You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "hadianow (via GitHub)" <gi...@apache.org> on 2025/06/03 16:30:31 UTC
[D] How to Restrict access to supserset APIs with proper authentication [superset]
GitHub user hadianow created a discussion: How to Restrict access to supserset APIs with proper authentication
- I am using Superset dashboards in my application, and this is how the authentication works in my application for fetching charts and dashboards: https://www.npmjs.com/package/@superset-ui/embedded-sdk#creating-a-guest-token
- The **Public** role in the Superset Roles list has numerous Permissions associated with it
- As a result, unauthenticated users can access APIs (for example: api/v1/chart/related/owners), which is a huge security issue
- I tried revoking the permissions associated with the Public role. But that stopped the access to dashboards for even the authenticated users (refer to aforementioned link)
- How can I restrict access to just authenticated users?
- From my `superset_config.py` file:
PUBLIC_ROLE_LIKE = "Guest_public"
- PS: Despite removing all permissions related to the role `Guest_public`, unauthenticated users still have access to all the dashboards and charts
- `GUEST_ROLE_NAME` is not explicitly anywhere in the `superset_config.py` file
GitHub link: https://github.com/apache/superset/discussions/33674
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
<!-- Greeting -->
Hi @hadianow! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
To restrict access to Superset APIs so only authenticated users can access them, you need to carefully configure the roles and permissions, especially around the "Public" and guest roles.
By default, Superset uses the `Public` role for unauthenticated users. The `PUBLIC_ROLE_LIKE` setting in your `superset_config.py` determines which built-in role's permissions are copied to the `Public` role. If you set `PUBLIC_ROLE_LIKE = "Guest_public"`, the permissions from the `Guest_public` role are applied to `Public`. However, if you remove all permissions from `Guest_public`, but unauthenticated users still have access, it suggests that either the permissions are not being synced properly, or another configuration is granting access.
Superset's embedded SDK uses guest tokens for authentication. The guest user is represented by the `GuestUser` class, which is considered authenticated in most places (`is_authenticated` returns true), and is not treated as anonymous. The guest user role is determined by the `GUEST_ROLE_NAME` config, which defaults to `Public` if not set. This means embedded users with a guest token are assigned the `Public` role unless you explicitly change `GUEST_ROLE_NAME` in your config. If you want to separate embedded guest access from true public (unauthenticated) access, you should define a dedicated guest role and set `GUEST_ROLE_NAME` to that role name in your config. Otherwise, both unauthenticated and guest-token users will share the same permissions, which is likely why restricting one restricts the other as well ([source](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/config.py)).
To restrict API access to only authenticated users:
- Remove all permissions from the `Public` role (or your `PUBLIC_ROLE_LIKE` role).
- Create a dedicated role for embedded/guest users (for example, `Guest_public` or `EmbedGuest`), grant it only the minimum permissions needed for embedded dashboards, and set `GUEST_ROLE_NAME = "EmbedGuest"` in your `superset_config.py`.
- Sync your roles after making changes (you may need to restart Superset or use the role sync command).
- Ensure your embedded SDK uses guest tokens that are mapped to the correct guest role.
This setup ensures that unauthenticated users (those without a valid session or guest token) have no access, while embedded users with a valid guest token have only the permissions you grant to the guest role. If you do not set `GUEST_ROLE_NAME`, both unauthenticated and guest-token users will use the `Public` role, which is not secure for your use case ([source](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/config.py), [source](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/security/guest_token.py)).
If you have already removed all permissions from `Guest_public` but still see access, double-check that:
- The `Public` role does not have lingering permissions.
- The `GUEST_ROLE_NAME` is set to a role that does not have permissions you want to restrict.
- You have restarted Superset or synced roles after making changes.
For embedded dashboards, guest tokens grant access to all charts on the dashboard they are created for, and dataset access is automatically handled for those datasets used in the dashboard ([source](https://github.com/apache/superset/issues/26201)).
If you need to further restrict which APIs are accessible, review the permissions assigned to your guest and public roles, and remove any permissions for endpoints you do not want exposed.
References:
- [Superset config.py: PUBLIC_ROLE_LIKE and GUEST_ROLE_NAME](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/config.py)
- [GuestUser class and authentication logic](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/security/guest_token.py)
- [Guest token and embedded dashboard permissions](https://github.com/apache/superset/issues/26201)
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=63dee3c6-7c40-4806-90d9-1b5b27634e27) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13358282
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow deleted a comment on the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
Hi, [@dosu](https://go.dosu.dev/dosubot) @dosu , Kindly review the issue
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13709021
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow added a comment to the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
- Suppose I set the `GUEST_ROLE_NAME` to a custom role `EmbedGuest`
- Do I have to add all the users to this new role manually?
- Earlier, the `public` role did not require any users to be added manually to that role
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13363673
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow closed a discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
- I am using Superset dashboards in my application, and this is how the authentication works in my application for fetching charts and dashboards: https://www.npmjs.com/package/@superset-ui/embedded-sdk#creating-a-guest-token
- The **Public** role in the Superset Roles list has numerous Permissions associated with it
- As a result, unauthenticated users can access APIs (for example: api/v1/chart/related/owners), which is a huge security issue
- I tried revoking the permissions associated with the Public role. But that stopped the access to dashboards for even the authenticated users (refer to aforementioned link)
- How can I restrict access to just authenticated users?
- From my `superset_config.py` file:
PUBLIC_ROLE_LIKE = "Guest_public"
- PS: Despite removing all permissions related to the role `Guest_public`, unauthenticated users still have access to all the dashboards and charts
- `GUEST_ROLE_NAME` is not explicitly anywhere in the `superset_config.py` file
GitHub link: https://github.com/apache/superset/discussions/33674
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow edited a comment on the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
@dosu
- So if I set `GUEST_ROLE_NAME = "EmbedGuest"`, this shall restrict unauthenticated users from accessing APIs that are not permitted for them.
- To sum up, unauthenticated users normally have access to only the APIs listed in the permissions of the `Public` role, I suppose?
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13364755
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow edited a comment on the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
- So if I set `GUEST_ROLE_NAME = "EmbedGuest"`, this shall restrict unauthenticated users from accessing APIs that are not permitted for them.
- To sum up, unauthenticated users normally have access to only the APIs listed in the permissions of the `Public` role, I suppose?
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13364755
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow edited a discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
- I am using Superset dashboards in my application, and this is how the authentication works in my application for fetching charts and dashboards: https://www.npmjs.com/package/@superset-ui/embedded-sdk#creating-a-guest-token
- The **Public** role in the Superset Roles list has numerous Permissions associated with it
- As a result, unauthenticated users can access APIs (for example: api/v1/chart/related/owners), which is a huge security issue
- I tried revoking the permissions associated with the Public role. But that stopped the access to dashboards for even the authenticated users (refer to aforementioned link)
- How can I restrict access to just authenticated users?
- From my `superset_config.py` file:
PUBLIC_ROLE_LIKE = "Guest_public"
- PS: Despite removing all permissions related to the role `Guest_public`, unauthenticated users still have access to all the dashboards and charts
- `GUEST_ROLE_NAME` is not explicitly anywhere in the `superset_config.py` file
GitHub link: https://github.com/apache/superset/discussions/33674
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow added a comment to the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
- So if I set `GUEST_ROLE_NAME = "EmbedGuest"`, this shall restrict unauthenticated users from accessing APIs that are not permitted for them.
- To sum up, unauthenticated users normally have access to only the APIs listed in the permissions of the `Public` role, I suppose?
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13364755
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow deleted a comment on the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
Hi, [@dosu](https://go.dosu.dev/dosubot), @dosu Setting `GUEST_ROLE_NAME = "EmbedGuest"` in `superset_config.py` did not resolve the issue. Rather, an error was thrown
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13708927
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow edited a comment on the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
Hi, [@dosu](https://go.dosu.dev/dosubot), @dosu Setting `GUEST_ROLE_NAME = "EmbedGuest"` in `superset_config.py` did not resolve the issue. Rather, an error was thrown
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13708927
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
<!-- Greeting -->
Hi @hadianow! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
To restrict access to Superset APIs so only authenticated users can access them, you need to carefully configure the roles and permissions, especially around the "Public" and guest roles.
By default, Superset uses the `Public` role for unauthenticated users. The `PUBLIC_ROLE_LIKE` setting in your `superset_config.py` determines which built-in role's permissions are copied to the `Public` role. If you set `PUBLIC_ROLE_LIKE = "Guest_public"`, the permissions from the `Guest_public` role are applied to `Public`. However, if you remove all permissions from `Guest_public`, but unauthenticated users still have access, it suggests that either the permissions are not being synced properly, or another configuration is granting access.
Superset's embedded SDK uses guest tokens for authentication. The guest user is represented by the `GuestUser` class, which is considered authenticated in most places (`is_authenticated` returns true), and is not treated as anonymous. The guest user role is determined by the `GUEST_ROLE_NAME` config, which defaults to `Public` if not set. This means embedded users with a guest token are assigned the `Public` role unless you explicitly change `GUEST_ROLE_NAME` in your config. If you want to separate embedded guest access from true public (unauthenticated) access, you should define a dedicated guest role and set `GUEST_ROLE_NAME` to that role name in your config. Otherwise, both unauthenticated and guest-token users will share the same permissions, which is likely why restricting one restricts the other as well ([source](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/config.py)).
To restrict API access to only authenticated users:
- Remove all permissions from the `Public` role (or your `PUBLIC_ROLE_LIKE` role).
- Create a dedicated role for embedded/guest users (for example, `Guest_public` or `EmbedGuest`), grant it only the minimum permissions needed for embedded dashboards, and set `GUEST_ROLE_NAME = "EmbedGuest"` in your `superset_config.py`.
- Sync your roles after making changes (you may need to restart Superset or use the role sync command).
- Ensure your embedded SDK uses guest tokens that are mapped to the correct guest role.
This setup ensures that unauthenticated users (those without a valid session or guest token) have no access, while embedded users with a valid guest token have only the permissions you grant to the guest role. If you do not set `GUEST_ROLE_NAME`, both unauthenticated and guest-token users will use the `Public` role, which is not secure for your use case ([source](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/config.py), [source](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/security/guest_token.py)).
If you have already removed all permissions from `Guest_public` but still see access, double-check that:
- The `Public` role does not have lingering permissions.
- The `GUEST_ROLE_NAME` is set to a role that does not have permissions you want to restrict.
- You have restarted Superset or synced roles after making changes.
For embedded dashboards, guest tokens grant access to all charts on the dashboard they are created for, and dataset access is automatically handled for those datasets used in the dashboard ([source](https://github.com/apache/superset/issues/26201)).
If you need to further restrict which APIs are accessible, review the permissions assigned to your guest and public roles, and remove any permissions for endpoints you do not want exposed.
References:
- [Superset config.py: PUBLIC_ROLE_LIKE and GUEST_ROLE_NAME](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/config.py)
- [GuestUser class and authentication logic](https://github.com/apache/superset/blob/cacf1e06d64092b65aafdd15b67aad84fd963f1b/superset/security/guest_token.py)
- [Guest token and embedded dashboard permissions](https://github.com/apache/superset/issues/26201)
<!-- Dosu Comment Footer -->
*To reply, just mention my name [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/63dee3c6-7c40-4806-90d9-1b5b27634e27?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/63dee3c6-7c40-4806-90d9-1b5b27634e27?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/63dee3c6-7c40-4806-90d9-1b5b27634e27?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/63dee3c6-7c40-4806-90d9-1b5b27634e27?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/63dee3c6-7c40-4806-90d9-1b5b27634e27?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/63dee3c6-7c40-4806-90d9-1b5b27634e27?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/63dee3c6-7c40-4806-90d9-1b5b27634e27?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/33674)
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13358282
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
<!-- Answer -->
You do not need to manually add users to the `EmbedGuest` role when you set `GUEST_ROLE_NAME = "EmbedGuest"`. When a user accesses a Superset dashboard via the embedded SDK and presents a valid guest token, Superset automatically assigns the user to the role specified by `GUEST_ROLE_NAME` for the duration of that session. This works similarly to how the `Public` role is automatically assigned to unauthenticated users—no manual user assignment is required for either case. The guest token mechanism handles the role assignment behind the scenes, so as long as your guest tokens are generated correctly and reference the right role, users will receive the permissions of `EmbedGuest` automatically [reference](https://github.com/apache/superset/issues/26201).
<!-- Dosu Comment Footer -->
*To reply, just mention my name [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/76bdd2c2-a51e-4e1f-ab25-023d9d706b1e?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/76bdd2c2-a51e-4e1f-ab25-023d9d706b1e?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/76bdd2c2-a51e-4e1f-ab25-023d9d706b1e?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/76bdd2c2-a51e-4e1f-ab25-023d9d706b1e?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/76bdd2c2-a51e-4e1f-ab25-023d9d706b1e?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/76bdd2c2-a51e-4e1f-ab25-023d9d706b1e?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/76bdd2c2-a51e-4e1f-ab25-023d9d706b1e?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/33674)
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13363691
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
<!-- Answer -->
You do not need to manually add users to the `EmbedGuest` role when you set `GUEST_ROLE_NAME = "EmbedGuest"`. When a user accesses a Superset dashboard via the embedded SDK and presents a valid guest token, Superset automatically assigns the user to the role specified by `GUEST_ROLE_NAME` for the duration of that session. This works similarly to how the `Public` role is automatically assigned to unauthenticated users—no manual user assignment is required for either case. The guest token mechanism handles the role assignment behind the scenes, so as long as your guest tokens are generated correctly and reference the right role, users will receive the permissions of `EmbedGuest` automatically [reference](https://github.com/apache/superset/issues/26201).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=76bdd2c2-a51e-4e1f-ab25-023d9d706b1e) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13363691
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow added a comment to the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
Setting `GUEST_ROLE_NAME = "EmbedGuest"` in `superset_config.py` did not resolve the issue
Rather, an error was thrown
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13369468
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow deleted a comment on the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
- So if I set `GUEST_ROLE_NAME = "EmbedGuest"`, this shall restrict unauthenticated users from accessing APIs that are not permitted for them.
- To sum up, unauthenticated users normally have access to only the APIs listed in the permissions of the `Public` role, I suppose?
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13364755
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow added a comment to the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
Hi, [@dosu](https://go.dosu.dev/dosubot), Setting GUEST_ROLE_NAME = "EmbedGuest" in superset_config.py did not resolve the issue. Rather, an error was thrown
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13708927
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow deleted a comment on the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
Setting `GUEST_ROLE_NAME = "EmbedGuest"` in `superset_config.py` did not resolve the issue
Rather, an error was thrown
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13369468
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] How to Restrict access to supserset Dashboards/Charts with proper authentication [superset]
Posted by "hadianow (via GitHub)" <gi...@apache.org>.
GitHub user hadianow added a comment to the discussion: How to Restrict access to supserset Dashboards/Charts with proper authentication
Hi, [@dosu](https://go.dosu.dev/dosubot) @dosu , Kindly review the issue
GitHub link: https://github.com/apache/superset/discussions/33674#discussioncomment-13709021
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org