You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "berlicon (via GitHub)" <gi...@apache.org> on 2025/11/01 12:19:25 UTC
[I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
berlicon opened a new issue, #28214:
URL: https://github.com/apache/superset/issues/28214
### Bug description
User without access to database table can view data from table via dashboard created by another user who has rights to the table.
### How to reproduce the bug
1. I have user1 with access rights to table1 from ClickHouse database
2. I have user2 with NO access rights to table1 from ClickHouse database
3. User1 created dataset, chart and dashboard for viewing data to table1
4. User1 shares dashboard with User2 - added it as dashboard's owner and dataset's owner
5. User2 can view data to table1. It is a bug. He does not have access (database grants) to table1
### Superset version
3.0.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-2080260553
Gotcha. The way that Superset works is typically that you create a database connection using a service account (I'm guessing that's probably what your admin person did), and then you configure your data access within Superset (associating a role to users and to database connections, schemas, tables and row-level-security (RLS) rules). Otherwise Superset doesn't really know what to show you when listing charts, dashboards and datasets, and whether it's safe to share a cache (in the case of RLS).
But, there's recent development around impersonation / oauth for databases. I don't think it's implemented for Clickhouse, but may be implementable if Clickhouse supports oauth. More information here: https://github.com/apache/superset/pull/27631
Note that a shortcoming of that approach is Superset, unless you duplicate some of the data access policy as Superset roles, will show you all objects (charts, dashboards, datasets, ....) and when you click on it you'll get a "NO ACCESS" error message, which isn't a great experience. But it sounded like this is the behavior you were expecting.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "berlicon (via GitHub)" <gi...@apache.org>.
berlicon commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-3497427298
OK, I received the correct answer in this issue: https://github.com/apache/superset/issues/36019
So, I close the issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "berlicon (via GitHub)" <gi...@apache.org>.
berlicon closed issue #28214: Dashboards should be loaded with current user access rights, not with dashboard owner's access rights
URL: https://github.com/apache/superset/issues/28214
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-2079679779
> It does not matter what role in Superset User2 has
Mmmh. Yes it does. `Alpha` and and `Admin` both have `all_datasource_access`. https://superset.apache.org/docs/security/#alpha
I'm not sure I understand you fully though, it's unclear to me whether you are referring to database permissions or superset permissions at times, please clarify. The typical way to access databases from BI tools is to use a service account that has general read access to everything you want to expose in the BI tools, and implement the restrictions using the security model in the BI tool.
There are ways to impersonate or use oauth so that each user can effectively have their database-defined user access.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "berlicon (via GitHub)" <gi...@apache.org>.
berlicon closed issue #28214: Dashboards should be loaded with current user access rights, not with dashboard owner's access rights
URL: https://github.com/apache/superset/issues/28214
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "berlicon (via GitHub)" <gi...@apache.org>.
berlicon commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-2079954092
@mistercrunch I meant we have Angular app where users can create ClickHouse databases. And we give grants (CRUD operations to tables) to these users with such SQL script: "GRANT SELECT ON "dbo"."DATA" TO 'user26'". Also we have Superset integrated to our app. And users can run SQL queries to some tables where they have grants for SELECT. Also Superset have dashboard functionality. And we have bug that if some user (admin) created dashboard for viewing data to some table he has access and share that dashboard to other users (business users) they could view data they do not have access. I checked that when business user view dashboard, page loaded data from database with dashboard's creator (admin) accout. But I want that dashboard should be loaded under role with current user. So we have users in Superset but their access rights to tables we store in ClickHouse database which Superset does not know. As I understand I have to change backend code of Superset on Python to implement t
his. But Python/React/Flask and Supersert are not my tech stack and I want help how and where I should modify Superset code. Or maybe we should create dashboards in Superset another way to support this behaviour (users can view data they have access only).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-2080263708
Given the title of the issue, it sounds like [berlicon](https://github.com/berlicon)'s expectations are very different from the common expectations when configuring/using a BI tool. Unless I'm missing something.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "berlicon (via GitHub)" <gi...@apache.org>.
berlicon commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-3476349810
Can I reopen this issue?
The problem is the same.
Steps to reproduce:
1. We have User1 and User2 in Superset.
2. We have ClickHouse DB connected to Superset.
3. User1 has access to table1 in ClickHouse DB. User2 does not.
4. If User1 opens SQLLab and executes query: select * from table1 - he will get data from table1.
5. if User2 opens SQLLab and executes query: select * from table1 - he will give ClickHouse error "Code: 497. DB::Exception: User2: Not enough privileges.(ACCESS_DENIED)"
6. User1 creates dataset1 for table1.
7. User1 creates dashboard/chart for dataset1.
8. User1 opens dashboard and clicks Share/Copy permalink to clipboard.
9. User2 opens Superset and pastes permalink to browser.
10. User2 gets an error: "This endpoint requires the datasource table1, database or `all_datasource_access` permission". It is OK.
11. User1 adds User2 as coowner of dataset1
12. User2 clicks "Force refresh" on shared dashboard.
13. User2 can see data in dashboard. It is a BUG. User2 should not see any data in dashboard because he does not have access to table1 in Clickhouse. I investigated that query to database was executed under User1 even though User2 is actually watching the dashboard. I run the query: select * from system.processes -- in ClickHouse it shows which user really made the query and it was User1. See: https://clickhouse.com/docs/operations/system-tables/processes
How/where I should change the Superset code in order to shared dashboard will be executed under shared user access rights? Or maybe I did that wrong way?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "abhishekindigg (via GitHub)" <gi...@apache.org>.
abhishekindigg commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-2079580065
@mistercrunch Even I provided `Gamma` role still they are not able to view Dashboards.
#28234
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "berlicon (via GitHub)" <gi...@apache.org>.
berlicon commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-2078959002
It does not matter what role in Superset User2 has. I want that if User2 viewing any dashboard that dashboard be loaded under User2 access rights. And if User2 does not have access rights for viewing data (these rights are stored in ClickHouse DB) he would get an error "Access denied".
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "berlicon (via GitHub)" <gi...@apache.org>.
berlicon commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-2080455447
My expectations were that somehow advice me how to change code in Superset. May be here:
superset\tasks\async_queries.py
@celery_app.task(name="load_chart_data_into_cache", soft_time_limit=query_timeout)
def load_chart_data_into_cache(...)
OK. Let's close this ticket.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "berlicon (via GitHub)" <gi...@apache.org>.
berlicon commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-2076956017
1. How I should share dashboards to users and they loading data with their access rights?
2. Or where/how I should change code of Superset to do the same?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Dashboards should be loaded with current user access rights, not with dashboard owner's access rights [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on issue #28214:
URL: https://github.com/apache/superset/issues/28214#issuecomment-2078392965
What is/are user2's role? You'll want user 2 as `Gamma` presumably
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org