dosubot[bot]
commented
1 month ago The issue you're encountering with RBAC on the Superset dashboard might be due to several factors related to the DASHBOARD_RBAC feature and its configuration. Here are some key points to consider:
-
Feature Flag: Ensure that the
DASHBOARD_RBACfeature flag is enabled. This flag is crucial for the RBAC rules to be enforced correctly.DEFAULT_FEATURE_FLAGS = { "DASHBOARD_RBAC": True, # other feature flags } -
Dashboard Roles: The
DASHBOARD_RBAClogic manages dashboard access through roles and is only applicable if the dashboard has roles set. Ensure that the dashboard has the appropriate roles assigned. -
Draft Dashboards: Users with dashboard permissions cannot access draft dashboards even if they have the necessary roles. Ensure that the dashboard is published.
-
Permissions: The permissions you have set for the "Public" role seem comprehensive. However, ensure that the role has the necessary permissions to view the dashboard and its components. The following permissions are essential:
can read on Dashboardcan read on Chartcan dashboard permalink on Supersetcan read on DashboardPermalinkRestApi
-
Public Access: Public users without explicit permissions cannot access dashboards, even if they are published. Ensure that the "Public" role has the necessary permissions.
-
Logs and Debugging: Utilize Superset's specific error types related to security access to diagnose issues. Look for
DASHBOARD_SECURITY_ACCESS_ERRORin the logs to understand why access might be denied.
Here is a sample configuration for superset_config.py:
AUTH_ROLE_PUBLIC = 'Public'
PUBLIC_ROLE_LIKE = "Guest" # Create a guest role for anonymous view dashboards
DEFAULT_FEATURE_FLAGS = {
"DASHBOARD_RBAC": True,
"ENABLE_TEMPLATE_PROCESSING": True,
"DASHBOARD_NATIVE_FILTERS": True,
"DASHBOARD_CROSS_FILTERS": True
}Ensure that the "Public" role has the following permissions:
can read on Dashboardcan read on Chartcan dashboard permalink on Supersetcan read on DashboardPermalinkRestApi
If the issue persists, you might want to check the detailed error objects returned by the SupersetSecurityManager class for more insights [1][2].
To continue talking to Dosu, mention @dosu.
Bug description
RBAC on dashboard is not working as expected.
How to reproduce the bug
draftAnd then with all the Gamma permission)
Screenshots/recordings
No response
Superset version
4.0.2
Python version
Not applicable
Node version
Not applicable
Browser
Safari
Additional context
Working with the official prebuilt docker image from tag.
If you don't enable the RBAC feature and add the
all datasource access on all_datasource_accessto the public role with the first minimal set of permission mentioned above and try tou access it with the permalink it works.So if the RBAC feature works as described and "bypass dataset level checks" normally the 1st minimal set of permissions (so without
all datasource access on all_datasource_accessbecause the objectif of enabling the RBAC feature is to avoid to grant this pem) is supposed to work.Logs from the superset_app container :
Checklist