You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "sreejithac43 (via GitHub)" <gi...@apache.org> on 2024/12/17 05:19:22 UTC
[I] Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled [superset]
sreejithac43 opened a new issue, #31492:
URL: https://github.com/apache/superset/issues/31492
### Bug description
I am getting an error:
"This session has encountered an interruption, and some controls may not work as intended. If you are the developer of this app, please check that the guest token is being generated correctly."
when using RLS filter in GuestToken for embedded dashboard when "GLOBAL_ASYNC_QUERIES" = True. The same GuestToken set up works when GLOBAL_ASYNC_QUERIES is not used
the errors I am getting in the dashboard network are "not authorised" for charts and filter apis and the above quoted message on the top
Note:
I have celery worker and cache set up with a Redis server in both cases
token payload :
{
"user": {
"username": "guest",
"first_name": "guest",
"last_name": "guest"
},
"resources": [
{
"type": "dashboard",
"id": "d035c4d2-3e2c-4e3f-b45e-20ebb8b366e8"
}
],
"rls_rules": [
{
"clause": ""STATEID" = 3"
}
],
"iat": 1734112254.027939,
"exp": 1734112554.027939,
"aud": "http://0.0.0.0:8080/",
"type": "guest"
}
I have seen discussion and PR in
https://github.com/apache/superset/pull/18924
https://github.com/apache/superset/issues/24171
and some in slack also addressing this bug but it says it was solved from superset 3.1 and I am using latest superset in my docker pull
### Screenshots/recordings
_No response_
### Superset version
master / latest-dev
### Python version
3.10
### Node version
I don't know
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [X] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #31492: Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled
URL: https://github.com/apache/superset/issues/31492
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #31492:
URL: https://github.com/apache/superset/issues/31492#issuecomment-2842856958
This has been inactive for 4 months now. It might just be an edge case nobody is facing, or perhaps it's resolved in 4.1.2/5.0.0. Are you still facing this one?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled [superset]
Posted by "ibuys (via GitHub)" <gi...@apache.org>.
ibuys commented on issue #31492:
URL: https://github.com/apache/superset/issues/31492#issuecomment-4779359425
I'm seeing the same behavior on version 6.1.0, installed from pip. Would it help to file my own bug report?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #31492:
URL: https://github.com/apache/superset/issues/31492#issuecomment-3887964802
Is anyone still hitting this on 5.0/6.? If so, it would be really helpful to know whether the `Not authorized` error comes from the worker side (missing guest context) or the cache retrieval side (similar to the cache key mismatch in #31975). A stack trace from the worker logs would help narrow it down.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled [superset]
Posted by "sreejithac43 (via GitHub)" <gi...@apache.org>.
sreejithac43 closed issue #31492: Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled
URL: https://github.com/apache/superset/issues/31492
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled [superset]
Posted by "kadlecp (via GitHub)" <gi...@apache.org>.
kadlecp commented on issue #31492:
URL: https://github.com/apache/superset/issues/31492#issuecomment-2893408054
We are experiencing exactly same problems when using embedded Superset with RLS.
With `GLOBAL_ASYNC_QUERIES` disabled everything works fine, but once we enable this feature flag we are getting `Not authorized` when calling `/api/v1/chart/data?form_data=%7B%22slice_id%22%3A${SliceId}%7D&dashboard_id=${DashboardID}&force=true`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled [superset]
Posted by "rsprudencio (via GitHub)" <gi...@apache.org>.
rsprudencio commented on issue #31492:
URL: https://github.com/apache/superset/issues/31492#issuecomment-3920074468
@rusackas check https://github.com/apache/superset/pull/37862 for how to fix it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #31492:
URL: https://github.com/apache/superset/issues/31492#issuecomment-2547532025
<!-- Greeting -->
Hey @sreejithac43! 👋 I'm here to help you tackle bugs, answer questions, and even become a contributor.
<!-- Answer -->
I found a similar unsolved discussion regarding the issue you're experiencing: [how can we use simple rls filter in guest token for embedded dashboard when "GLOBAL_ASYNC_QUERIES": True?](https://github.com/apache/superset/discussions/31474), which was last updated on December 16, 2024 <sup>[[1]](https://github.com/apache/superset/discussions/31474)</sup>.
The error you're encountering seems related to the use of Row Level Security (RLS) filters with Guest Tokens when the `GLOBAL_ASYNC_QUERIES` setting is enabled. This issue has been discussed in various threads and was reportedly resolved in Superset version 3.1. However, users on the latest version are still experiencing problems, as noted in the GitHub pull request [#18924](https://github.com/apache/superset/pull/18924) and issue [#24171](https://github.com/apache/superset/issues/24171).
The problem might be related to how cache keys from guest token RLS clauses are evaluated, which could lead to authorization issues. It might be helpful to review the configurations of your guest tokens and RLS clauses, as suggested in the discussions. Additionally, ensure that your setup aligns with the latest documentation and any updates that might have been made to address this issue.
<!-- Dosu Comment Footer -->
*To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
---
<sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/dee88add-6575-4686-81fd-ba05ee8a48a5?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/dee88add-6575-4686-81fd-ba05ee8a48a5?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/dee88add-6575-4686-81fd-ba05ee8a48a5?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/dee88add-6575-4686-81fd-ba05ee8a48a5?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/dee88add-6575-4686-81fd-ba05ee8a48a5?feedback_type=hallucination) | [Other](https://app.dosu.dev/response-feedback/dee88add-6575-4686-81fd-ba05ee8a48a5?feedback_type=other)</sup>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org