You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "rodmaz (via GitHub)" <gi...@apache.org> on 2023/07/28 21:52:42 UTC
[GitHub] [superset] rodmaz opened a new issue, #24837: Permission in PUBLIC role removes API permission from ADMIN role.
rodmaz opened a new issue, #24837:
URL: https://github.com/apache/superset/issues/24837
:bug: Something strange is happening to Superset v2.1.0 regarding permissions.
Why adding a permission like can _read on dashboards_ for role **Public** removes this permission for role Admin?
#### How to reproduce the bug
1. Make sure **Public** role has NO permission.
2. Using `curl` and a token from an **Admin** user, query the API for available dashboards:
```[shell]
curl --location 'http://localhost:8088/api/v1/dashboard/' \
--header 'Authorization: Bearer xxxxx'
```
We should get a list of current available dashboards. (So far so good).
```
{
"count": 10,
"description_columns": {},
"ids": [
9,
10,
8,
...
```
4. Now add permission `can read on Dashboard` in the role **Public**.
<img width="495" alt="Screenshot 2023-07-28 at 17 28 06" src="https://github.com/apache/superset/assets/55300/813c3ae5-e045-4418-92f1-ff136fdd2179">
5. Perform the same query as step 2 and (surprisingly!) we see no more Dashboards in the API.
```
{
"count": 0,
"description_columns": {},
"ids": [],
"label_columns"
...
```
### Expected results
Adding permission in **Public** role should not affect users using the API with role **Admin**.
### Actual results
Adding permission in role **Public** REMOVES permission from users with role **Admin**.
### Environment
- superset version: `2.1.0` and `2.1.1rc2`
- python version: `3.8.17`
- node.js version: `v16.20.0`
- [x] I have checked the superset logs for python stacktraces and included it here as text if there are any.
- [x] I have reproduced the issue with at least the latest released version of superset.
- [x] I have checked the issue tracker for the same issue and I haven't found one similar.
### Additional context
**Public** is the role defined for guest users:
```[python]
# Embedded config options
GUEST_ROLE_NAME = "Public"
GUEST_TOKEN_JWT_SECRET = "test-guest-secret-change-me"
GUEST_TOKEN_JWT_ALGO = "HS256"
GUEST_TOKEN_HEADER_NAME = "X-GuestToken"
GUEST_TOKEN_JWT_EXP_SECONDS = 300 # 5 minutes
# Guest token audience for the embedded superset, either string or callable
GUEST_TOKEN_JWT_AUDIENCE: Optional[Union[Callable[[], str], str]] = None
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] rodmaz commented on issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
Posted by "rodmaz (via GitHub)" <gi...@apache.org>.
rodmaz commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1656474435
Should we create a new role for guest users instead?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2113355091
Good to know... but we currently support 3.1.x and 4.0.x for the time being. If anyone can validate using those versions, that would be even better still.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "lbuchli (via GitHub)" <gi...@apache.org>.
lbuchli commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2176018616
I played around a bit with this and found a hacky solution, which could also be a pointer to implementing better solution:
In superset_config.py:
```python
from superset.security.manager import SupersetSecurityManager
from flask import Flask
from flask_login import login_user
from flask_jwt_extended import JWTManager
class CustomSecurityManager(SupersetSecurityManager):
def create_jwt_manager(self, app: Flask) -> JWTManager:
def _load_user_jwt(_jwt_header, jwt_data):
user = self.load_user_jwt(_jwt_header, jwt_data)
login_user(user) # sets g.user to jwt provided user
return user
jwt_manager = JWTManager()
jwt_manager.init_app(app)
jwt_manager.user_lookup_loader(_load_user_jwt)
return jwt_manager
CUSTOM_SECURITY_MANAGER = CustomSecurityManager
```
I'm by no means an expert with flask permission stuff, so I cannot say whether this is a good idea from a security point of view. In short, it is a patch for [this function](https://github.com/dpgaspar/Flask-AppBuilder/blob/bbf2adb1312ac1f994ef04e5d5e581d1447cb732/flask_appbuilder/security/manager.py#L2166), which sets g.user, although this has no effect for some reason I haven't looked into. Instead using flask_logins login_user, it works.
I also have absolutely no clue why this problem only pops up when setting PUBLIC role perm can read on Dashboard.
I hope this helps somebody and if someone thinks that this solution is a bad idea, please say so.
This is tested with apache/superset:4.0.1, using the following setup:
<details><summary>Setup</summary>
<p>
```Dockerfile
FROM apache/superset:4.0.1
USER root
RUN pip install psycopg2-binary
COPY ./superset-init.sh /superset-init.sh
COPY superset_config.py /app/
ENV SUPERSET_CONFIG_PATH /app/superset_config.py
USER superset
ENTRYPOINT [ "/superset-init.sh" ]
```
```bash
#!/bin/bash
superset fab create-admin --username "admin" --firstname Superset --lastname Admin --email "admin@superset.com" --password "admin"
cat > /tmp/public-role-perms.json <<EOF
[{"name": "Public", "permissions": [
{"permission": {"name": "can_read"}, "view_menu": {"name": "Dashboard"}}
]}]
EOF
superset fab import-roles -p /tmp/public-role-perms.json
superset db upgrade
superset superset init
/bin/sh -c /usr/bin/run-server.sh
```
</p>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "kleky (via GitHub)" <gi...@apache.org>.
kleky commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2343342322
I can confirm this occurs on 4.0.0 and is causing us serious pain. We sync DB schema from Cube Cloud to Superset, which uses the REST API. The workaround by changing the GUEST_ROLE_NAME worked sometimes, but not on other instances and it makes no sense why.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] rodmaz commented on issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
Posted by "rodmaz (via GitHub)" <gi...@apache.org>.
rodmaz commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1656759446
We managed to fix this by using another custom role for the `GUEST_ROLE_NAME` and leaving `PUBLIC` alone.
Still odd, unexpected behavior but this works fine.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2108711804
Just checking in to see if anyone can recapitulate the issue here. I'm tempted to close it as stale, but it's probably gone stale because it's hard to tell if there's a real bug here, or if this is a question of how to configure roles for embedding (in which case, it should be a Discussion, not an Issue). Thoughts?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "ss-ravi (via GitHub)" <gi...@apache.org>.
ss-ravi commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2111411144
@rusackas I haven't tried it on the 4.0.0 version, but it does happen on 3.0.2.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] nytai commented on issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
Posted by "nytai (via GitHub)" <gi...@apache.org>.
nytai commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1679879696
@ahmed-adly-khalil Embedded doesn't have the use the Public role, you can configure it to use whichever role you want with `GUEST_ROLE_NAME` as @rodmaz has done. This definitely seems like an issue, but there are workaround.
@dpgaspar any thoughts on what might be happening here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] ahmed-adly-khalil commented on issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
Posted by "ahmed-adly-khalil (via GitHub)" <gi...@apache.org>.
ahmed-adly-khalil commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1680080767
@nytai Yeah `GUEST_ROLE_NAME` fixed the problem for me and i can do both dashboard embedding and use the API, thanks a lot. I still think this is a bug and it's great to be fixed since this behaviour is mostly unexpected
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-3930487325
Since the comment addressed the issue, this is otherwise quite stale, we have a new Public default role now, and this issue was reported on 2.0, I think I'm going to take the liberty of closing this one out.
If anyone is still experiencing an issue in this department, please feel free to regroup and post it as a new issue so it's easier to grok and address.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] rodmaz closed issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
Posted by "rodmaz (via GitHub)" <gi...@apache.org>.
rodmaz closed issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
URL: https://github.com/apache/superset/issues/24837
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "ss-ravi (via GitHub)" <gi...@apache.org>.
ss-ravi commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2109088345
@rusackas Adding permissions to the Public role makes the api requests using the Admin role stop working, so it does look like a bug. https://github.com/apache/superset/issues/26470
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "zachoooo (via GitHub)" <gi...@apache.org>.
zachoooo commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2622446509
@FynnMazurkiewicz This explains so much! I've been really struggling with this issue. I wonder why this issue doesn't occur if you set the session cookie. The one provided by CSRF token endpoint doesn't work, but the one provided by actually logging into Superset in browser and then inspecting the network and copying will work properly without any changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "rodmaz (via GitHub)" <gi...@apache.org>.
rodmaz commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2110171311
This is a well described and rather serious bug I would say, when users add permissions for role **Public** removes permissions for role **Admin**.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "rodmaz (via GitHub)" <gi...@apache.org>.
rodmaz commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2110758994
We haven't upgraded yet but plan to do so soon.
I would say, if this is not a bug it should be definitely better documented. Adding permissions in one role ending up removing permissions from another is not something users really expect TBH.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] mdeshmu commented on issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
Posted by "mdeshmu (via GitHub)" <gi...@apache.org>.
mdeshmu commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1656454228
It is not recommended to modify default roles.
You should clone the default roles and make modifications to them.
Are you able to replicate this in cloned roles?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] rodmaz commented on issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
Posted by "rodmaz (via GitHub)" <gi...@apache.org>.
rodmaz commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1656474132
We are only adding permissions to the **Public** role since it is a requirement when we embed dashboards.
That’s the overall approach documented. We just didn’t expect it to break the API.
**Public** role is our guest role.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "ss-ravi (via GitHub)" <gi...@apache.org>.
ss-ravi commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1899493537
I have the same problem.
In my case I need the `can read on Chart` permission in the public role so I can embed the chart in my app without having to login. But when I add this to the role, the `/chart` api stops working.
For me, the `GUEST_ROLE_NAME` workaround does not seem to work, as the embed chart functionality does not use the guest token (and there is no sdk for it).
Does someone know what can I do to solve it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2110466437
@rodmaz a serious bug on 2.1.0, or have you upgraded since then?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "aibunny (via GitHub)" <gi...@apache.org>.
aibunny commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2133033508
For superset version 3.1.x I didn't experience this issue but for 4.0.x I am experiencing this issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "lautaro79 (via GitHub)" <gi...@apache.org>.
lautaro79 commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-3114157375
In my humble opinion @FynnMazurkiewicz found a great workaround and it should be added directly to the SupersetSecurityManager to avoid everyone implementing the same thing in a CustomSecurityManager.
The solution I am referring to is: [Patch](https://github.com/apache/superset/issues/24837#issuecomment-2501991590)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
URL: https://github.com/apache/superset/issues/24837
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2898709877
This has been silent for a while, so it hit my "stale issues" radar. Does anyone (including @dpgaspar) have an update here as to whether or not this has been patches in FAB? Not sure if we should keep this open or not on this repo. Maybe there's an issue on the FAB repo we can link to here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2110909787
Agreed... it's definitely a bug if it's happening in supported versions. That just needs to be validated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] ahmed-adly-khalil commented on issue #24837: Permission in PUBLIC role removes API permission from ADMIN role.
Posted by "ahmed-adly-khalil (via GitHub)" <gi...@apache.org>.
ahmed-adly-khalil commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1679689525
i'm having same issue, why adding permission to the public rule removes it from the admin and on the api level only? !!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "tcape (via GitHub)" <gi...@apache.org>.
tcape commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1889937198
@rodmaz @ahmed-adly-khalil Could either of you provide your `config.py` and `superset_config.py` values you have set? I cannot get embedding and API to both work. It's always either one or the other.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "ahmed-adly-khalil (via GitHub)" <gi...@apache.org>.
ahmed-adly-khalil commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-1890590786
Just use a different role for embracing not public
On Fri, Jan 12, 2024 at 3:54 PM Tim Capehart ***@***.***>
wrote:
> @rodmaz <https://github.com/rodmaz> @ahmed-adly-khalil
> <https://github.com/ahmed-adly-khalil> Could either of you provide your
> config.py and superset_config.py values you have set? I cannot get
> embedding and API to both work. It's always either one or the other.
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/apache/superset/issues/24837#issuecomment-1889937198>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AIUQUZMAEQD3LI25IYGDN6TYOGPI7AVCNFSM6AAAAAA24AUQIWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOBZHEZTOMJZHA>
> .
> You are receiving this because you were mentioned.Message ID:
> ***@***.***>
>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "FynnMazurkiewicz (via GitHub)" <gi...@apache.org>.
FynnMazurkiewicz commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-2501991590
TLDR: **Patch available!**
This bug is still present in version 4.0.1. The workaround suggested by @lbuchli did not work for me either.
**Bug summary**
Whenever you set the "can_read" permission of "Dashboard" as part of the public permissions, the API of that endpoint will start ignoring the JWT entirely and always assume that the public user makes the request. In fact, this bug not only occurs for this endpoint, but for all endpoints. As soon as any item is part of the public read permissions, the JWT is ignored. This breaks the JWT authorization, as the API ignores any given token and always assumes public user permissions. For example, the dashboard endpoint will always return only dashboards available to the public user, even if you supply a JWT Bearer token of a user that has access to more dashboards (such as the admin role).
**Root cause**
I have completed a root cause analysis of this bug. It is caused by an issue in FlaskAppBuilder, the underlying framework also built by the lovely @dpgaspar. [In the security decorator `_protect()`](https://github.com/dpgaspar/Flask-AppBuilder/blob/master/flask_appbuilder/security/decorators.py#L98), that is called to set the authorization context on any endpoint, there is a special condition set for items that are considered public (meaning the public permissions can read them). I'll quote the relevant parts for discussion:
```python
flask_appbuilder/security/decorators.py:98
# Check if the resource is public
if current_app.appbuilder.sm.is_item_public(permission_str, class_permission_name):
return f(self, *args, **kwargs)
# if no browser login then verify JWT
if not (self.allow_browser_login or allow_browser_login):
verify_jwt_in_request()
# Verify resource access
if current_app.appbuilder.sm.has_access(permission_str, class_permission_name):
return f(self, *args, **kwargs)
```
In this decorator, it is first checked whether the item is public and if it is, the endpoint function is immediately called - with no further JWT token handling. You can see the function call to `verify_jwt_in_request()` is only called when the public condition check fails.
I am not sure if this can be considered a bug in FAB itself, so I won't open a bug issue there. I do see however, that this might cause issues a lot and I highly question this order is correct. @dpgaspar What do you think?
**Patch**
Until there is a proper fix implemented by @dpgaspar or any other maintainer, its possible to hack around this by attempting a JWT login by overwriting `is_item_public` in the SecurityManager and adding a call to `verify_jwt_in_request` there.
```python
class MySecurityManager(SupersetSecurityManager):
...
def is_item_public(self, permission_name, view_name):
verify_jwt_in_request(optional=True) # Attempt to parse any existing JWT and fail silently
return super().is_item_public(permission_name, view_name)
...
```
Thanks to my employer https://www.dksr.city/en/ for donating A LOT of time to work on this and being able to donate my findings back to the open source community.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Permission in PUBLIC role removes API permission from ADMIN role. [superset]
Posted by "7frank (via GitHub)" <gi...@apache.org>.
7frank commented on issue #24837:
URL: https://github.com/apache/superset/issues/24837#issuecomment-3804736092
It took a day to get back to this topic. I can confirm that https://github.com/apache/superset/issues/24837#issuecomment-2501991590 addresses the issue for me. Although I agree with @lautaro79 that this could reduce a lot of head scratch when added by default.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org