You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "berlicon (via GitHub)" <gi...@apache.org> on 2025/12/12 13:52:26 UTC
[I] dbs.impersonate_user = true does not work [superset]
berlicon opened a new issue, #36592:
URL: https://github.com/apache/superset/issues/36592
### Bug description
1. There is user1 with dataset1, chart1 and dashboard1. Dashboard1 based on chart1 which based on dataset1. Dataset1 points to Clickhouse table1.
2. There is user2.
3. I have enabled impersonation for user2 - e.g. I put: impersonate_user = true for user2 in dbs table of Superset DB.
4. Both user1 and user2 has database access to Clickhouse table1. Both can run query in SQL Lab and get the results: select * from table1.
5. User1 adds user2 as coowner of dataset1 in order to share dashboard1 to user2.
6. User1 opens dashboard1 and click "Share/Copy permalink to clipboard".
7. User2 opens permalink in browser and gets an error: DB::Exception: user2: Authentication failed: password is incorrect, or there is no user with such name.
Actually the same issue was added before but it is still unresolved: https://github.com/apache/superset/issues/17074
The route cause of the error in these rows (superset\db_engine_specs\base.py):
if impersonate_user and username is not None:
url = url.set(username=username)
It seems in addition we should add rows like this:
user = security_manager.find_user(username=username)
url = url.set(password=user.password)
... But unfortunatelly, user.password contains encoded value like this:
scrypt:32768:8:1$iVy4M6mkGXr5y0AT$1b5eff974069e11d5e5d623d2d3428ed23cdfcb321167a9b7af2175b2e92c56cec16285cc9193edc9b1a1eda5638d7749c8b3fcf88fd4253ef4a41692f5d9e6f
... And I don't know how to decode it.
I checked and add this row:
url = url.set(password='8i^hO$0g') # it is decoded value of password
... and user can load the dashboard. But decoded password I can see in this line (superset\models\core.py):
effective_username = self.get_effective_user(sqlalchemy_url)
here I can see decoded password in this variable: sqlalchemy_url.password
... but it happens when user loads his own dashboard.
PS: My Superset version is 3.0, but I checked last version (6.0) and this bug is still unresolved.
### Screenshots/recordings
_No response_
### Superset version
master / latest-dev
### Python version
3.9
### Node version
16
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] dbs.impersonate_user = true does not work [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #36592:
URL: https://github.com/apache/superset/issues/36592#issuecomment-4898881604
Duplicate of long-standing #17074 and works-as-designed: impersonation swaps the username into the DSN and requires a DB auth scheme that doesn't need per-user passwords (LDAP/Kerberos/trusted auth). Superset cannot and should not decode hashed user passwords for ClickHouse. Close as by-design/duplicate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] dbs.impersonate_user = true does not work [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #36592:
URL: https://github.com/apache/superset/issues/36592#issuecomment-3646578531
<!-- Answer -->
This is a known and unresolved limitation in Superset: when using impersonation with ClickHouse, Superset only sets the username in the connection string, not the password. User passwords are stored hashed/encoded (e.g., scrypt) and cannot be decoded for use in the connection URL, so authentication fails if the database requires both username and password for each user. There is no secure, built-in workaround for this—manually setting the password works but is not scalable or secure. Superset maintainers recommend using a service account for database connections and managing access via Superset roles and permissions, since per-user database impersonation with password is not supported for ClickHouse. This issue is confirmed to be unresolved in the latest versions and discussed in detail in several issues, including [#17074](https://github.com/apache/superset/issues/17074), [#20455](https://github.com/apache/superset/issues/20455), [#28214](https://github.com/apache/superset/issu
es/28214), and [#36019](https://github.com/apache/superset/issues/36019).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/379377ae-22bf-4644-a404-2a897cef7805?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/379377ae-22bf-4644-a404-2a897cef7805?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/379377ae-22bf-4644-a404-2a897cef7805?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/379377ae-22bf-4644-a404-2a897cef7805?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/379377ae-22bf-4644-a404-2a897cef7805?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/379377ae-22bf-4644-a404-2a897cef7805?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/379377ae-22bf-4644-a404-2a897cef7805?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=This%20is%20a%20known%20and%20unresolved%20limitation%20in%20Superset%3A%20when%20using%20impersonation%20with%20ClickHouse%2C%20Superset%20only%20sets%20the%20username%20in%20the%20connection%20string%2C%20not%20the%20password.%20User%20passwords%20are%20stored%20hashed/encoded%20%28e.g.%2C%20scrypt%29%20and%20cannot%20be%20decoded%20for%20use%20in%20the%20connection%20URL%2C%20so%20authentication%20fails%20if%20the%20database%20requires%20both%20username%20and%20password%20for%20each%20user.%20There%20is%20no%20secure%2C%20built-in%20workaround%20for%20this%E2%80%94manually%20setting%20the%20password%20works%20but%20is%20not%20scalable%20or%20secure.%20Superset%20maintainers%20recommend%20using%20a%20service%20account%20for%20database%20connectio
ns%20and%20managing%20access%20via%20Superset%20roles%20and%20permissions%2C%20since%20per-user%20database%20impersonation%20with%20password%20is%20not%20supported%20for%20ClickHouse.%20This%20issue%20is%20confirmed%20to%20be%20unresolved%20in%20the%20latest%20versions%20and%20discussed%20in%20detail%20in%20several%20issues%2C%20including%20%5B%2317074%5D%28https%3A//github.com/apache/superset/issues/17074%29%2C%20%5B%2320455%5D%28https%3A//github.com/apache/superset/issues/20455%29%2C%20%5B%2328214%5D%28https%3A//github.com/apache/superset/issues/28214%29%2C%20and%20%5B%2336019%5D%28https%3A//github.com/apache/superset/issues/36019%29.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/36592)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] dbs.impersonate_user = true does not work [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #36592: dbs.impersonate_user = true does not work
URL: https://github.com/apache/superset/issues/36592
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org