You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@superset.apache.org by GitBox <gi...@apache.org> on 2021/07/20 11:19:06 UTC

[GitHub] [superset] xneg opened a new issue #15797: Add Alpha users access to all dashboards when DASHBOARD_RBAC is enabled

xneg opened a new issue #15797:
URL: https://github.com/apache/superset/issues/15797

**Is your feature request related to a problem? Please describe.**
According to [documentation](https://superset.apache.org/docs/security)

> Alpha users have access to all data sources, but they cannot grant or revoke access from other users.

When enabling the DASHBOARD_RBAC setting, Alpha users lost access to dashboards they don't own. Only admin users have full access to all dashboards. Our BI command has had an Alpha role to create and setup dashboards but they are not admins. After enabling DASHBOARD_RBAC they can't see draft dashboards.

**Describe the solution you'd like**
I suggest to add [here](https://github.com/apache/superset/blob/ffa51753e3cfdc401ca976e66e5b85cda032dc08/superset/security/manager.py#L1181) another check

```
can_access = (
is_user_admin() or is_user_alpha()
...
```

**Describe alternatives you've considered**
An alternative is to add in every newly created dashboard access roles Alpha role. But it seems fiddly and easy to miss.

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

[GitHub] [superset] xneg commented on issue #15797: Add Alpha users access to all dashboards when DASHBOARD_RBAC is enabled

Posted by GitBox <gi...@apache.org>.

xneg commented on issue #15797:
URL: https://github.com/apache/superset/issues/15797#issuecomment-1017173494


   Oh, ok, thank you!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

[GitHub] [superset] amitmiran137 closed issue #15797: Add Alpha users access to all dashboards when DASHBOARD_RBAC is enabled

Posted by GitBox <gi...@apache.org>.

amitmiran137 closed issue #15797:
URL: https://github.com/apache/superset/issues/15797


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

[GitHub] [superset] amitmiran137 commented on issue #15797: Add Alpha users access to all dashboards when DASHBOARD_RBAC is enabled

Posted by GitBox <gi...@apache.org>.

amitmiran137 commented on issue #15797:
URL: https://github.com/apache/superset/issues/15797#issuecomment-1017171517


   you can just assign the Alpha role with all databases permissions and that will do it


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

[GitHub] [superset] xneg commented on issue #15797: Add Alpha users access to all dashboards when DASHBOARD_RBAC is enabled

Posted by GitBox <gi...@apache.org>.

xneg commented on issue #15797:
URL: https://github.com/apache/superset/issues/15797#issuecomment-1080797125

Sorry, but your suggestion doesn't work.
If we look at [this filter](https://github.com/apache/superset/blob/a39dd4493e8b40cc142451bc71e4d1d4f2705d3f/superset/dashboards/filters.py#L62) code we'll see that
> List dashboards with the following criteria:
1. Those which the user owns
2. Those which the user has favorited
3. Those which have been published (if they have access to at least one slice)
**If the user is an admin then show all dashboards.**

I think that if the alpha user is somewhat like the administrator in regards to viewing data sources, then they could list all dashboards too.

So my suggestion to change [this line](https://github.com/apache/superset/blob/a39dd4493e8b40cc142451bc71e4d1d4f2705d3f/superset/dashboards/filters.py#L75) to
```
if is_user_admin() or is_user_alpha():
return query
```
P.S. I added all database permissions to alpha users but with RBAC enabled they can't see all dashboards.

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org