Database connection export -> import fails to include any encrypted private keys

[joeyJsonar]

Bug description

Export a working big query database, and delete the database and try to import it.
It looks like it works, but it fails when testing connection and it fails when creating dataset.

This is due to the functionality that Superset only exports the serialized database connection and doesn't include any encrypted private keys. This is meant for extra security, but I will change it so that editing the imported Google BigQuery connection will prompt for uploading these 'Service Account' credentials again.

Screenshots/recordings

1201.import.database.mp4

Superset version

master / latest-dev

Python version

3.9

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

Hi @joeyJsonar! I'm Dosu and I’m helping the superset team.

This behavior is expected: Superset intentionally does not export sensitive credentials like Google BigQuery service account private keys for security reasons. When you export and import a BigQuery database connection, the exported file contains the connection configuration but omits encrypted fields (such as the service account key stored in encrypted_extra). As a result, after import, the connection appears in the UI but cannot connect or create datasets until you manually edit the database and re-upload the service account credentials.

There is currently no built-in prompt to remind you to re-upload credentials after import; you must do this step manually to restore connectivity. This design ensures that private keys and other secrets are never inadvertently transferred between environments or exposed in exported files. For BigQuery and other databases that rely on sensitive credentials, always plan to re-supply those credentials after importing the connection into a new Superset instance.

Relevant code references:

• Export logic (superset/commands/database/export.py)
• Import logic (superset/commands/database/importers/v1/utils.py)
• Database model (superset/models/core.py)

To restore a BigQuery connection after import: edit the imported database, upload the service account credentials, and save. The connection should then work as expected.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[sfirke]

Thanks for opening this and being willing to improve it, @joeyJsonar ! I retitled the issue to try to make it more specific, feel free to edit further if I got it wrong.