You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "17Shristi (via GitHub)" <gi...@apache.org> on 2025/07/11 09:58:27 UTC
[D] Querying on data set [superset]
GitHub user 17Shristi created a discussion: Querying on data set
I have certain charts which are embedded on client facing UI. I want to apply filters like user id to display data specific to that user.
these charts are embedded using a guest token. Now when I simply passed rls clause in guest token api, filtering is happeningcbut not on the db query. Db query is so heavy that it will take lot of time to load the data and then applied the filter. I want filters on query only.
@dosu can you help.
GitHub link: https://github.com/apache/superset/discussions/34132
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Querying on data set [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Querying on data set
<!-- Answer -->
Here’s a step-by-step checklist for setting up RLS (Row Level Security) with guest tokens for embedded charts in Superset, ensuring filtering happens at the database query level:
1. **Config file changes**:
- Enable the `EMBEDDED_SUPERSET` feature flag in your `superset_config.py` (or `superset_config_docker.py` if using Docker).
- Set up CORS settings (`ENABLE_CORS`, `ALLOWED_DOMAINS`) if embedding from another domain.
- Make sure your guest token secret, algorithm, and audience are configured as needed.
- If using Docker, config overrides must go in `./docker/pythonpath_dev/superset_config_docker.py` on the host, not `/app/superset/config.py` inside the container. [details](https://github.com/apache/superset/issues/33702)
2. **Guest token API**:
- When creating the guest token, include user-specific attributes in the `user` object (e.g., `user_id`).
- Example:
```python
guest_token = security_manager.create_guest_access_token(
user={
"username": "external_user",
"attributes": {
"user_id": "12345"
}
},
resources=[{"type": "dashboard", "id": "dashboard-uuid"}],
rls=[]
)
```
- The `rls` field can be used to pass explicit RLS rules, but for dynamic user filtering, using attributes is preferred. [example](https://github.com/apache/superset/issues/33922)
3. **Dataset SQL changes**:
- In your dataset’s SQL, reference the user attribute using the Jinja macro (if available in your version):
```sql
SELECT * FROM your_table
WHERE user_id = '{{ get_guest_user_attribute("user_id") }}'
```
- If the macro is not available, use the standard Jinja macros like `current_user_id` if your setup supports it.
- Make sure the column referenced in your filter exists in the dataset, or you’ll get SQL errors. [example](https://github.com/apache/superset/issues/32869)
4. **Superset UI (RLS section)**:
- You can define RLS rules in the Superset UI via the RLS modal for the dataset. The modal now has a simplified clause input.
- RLS rules can also be managed via the REST API.
- If you’re using dynamic user attributes in SQL, you may not need to define extra RLS rules in the UI for user-specific filtering, but you can use the UI for static or role-based rules. [UI update](https://github.com/apache/superset/pull/33942)
5. **Other notes**:
- RLS only applies to datasets, not to charts created directly from SQL Lab unless you save the query as a dataset first. [reference](https://github.com/apache/superset/issues/33346)
- Guest tokens automatically have access to datasets used in the dashboard they’re created for; you don’t need to grant explicit dataset access. [reference](https://github.com/apache/superset/issues/26201)
- The `can_set_embedded` permission must be granted to the user/role for embedding dashboards. [reference](https://github.com/apache/superset/issues/33702)
If you follow these steps, user-specific filtering should be pushed down to the database query level for embedded charts. If you run into issues, double-check the feature flags, dataset column names, and that your guest token includes the correct attributes.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/129d9bd4-5ddb-4f1d-a2be-778a829752e4?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/129d9bd4-5ddb-4f1d-a2be-778a829752e4?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/129d9bd4-5ddb-4f1d-a2be-778a829752e4?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/129d9bd4-5ddb-4f1d-a2be-778a829752e4?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/129d9bd4-5ddb-4f1d-a2be-778a829752e4?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/129d9bd4-5ddb-4f1d-a2be-778a829752e4?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/129d9bd4-5ddb-4f1d-a2be-778a829752e4?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/34132)
GitHub link: https://github.com/apache/superset/discussions/34132#discussioncomment-13730436
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Querying on data set [superset]
Posted by "17Shristi (via GitHub)" <gi...@apache.org>.
GitHub user 17Shristi edited a discussion: Querying on data set
I have certain charts which are embedded on client facing UI. I want to apply filters like user id to display data specific to that user.
these charts are embedded using a guest token. Now when I simply passed rls clause in guest token api, filtering is happening but not on the db query. Db query is so heavy that it will take lot of time to load the data and then filter is being applied. I want filters to get apply on query only.
@dosu can you help.
GitHub link: https://github.com/apache/superset/discussions/34132
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Querying on data set [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Querying on data set
<!-- Greeting -->
Hi @17Shristi! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
Superset applies RLS filters from guest tokens directly at the SQL query level, so filtering should happen in the database, not after data retrieval. If you're seeing filtering only after the query runs, it's likely due to how the RLS clause is defined or attached to the dataset. Double-check that your RLS clause references the correct dataset and columns—if the column doesn't exist in the dataset, the filter won't be applied as expected, and you might see errors or unexpected behavior ([example](https://github.com/apache/superset/issues/32869)).
For user-specific filtering (like user id), there's ongoing work to support dynamic user attributes in guest tokens, which you can access in your dataset SQL using the Jinja macro `get_guest_user_attribute`. This allows you to pass user-specific values (like user id) in the guest token and use them directly in your SQL WHERE clause, ensuring the filter is pushed down to the database ([details and example](https://github.com/apache/superset/issues/33922)):
```python
# When creating the guest token
guest_token = security_manager.create_guest_access_token(
user={
"username": "external_user",
"attributes": {
"user_id": "12345"
}
},
resources=[{"type": "dashboard", "id": "dashboard-uuid"}],
rls=[]
)
```
Then, in your dataset's SQL:
```sql
SELECT * FROM your_table
WHERE user_id = '{{ get_guest_user_attribute("user_id") }}'
```
If you're still seeing issues, check that the `EMBEDDED_SUPERSET` feature flag is enabled, your RLS clauses are correctly formatted, and the dataset columns match your RLS rules. If you use SQL Lab, make sure to save queries as datasets before creating charts, as RLS is only enforced on datasets ([reference](https://github.com/apache/superset/issues/33346)).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/b51e0e5c-f277-4f61-8a86-328348b3632d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/b51e0e5c-f277-4f61-8a86-328348b3632d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/b51e0e5c-f277-4f61-8a86-328348b3632d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/b51e0e5c-f277-4f61-8a86-328348b3632d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/b51e0e5c-f277-4f61-8a86-328348b3632d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/b51e0e5c-f277-4f61-8a86-328348b3632d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/b51e0e5c-f277-4f61-8a86-328348b3632d?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/34132)
GitHub link: https://github.com/apache/superset/discussions/34132#discussioncomment-13730366
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Querying on data set [superset]
Posted by "arvind-das (via GitHub)" <gi...@apache.org>.
GitHub user arvind-das added a comment to the discussion: Querying on data set
In case the attribute is at the same level of "username" how to fetch that to be used
GitHub link: https://github.com/apache/superset/discussions/34132#discussioncomment-15798674
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Querying on data set [superset]
Posted by "17Shristi (via GitHub)" <gi...@apache.org>.
GitHub user 17Shristi added a comment to the discussion: Querying on data set
can you once again list the steps to set the rls property properly. is there thing need to be added on config file? and what changes are required in db query or guest token api. also do we need to define something in rls section in superset UI?
@dosu
GitHub link: https://github.com/apache/superset/discussions/34132#discussioncomment-13730398
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Querying on data set [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Querying on data set
<!-- Greeting -->
Hi @17Shristi! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
Superset applies RLS filters from guest tokens directly at the SQL query level, so filtering should happen in the database, not after data retrieval. If you're seeing filtering only after the query runs, it's likely due to how the RLS clause is defined or attached to the dataset. Double-check that your RLS clause references the correct dataset and columns—if the column doesn't exist in the dataset, the filter won't be applied as expected, and you might see errors or unexpected behavior ([example](https://github.com/apache/superset/issues/32869)).
For user-specific filtering (like user id), there's ongoing work to support dynamic user attributes in guest tokens, which you can access in your dataset SQL using the Jinja macro `get_guest_user_attribute`. This allows you to pass user-specific values (like user id) in the guest token and use them directly in your SQL WHERE clause, ensuring the filter is pushed down to the database ([details and example](https://github.com/apache/superset/issues/33922)):
```python
# When creating the guest token
guest_token = security_manager.create_guest_access_token(
user={
"username": "external_user",
"attributes": {
"user_id": "12345"
}
},
resources=[{"type": "dashboard", "id": "dashboard-uuid"}],
rls=[]
)
```
Then, in your dataset's SQL:
```sql
SELECT * FROM your_table
WHERE user_id = '{{ get_guest_user_attribute("user_id") }}'
```
If you're still seeing issues, check that the `EMBEDDED_SUPERSET` feature flag is enabled, your RLS clauses are correctly formatted, and the dataset columns match your RLS rules. If you use SQL Lab, make sure to save queries as datasets before creating charts, as RLS is only enforced on datasets ([reference](https://github.com/apache/superset/issues/33346)).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=b51e0e5c-f277-4f61-8a86-328348b3632d) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/34132#discussioncomment-13730366
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Querying on data set [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Querying on data set
<!-- Answer -->
Here’s a step-by-step checklist for setting up RLS (Row Level Security) with guest tokens for embedded charts in Superset, ensuring filtering happens at the database query level:
1. **Config file changes**:
- Enable the `EMBEDDED_SUPERSET` feature flag in your `superset_config.py` (or `superset_config_docker.py` if using Docker).
- Set up CORS settings (`ENABLE_CORS`, `ALLOWED_DOMAINS`) if embedding from another domain.
- Make sure your guest token secret, algorithm, and audience are configured as needed.
- If using Docker, config overrides must go in `./docker/pythonpath_dev/superset_config_docker.py` on the host, not `/app/superset/config.py` inside the container. [details](https://github.com/apache/superset/issues/33702)
2. **Guest token API**:
- When creating the guest token, include user-specific attributes in the `user` object (e.g., `user_id`).
- Example:
```python
guest_token = security_manager.create_guest_access_token(
user={
"username": "external_user",
"attributes": {
"user_id": "12345"
}
},
resources=[{"type": "dashboard", "id": "dashboard-uuid"}],
rls=[]
)
```
- The `rls` field can be used to pass explicit RLS rules, but for dynamic user filtering, using attributes is preferred. [example](https://github.com/apache/superset/issues/33922)
3. **Dataset SQL changes**:
- In your dataset’s SQL, reference the user attribute using the Jinja macro (if available in your version):
```sql
SELECT * FROM your_table
WHERE user_id = '{{ get_guest_user_attribute("user_id") }}'
```
- If the macro is not available, use the standard Jinja macros like `current_user_id` if your setup supports it.
- Make sure the column referenced in your filter exists in the dataset, or you’ll get SQL errors. [example](https://github.com/apache/superset/issues/32869)
4. **Superset UI (RLS section)**:
- You can define RLS rules in the Superset UI via the RLS modal for the dataset. The modal now has a simplified clause input.
- RLS rules can also be managed via the REST API.
- If you’re using dynamic user attributes in SQL, you may not need to define extra RLS rules in the UI for user-specific filtering, but you can use the UI for static or role-based rules. [UI update](https://github.com/apache/superset/pull/33942)
5. **Other notes**:
- RLS only applies to datasets, not to charts created directly from SQL Lab unless you save the query as a dataset first. [reference](https://github.com/apache/superset/issues/33346)
- Guest tokens automatically have access to datasets used in the dashboard they’re created for; you don’t need to grant explicit dataset access. [reference](https://github.com/apache/superset/issues/26201)
- The `can_set_embedded` permission must be granted to the user/role for embedding dashboards. [reference](https://github.com/apache/superset/issues/33702)
If you follow these steps, user-specific filtering should be pushed down to the database query level for embedded charts. If you run into issues, double-check the feature flags, dataset column names, and that your guest token includes the correct attributes.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=129d9bd4-5ddb-4f1d-a2be-778a829752e4) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/34132#discussioncomment-13730436
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Querying on data set [superset]
Posted by "arvind-das (via GitHub)" <gi...@apache.org>.
GitHub user arvind-das edited a comment on the discussion: Querying on data set
@dosu In case the attribute is at the same level of "username" how to fetch that to be used
GitHub link: https://github.com/apache/superset/discussions/34132#discussioncomment-15798674
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org