Question about Restricting Owner List Visibility in Superset

[ishirvani]

Dear Apache Superset Support Team,

I hope this message finds you well.

I am currently using Apache Superset and I have encountered a challenge. When a user creates a chart, the list of potential owners displayed includes all users of Superset. I would like to restrict this list so that users can only see and select owners who share the same role as themselves.

Could you please provide guidance on how to achieve this? Specifically, I am interested in knowing if there is a way to configure roles and permissions to limit the visibility of users in the owner selection list to only those who have the same role.

Thank you for your support and assistance.

Best regards, Iman

[dosubot[bot]]

I found some similar discussions regarding restricting the list of users in the 'owners' filter for dashboards and charts in Superset:

1. How to restrict the list of users that appear in the 'owners' filter for dashboards/charts? - This discussion is still open and does not have a solution yet ^[1].

2. Block ownership change or reduce the list of available users - This is another open discussion without a solution ^[2].

3. Permissions to limit user list for 'Owner', 'Created by' dropdown - Filters and Search - This discussion is also open and unsolved ^[3].

Currently, there is a new configuration option in Superset that allows filtering specific users from dropdown lists, which might be relevant to your needs. This feature is mentioned in the changelog: "new config to filter specific users from dropdown lists" ^[4]. However, specific details on how to configure this to filter users based on roles are not provided in the available information. You might want to explore this configuration option further to see if it can be adapted to your requirements.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[ishirvani]

Dear Apache Superset Support Team,

I hope this message finds you well.

I am currently using Apache Superset installed on Windows, and I have encountered a challenge. I would like to change the filter values as mentioned in the link you provided (#30163). However, I am unsure where to locate and modify these filter values in the installed environment on Windows.

Could you please provide guidance on where and how to change the filter values in this setup? Any specific file paths or configuration settings would be greatly appreciated.

Thank you for your support and assistance.

Best regards, iman

[dosubot[bot]]

To change the filter values in your Apache Superset installation on Windows, you need to modify the EXTRA_RELATED_QUERY_FILTERS and EXTRA_DYNAMIC_QUERY_FILTERS settings. Here’s how you can do it:

1. Locate the superset/config.py File:

   • The config.py file is typically located in the directory where Superset is installed. If you have set a custom SUPERSET_HOME environment variable, it might be in that directory. Otherwise, it defaults to ~/.superset.

2. Modify the Filters:

   • Open the config.py file and locate the EXTRA_RELATED_QUERY_FILTERS and EXTRA_DYNAMIC_QUERY_FILTERS settings. They are defined as empty dictionaries by default:

     EXTRA_RELATED_QUERY_FILTERS: ExtraRelatedQueryFilters = {}
     EXTRA_DYNAMIC_QUERY_FILTERS: ExtraDynamicQueryFilters = {}

   • You can add custom filter functions to these dictionaries. For example, to filter users in the "Owners" dropdown to only show "admin" or users starting with the letter "b", you can define a function and assign it to the EXTRA_RELATED_QUERY_FILTERS:

     def user_filter(query: Query, *args, **kwargs):
         from superset import security_manager
         user_model = security_manager.user_model
         filters = [
             user_model.username == "admin",
             user_model.username.ilike("b%"),
         ]
         return query.filter(or_(*filters))
     
     EXTRA_RELATED_QUERY_FILTERS = {"user": user_filter}

   • Similarly, to filter databases in the "Database Connections" list to only show those starting with the letter "b", you can define a function and assign it to the EXTRA_DYNAMIC_QUERY_FILTERS:

     def initial_database_filter(query: Query, *args, **kwargs):
         from superset.models.core import Database
         filter = Database.database_name.startswith('b')
         return query.filter(filter)
     
     EXTRA_DYNAMIC_QUERY_FILTERS = {"database": initial_database_filter}

3. Override the Default Configuration:

   • If you prefer not to modify the original config.py file, you can create a superset_config.py file with your custom configurations and set the SUPERSET_CONFIG_PATH environment variable to point to this file. This way, your custom settings will override the defaults without altering the original file.

By following these steps, you can customize the filter values in your Superset installation on Windows ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[ishirvani]

Dear Apache Superset Support Team,

I hope this message finds you well.

I am currently using Apache Superset installed on Windows, and I have encountered a challenge. When a user creates a chart, the list of potential owners displayed includes all users of Superset. I would like to restrict this list so that only users with the "Alpha" role are displayed.

Could you please provide guidance on how to achieve this? Specifically, I am interested in knowing if there is a way to configure roles and permissions to limit the visibility of users in the owner selection list to only those who have the "Alpha" role.

Thank you for your support and assistance.

Best regards, iman

[dosubot[bot]]

To restrict the owner selection list in Apache Superset to only display users with the "Alpha" role, you can use the EXTRA_RELATED_QUERY_FILTERS setting in the superset/config.py file. Here's how you can achieve this:

1. Locate the superset/config.py File:

   • This file is typically located in the directory where Superset is installed. If you have set a custom SUPERSET_HOME environment variable, it might be in that directory. Otherwise, it defaults to ~/.superset.

2. Modify the EXTRA_RELATED_QUERY_FILTERS:

   • Open the config.py file and add a custom filter function to the EXTRA_RELATED_QUERY_FILTERS dictionary to filter users by the "Alpha" role. Here is an example of how you can define this filter:

   def alpha_role_filter(query: Query, *args, **kwargs):
       from superset import security_manager
       user_model = security_manager.user_model
       role_model = security_manager.role_model
       alpha_role = security_manager.find_role("Alpha")
       return query.join(user_model.roles).filter(role_model.id == alpha_role.id)
   
   EXTRA_RELATED_QUERY_FILTERS = {"user": alpha_role_filter}

   This function filters the users to only include those who have the "Alpha" role.

3. Override the Default Configuration (Optional):

   • If you prefer not to modify the original config.py file, you can create a superset_config.py file with your custom configurations and set the SUPERSET_CONFIG_PATH environment variable to point to this file. This way, your custom settings will override the defaults without altering the original file.

By following these steps, you can customize the owner selection list to only show users with the "Alpha" role in your Superset installation on Windows.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[ishirvani]

Dear Apache Superset Support Team,

I hope this message finds you well.

I am currently using Apache Superset installed on Windows, and I have encountered a challenge. When a user creates a chart, the list of potential owners displayed includes all users of Superset. I would like to restrict this list so that users can only see and select owners who share the same roles as themselves.

Could you please provide guidance on how to achieve this? Specifically, I am interested in knowing how to configure the EXTRA_RELATED_QUERY_FILTERS setting in the superset/config.py file to filter users based on their roles. Here is the code I am considering:

python
from sqlalchemy.orm import Query

def same_role_filter(query: Query, *args, **kwargs):
from superset import security_manager
user_model = security_manager.user_model
role_model = security_manager.role_model
current_user_roles = security_manager.get_user_roles()
return query.join(user_model.roles).filter(role_model.id.in_([role.id for role in current_user_roles]))

EXTRA_RELATED_QUERY_FILTERS = {"user": same_role_filter}
Please provide any additional guidance or corrections if necessary to ensure this configuration works correctly in my setup.

Thank you for your support and assistance.

Best regards, iman

[dosubot[bot]]

Your approach to filtering the owner selection list based on shared roles is mostly correct. However, there is a small adjustment needed in your filter function. You should ensure that the current_user_roles is a set of role IDs, which can be done by using a set comprehension. Here's the corrected version of your code:

from sqlalchemy.orm import Query
from superset import security_manager

def same_role_filter(query: Query, *args, **kwargs):
    user_model = security_manager.user_model
    role_model = security_manager.role_model
    current_user_roles = {role.id for role in security_manager.get_user_roles()}
    return query.join(user_model.roles).filter(role_model.id.in_(current_user_roles))

EXTRA_RELATED_QUERY_FILTERS = {"user": same_role_filter}

This code will filter the users in the owner selection list to only include those who share at least one role with the current user ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}