions also accept columns; either works on 4.x.

controlPanel.ts: what the user can change

typescript
import { t, validateNonEmpty } from '@superset-ui/core';
import {
  ControlPanelConfig,
  sharedControls,
} from '@superset-ui/chart-controls';

const config: ControlPanelConfig = {
  controlPanelSections: [
    {
      label: t('Query'),
      expanded: true,
      controlSetRows: [
        [
          {
            name: 'cols',
            config: {
              ...sharedControls.groupby,
              label: t('Category column'),
              description: t('One bar per distinct value'),
            },
          },
        ],
        [
          {
            name: 'metrics',
            config: {
              ...sharedControls.metrics,
              validators: [validateNonEmpty],
            },
          },
        ],
        ['adhoc_filters'],
        ['row_limit'],
      ],
    },
    {
      label: t('Hello Chart options'),
      expanded: true,
      controlSetRows: [
        [
          {
            name: 'threshold',
            config: {
              type: 'TextControl',
              isInt: true,
              default: 0,
              renderTrigger: true,
              label: t('Highlight threshold'),
              description: t('Bars at or above this value are highlighted'),
            },
          },
        ],
        [
          {
            name: 'highlight_color',
            config: {
              type: 'ColorPickerControl',
              default: { r: 26, g: 169, b: 202, a: 1 },
              renderTrigger: true,
              label: t('Highlight colour'),
            },
          },
        ],
      ],
    },
  ],
};

export default config;

Two things to notice. First, sharedControls gives you the same metric, group-by and filter controls every built-in chart uses, so the Explore experience is consistent. Second, renderTrigger: true on the threshold and colour controls means changing them re-renders without re-querying the database. Anything that only affects drawing should be a render trigger; anything that changes what data comes back should not.

The generator’s template may also import a sections helper and open the panel with a time section such as sections.legacyRegularTime. Whether that export exists depends on the release you pin: the time controls were reworked across the 4.x line as the generic chart axes behaviour became the default. Check what your @superset-ui/chart-controls actually exports before importing it, because a missing export takes out the whole control panel rather than one control. The config above needs no time section at all; adhoc_filters covers time filtering.

Control names are snake_case here. They arrive in transformProps as camelCase (highlight_color becomes highlightColor), because ChartProps runs the form data through a camelCase conversion and keeps the original on rawFormData. This conversion is the single most common source of “my control value is undefined”.

transformProps.ts: shaping data for the component

typescript
import { ChartProps, DataRecord } from '@superset-ui/core';

export interface HelloChartProps {
  width: number;
  height: number;
  data: DataRecord[];
  categoryColumn: string;
  metricLabel: string;
  threshold: number;
  highlightColor: string;
}

export default function transformProps(chartProps: ChartProps): HelloChartProps {
  const { width, height, formData, queriesData } = chartProps;
  const { cols, metrics, threshold, highlightColor } = formData;

  const data = (queriesData[0]?.data ?? []) as DataRecord[];
  const metric = metrics?.[0];
  const metricLabel =
    typeof metric === 'string' ? metric : metric?.label ?? 'value';
  const rgba = highlightColor
    ? `rgba(${highlightColor.r}, ${highlightColor.g}, ${highlightColor.b}, ${highlightColor.a})`
    : '#1aa9ca';

  return {
    width,
    height,
    data,
    categoryColumn: Array.isArray(cols) ? cols[0] : cols,
    metricLabel,
    threshold: Number(threshold) || 0,
    highlightColor: rgba,
  };
}

queriesData is an array with one entry per query object you returned from buildQuery. Each entry has a data array of row objects keyed by column or metric label. Metrics can be plain strings (saved metrics) or ad-hoc metric objects with a label; handle both. Keep this function pure and cheap; it runs on every render trigger.

HelloChart.tsx: the component

tsx
import React from 'react';
import { styled } from '@superset-ui/core';
import { HelloChartProps } from './transformProps';

const Wrapper = styled.div<{ height: number; width: number }>`
  height: ${({ height }) => height}px;
  width: ${({ width }) => width}px;
  box-sizing: border-box;
  display: flex;
  align-items: stretch;
  gap: 6px;
  padding: 8px;
  font-family: ${({ theme }) => theme.typography.families.sansSerif};
`;

/* One column per row: bar area on top, label pinned underneath. */
const Column = styled.div`
  flex: 1 1 0;
  min-width: 0;
  display: flex;
  flex-direction: column;
`;

/* Gives the bar a definite height to take a percentage of. */
const BarArea = styled.div`
  flex: 1 1 auto;
  min-height: 0;
  display: flex;
  align-items: flex-end;
`;

const Bar = styled.div<{ pct: number; color: string }>`
  width: 100%;
  height: ${({ pct }) => pct}%;
  background-color: ${({ color }) => color};
  border-radius: 2px 2px 0 0;
`;

const Label = styled.div`
  flex: 0 0 auto;
  padding-top: 4px;
  font-size: 11px;
  text-align: center;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
`;

export default function HelloChart({
  width,
  height,
  data,
  categoryColumn,
  metricLabel,
  threshold,
  highlightColor,
}: HelloChartProps) {
  const max = Math.max(1, ...data.map(row => Number(row[metricLabel]) || 0));

  return (
    <Wrapper width={width} height={height}>
      {data.map(row => {
        const value = Number(row[metricLabel]) || 0;
        const pct = (value / max) * 100;
        const hot = value >= threshold;
        const category = String(row[categoryColumn]);
        return (
          <Column key={category} title={`${category}: ${value}`}>
            <BarArea>
              <Bar pct={pct} color={hot ? highlightColor : '#ccc'} />
            </BarArea>
            <Label>{category}</Label>
          </Column>
        );
      })}
    </Wrapper>
  );
}

The nesting is worth a moment, because it is the part people get wrong first. A percentage height only resolves against a parent with a definite height. Wrapper gets one from the pixel height Superset hands it, and BarArea gets one from being a flex child of Wrapper, so height: ${pct}% on the bar works. Put that percentage directly inside an auto-height div and every bar collapses to nothing.

Otherwise this is plain HTML and CSS on purpose. It has no chart library dependency, it is trivially testable, and it demonstrates the two things every component must do: fill the width and height Superset gives it, and read its theme from @superset-ui/core rather than hard-coding fonts. For anything more demanding, look at how @superset-ui/plugin-chart-echarts wraps ECharts, or how the deck.gl plugins handle WebGL. The pattern is the same; only the drawing changes.

Step 3: Run it inside Superset

The plugin has to be part of the Superset frontend bundle. Superset does carry an experimental DYNAMIC_PLUGINS feature flag that fetches a plugin from a URL at runtime, but it has stayed experimental for years and nothing in the dashboard experience is built around it, so treat compiling into the bundle as the supported path.

The package’s entry point is its build output, not its source, so build it before linking:

bash
cd superset-plugin-chart-hello
npm i --force
npm run build

The --force is there because the generator’s peer dependency ranges rarely resolve cleanly against a single Superset checkout. Then link the package into the Superset frontend:

bash
cd ../superset/superset-frontend
npm i -S ../../superset-plugin-chart-hello

Then open src/visualizations/presets/MainPreset.js and add the plugin alongside the built-ins:

javascript
import HelloChartPlugin from 'superset-plugin-chart-hello';

// ... inside the plugins array passed to super()
new HelloChartPlugin().configure({ key: 'hello_chart' }),

The key is the chart’s viz_type. It is stored on every saved chart that uses the plugin, so choose it once and never change it.

Now run three processes: the backend, the Superset dev server, and a watch build for the plugin.

bash
# terminal 1, from the repo root with your virtualenv active
superset run -p 8088 --with-threads --reload --debugger

# terminal 2
cd superset/superset-frontend
npm run dev-server

# terminal 3, in the plugin directory
npm run dev

That third terminal is not optional. Superset resolves the linked package through its main field, which points at compiled output, so editing src/HelloChart.tsx changes nothing until the plugin is rebuilt. npm run dev is the generator’s watch build; check the scripts block in your package.json if the name differs. Without it you will edit code for twenty minutes and conclude that hot reloading is broken.

Open http://localhost:9000, create a chart, and search for “Hello Chart” in the picker. Pick a dataset, a category column and a metric, and you should see bars. Change the threshold and watch the bars recolour without a spinner, which confirms the render trigger is wired correctly.

If the dev server does not pick up a rebuilt plugin, restart it; watching across a symlink is occasionally flaky on Windows and in Docker volumes.

Step 4: Getting it into production

Because the plugin is compiled into the bundle, production means building Superset’s frontend with your plugin included. The official apache/superset image does not contain the frontend source, so you build from the repository at the tag you deploy:

  • In your Superset checkout, add the plugin dependency to superset-frontend/package.json and the registration line in MainPreset.js. Use a git URL or a private registry entry, not the relative path you developed against: the plugin directory sits outside the Docker build context, so a relative dependency fails at npm ci rather than merely being untidy. Commit both changes on a branch named for the Superset version, for example 4.1.1-acme.
  • Build the image from the repo root: docker build -t registry.example.com/superset:4.1.1-acme .. The Dockerfile’s frontend build stage runs npm ci and the frontend build, which now includes your plugin.
  • Deploy that image in place of the official one. Nothing else changes: same configuration, same metadata database, same Helm chart or compose file.

When you upgrade Superset, rebase the branch onto the new tag, bump the plugin’s @superset-ui/* peer dependencies to match, rebuild, and run the plugin’s tests. Budget half a day for a minor version and more for a major one; the ChartPlugin API is stable, but control-panel helpers and theme tokens do move.

Step 5: Tests worth writing

The generator sets up Jest. Three tests pay for themselves immediately:

  • transformProps with a realistic ChartProps fixture: assert the metric label resolution for both string and ad-hoc metrics, the camelCase control names, and the empty queriesData case.
  • buildQuery with sample form data: assert the query object contains the expected groupby and metrics, so a control rename does not silently produce an empty query.
  • The component with React Testing Library: render with three rows, assert three bars, and assert the highlighted count for a given threshold.

Superset’s frontend also has a Storybook (superset-frontend/storybook). Adding a story for your plugin gives designers and stakeholders a place to look at it without a running backend.

Pitfalls that cost time

  • Peer dependency drift. @superset-ui/core in your plugin must be the version the Superset frontend uses. Two copies of the library in one bundle produce baffling errors about themes or registries being undefined.
  • Forgetting the plugin’s watch build. The linked package serves compiled output, so source edits are invisible until it rebuilds.
  • camelCase vs snake_case. Controls are defined in snake_case and read in camelCase. Log formData once in transformProps if a value is missing.
  • Forgetting renderTrigger. Every cosmetic control without it forces a database round trip.
  • Declaring behaviours you have not implemented. Behavior.InteractiveChart without a setDataMask call gives users a cross-filter option that does nothing.
  • Percentage sizing inside auto-height containers. Give the parent a definite height or the chart renders empty at full data.
  • Hard-coded colours and fonts. Read them from the theme so the chart looks right in a themed or white-labelled Superset.
  • Changing the viz_type key. Saved charts reference it. Renaming it orphans every chart built on the plugin.
  • Ignoring width and height. Superset tells your component its size. A chart that sizes itself overflows dashboard grid cells.
  • Forking Superset core. Put chart logic in the plugin package, not in the Superset repo. The only lines you should be maintaining in the fork are the dependency and the registration.

What we have built this way

The mechanics above are the same ones behind the plugins we have written up on this blog: a dual-axis line chart for Superset 4 that plots two measures on independent axes and takes part in cross-filtering, and a multi-threshold heatmap for Superset 4.1 that colours cells against several hard limits instead of one gradient. Both started as exactly the skeleton in this post.

If you have a chart in mind and want to know what it would take, our Plugin Scoping Call is a free 45-minute session with a plugin engineer. You describe the visualisation, we walk through the data shape and interactions, and within 48 hours you get a written scope, effort estimate, and timeline you can act on with or without us. The wider service is described on our Superset plugin development page.