Issue with Dashboard Access for Role-Based Permissions (DASHBOARD_RBAC=True)

[aprendizlaura]

Hello everyone!

I'm testing the feature flag DASHBOARD_RBAC = TRUE, but it’s not working correctly. When I create a user with an assigned role, and that role is assigned to a dashboard, if I log in with that user, I can see all published dashboards, not only the ones associated with their role. Does anyone have an idea why this is happening and if it’s a permissions issue? I also see that the user can access all charts. Is there a way to adjust the role permissions so that when they log into Superset, they only see the Dashboards section and can only view the dashboards associated with their role?

Thank you so much!

[dosubot[bot]]

I found a similar unsolved discussion that might be relevant to your issue: Dashboard Viewer ^[1]. Additionally, there are some closed issues that might provide insights:

1. Not able to enable DASHBOARD_RBAC in helm chart? - This issue suggests ensuring that roles are correctly assigned to dashboards and that users are assigned to those roles. Also, make sure the dashboards you want to share are published.

2. RBAC not Working - This was resolved by a pull request that fixed the RBAC logic when no roles are chosen.

3. Can't create dashboard with custom role - This issue might provide additional context on role creation and assignment.

When DASHBOARD_RBAC is set to TRUE, a user can access a dashboard if it is published and the user has at least one role that matches the roles assigned to the dashboard. Ensure that the roles are correctly assigned to both the user and the dashboard, and that the dashboards are published ^[2].

To continue talking to Dosu, mention @dosu.

[aprendizlaura]

@dosu Which permissions should my role have for this to work?

[dosubot[bot]]

The reason you can see some visualizations and not others with your current role permissions is likely due to the specific permissions associated with your role. In Superset, roles need to have access to the data sources that the visualizations are based on. If you are unable to see certain visualizations, it may be because your role does not have the necessary permissions for the data sources those visualizations use. To resolve this, ensure that your role has been granted access to the required data sources ^[1].

To continue talking to Dosu, mention @dosu.

[aprendizlaura]

@dosu I don’t think so because, with the same dataset, I have created two visualizations: one is visible, and the other is not. In fact, I tried giving specific permission to that dataset, and the one that wasn’t visible before is still not visible.I think what’s missing is some permission for my role.

[dosubot[bot]]

If you have two visualizations based on the same dataset and one is visible while the other is not, it might be related to specific permissions required for the visualizations themselves or the dashboard settings. When DASHBOARD_RBAC is enabled, ensure that:

1. The role has explicit permissions for the specific visualizations or charts. This might involve checking if there are any additional permissions required for the visualization type or any custom settings applied to it.

2. The dashboard containing the visualizations is correctly configured with the roles. If the dashboard has roles set, ensure that the user role is included in those roles.

3. The visualizations are not restricted by any other settings, such as filters or custom access rules that might be applied at the visualization level.

If these aspects are correctly configured and the issue persists, it might be worth reviewing the specific permissions associated with the visualizations to ensure there are no additional restrictions.

To continue talking to Dosu, mention @dosu.

[aprendizlaura]

@dosu But how do I ensure that the role has explicit permissions? That’s my question—what permissions do I need to achieve my goal?

[dosubot[bot]]

To ensure that a role has explicit permissions to access specific visualizations and dashboards in Superset when using DASHBOARD_RBAC, you need to:

1. Grant Access to Specific Dashboards: Assign the role explicit access to the dashboards you want them to view. This will bypass dataset-level checks and implicitly grant read access to all charts and associated datasets within those dashboards ^[1].

2. Check Visualization Permissions: Ensure that the role has permissions for the specific visualizations. This might involve granting access to the charts themselves if there are any specific permissions set at the chart level.

3. Dataset Permissions: Although DASHBOARD_RBAC can bypass dataset-level checks, ensure that the role has access to the datasets used by the visualizations if needed. This can help avoid any unexpected access issues.

By following these steps, you can control which dashboards and visualizations a role can access, ensuring that users only see the content associated with their roles.

To continue talking to Dosu, mention @dosu.