Grant read-only access to the Public role for a specific dashboard without any additional permissions

[Stefan781]

I would like to grant read-only access to the Public role for an available dashboard. I know that one can theoretically achieve with the RBAC flag. However, it occurs to me that this does not work if you don't give custom permissions to the Public role, such as the ability to view dashboards. If you simply assign a role without permissions to a dashboard, Superset will inform about "Access Denied" when attempting to visit the dashboard via a hyperlink.

One way to work around this issue is to give Alpha permissions with the PUBLIC_ROLE_LIKE. However, this has the unwanted side effect of allowing the user to click around and get access to parts of the UI that they shouldn't see, such as the chart editing UI.
I would like a cleaner solution that would allow me to present to the user only what the dashboard displays, including any filters I have created for it. Is there a way to achieve this?

As an additional information, what I am looking for is to be able to embed a dashboard as standalone on a web page. The current approach with the Alpha permissions allows the user to click around the charts and enter the UI for editing them. The user shouldn't even have an option to open the options menu on a chart (the three dots). Perhaps there is a different way to achieve this?

[matheusbsilva]

I didn't find a way to allow dashboards to be public without giving the users the ability to browser around the superset UI, they can even see the list of another public dashboards accessing /dashboards/list. It would be awesome to have the same control we have with embedding, where we can specify rules to filter the data, and the user can't access the superset UI.

[nytai]

Seems like you just have to figure out the right set of permissions you want for this role.

[matheusbsilva]

@nytai the minimal permissions needed for the Public role to be able to see dashboards and use filters are these, in my experience:

[can read on CssTemplate, can read on Chart, can read on Dashboard, can write on DashboardFilterStateRestApi, can read on DashboardFilterStateRestApi, can explore json on Superset, can dashboard on Superset]

But with these permissions they can also access the list of Public dashboards on /dashboard/list/. If I remove can read on Dashboard they can not list the Public dashboards, but also they can't access a specific dashboard. And if I remove can dashboard on Superset, they can list the Public dashboards, but can't access a specific dashboard. So I was not able to figured out how to set up the right permissions for this Role, if you could help me I would be grateful.

[Stefan781]

I have done this, as I described in the question. It does not work for me.

[matheusbsilva]

@Stefan781 sorry I forgot the permissions dashboard permalink on Superset and can read on DashboardPermalinkRestApi on Public, which makes the permalink works, maybe that was the issue.

[Stefan781]

Now I get internal server error (500).

That was my point with the question. This seems like something that should be included in the documentation and updated when changes are made. There are other similar questions and they all end up with some set of permissions that work for some but not for all and most of them are out of date anyway. In my opinion, the best option would be to have a dedicated feature for such needs, something similar to the RBAC flag.

Thanks for your input! I will try to play with the permissions a bit more and hopefully, by trial and error, will get to somewhere. Wish it didn't have to be this way.

[matheusbsilva]

Yes I agree, the best option would be to have a feature for public dashboards. So we could create unique links and manage data access for each link with RLS, like we have on embedded dashboards.

[krishanthvs]

@matheusbsilva were you able to find any solution for the same

[KIINGOFKEBAB]

@Stefan781 Hello, did you found something it worked for you ?

[Stefan781]

Nothing that is not mentioned already.

[nurekm]

It uses read permissions of two different users for one control panel. These users should see a column named product_id. For example; Let the product_id column have data 1,2,3,4,5. The first user can see data 1 in the product_id column. 2,3,4,5 should see the data masked. how can i do that

[krishanthvs]

@Stefan781 were you able to resolve this issue