Issue with Public Role Permissions for Sharing Dashboards and Generating Screenshots in Superset

[aprendizlaura]

Hello everyone,

I’m experiencing an issue with permissions in Superset and haven’t been able to find a solution after trying several configurations. Below, I explain my situation in detail in the hope that someone can guide me or provide some help.

I have two goals:

1. Share a dashboard via a public link, so that anyone can access it without needing to log in to Superset. For this, I’m using the public role (Public).
2. Generate a screenshot of a chart through a Celery task locally so that it can be downloaded to my computer. Similar to the work Celery does when we generate alerts or reports, or when we download an image directly from Superset. Unable to get a screenshot of a chart #27760 (reply in thread)

So far, I’ve been able to achieve the first goal using the Public role. However, when I try to create the screenshot via code, the action does not complete successfully with the permissions assigned to this role. After investigating and testing different configurations, I discovered that if I change the configuration value from AUTH_ROLE_PUBLIC = 'Public' to AUTH_ROLE_PUBLIC = 'admin', the screenshot works perfectly. However, this breaks the first goal, as it’s no longer possible to access the dashboard via the public link without logging in.

I believe the solution might be to add some specific permissions to the Public role, which would allow me to keep the ability to access the dashboard publicly and, at the same time, enable the generation of screenshots via code. However, I haven’t been able to identify which permissions are needed.

I’ve searched for documentation that explains what each permission in Superset does, but I haven’t found anything clear enough to help me understand this.

My question is:

Does anyone know which specific permissions I should add to the Public role to generate screenshots via code without losing the ability to access dashboards without logging in?

I would really appreciate any guidance or help you can provide.

Thanks in advance.

Public Rol permissions

• can read on Chart
• can read on Dashboard
• can read on DashboardPermalinkRestApi
• can delete on FilterSets
• can list on FilterSets
• can add on FilterSets
• can edit on FilterSets
• can show on DynamicPlugin
• can list on DynamicPlugin
• can time range on Api
• can dashboard on Superset
• can explore json on Superset
• can dashboard permalink on Superset
• all datasource access on all_datasource_access
• can csv on Superset
• can explore on Superset
• can share chart on Superset
• can share dashboard on Superset
• can userinfo on UserDBModelView

superset_config.py

import logging
import os

from celery.schedules import crontab
from flask_caching.backends.filesystemcache import FileSystemCache
from superset.superset_typing import CacheConfig

logger = logging.getLogger()

SECRET_KEY = os.environ.get("SUPERSET_SECRET_KEY")
SQLALCHEMY_DATABASE_URI = os.environ.get("SQLALCHEMY_DATABASE_URI")

REDIS_HOST = os.getenv("REDIS_HOST", "redis")
REDIS_PORT = os.getenv("REDIS_PORT", "6379")
REDIS_CELERY_DB = os.getenv("REDIS_CELERY_DB", "0")
REDIS_RESULTS_DB = os.getenv("REDIS_RESULTS_DB", "1")

RESULTS_BACKEND = FileSystemCache("/app/superset_home/sqllab")

CACHE_DEFAULT_TIMEOUT = 86400

CACHE_CONFIG = {
    "CACHE_TYPE": "RedisCache",
    "CACHE_DEFAULT_TIMEOUT": CACHE_DEFAULT_TIMEOUT,
    "CACHE_KEY_PREFIX": "superset_",
    "CACHE_REDIS_HOST": REDIS_HOST,
    "CACHE_REDIS_PORT": REDIS_PORT,
    "CACHE_REDIS_DB": REDIS_RESULTS_DB,
}
DATA_CACHE_CONFIG = CACHE_CONFIG

class CeleryConfig:
    broker_url = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_CELERY_DB}"
    imports = ("superset.sql_lab", "superset.tasks", "superset.tasks.thumbnails")
    result_backend = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_RESULTS_DB}"
    worker_prefetch_multiplier = 10
    task_acks_late = True
    task_annotations = {
        "sql_lab.get_sql_results": {
            "rate_limit": "100/s",
        },
    }
    beat_schedule = {
        "reports.scheduler": {
            "task": "reports.scheduler",
            "schedule": crontab(minute="*", hour="*"),
        },
        "reports.prune_log": {
            "task": "reports.prune_log",
            "schedule": crontab(minute=10, hour=0),
        },
    }


CELERY_CONFIG = CeleryConfig

FEATURE_FLAGS = {
        "ALERT_REPORTS": True,
        "ALLOW_ADHOC_SUBQUERY": True,
        "ENABLE_TEMPLATE_PROCESSING": True,
        "ESTIMATE_QUERY_COST": True,
        "THUMBNAILS": True,
        "THUMBNAILS_SQLA_LISTENERS": True,
        "LISTVIEWS_DEFAULT_CARD_VIEW" : True,
        "DRILL_TO_DETAIL": True,
        "DRILL_BY": True,
        "EMBEDDED_SUPERSET": True,
        "HORIZONTAL_FILTER_BAR": True, #Funcionalidad que permite en el dashboard elegir la localizacion del filtro,
        "DASHBOARD_RBAC": True,  #Funcinalidad que permite establecer que roles pueden acceder al panel
        "ALERT_REPORT_TABS": True, #Funcionalidad para que en alertas y reportes capture todas las pestañas
        "DASHBOARD_VIRTUALIZATION": False,
        "ALLOW_FULL_CSV_EXPORT": True,
        "ALERTS_ATTACH_REPORTS": True,
        "DYNAMIC_PLUGINS": True,
        "VERSIONED_EXPORT": True,
}

ENABLE_CORS = True
CORS_OPTIONS = {
    "supports_credentials": True,
    "origins": ["http://myurl:80", "http://localhost:3000'"],
    "allow_headers": ["*"],
    "resources": ["*"],
}

GUEST_ROLE_NAME = "Gamma"
GUEST_TOKEN_JWT_EXP_SECONDS = 300
GUEST_TOKEN_JWT_ALGO = "HS256"
GUEST_TOKEN_HEADER_NAME = "X-GuestToken"


AUTH_ROLE_PUBLIC = "Public"
PUBLIC_ROLE_LIKE = "Gamma"

SESSION_COOKIE_SAMESITE = None
SESSION_COOKIE_SECURE = False
SESSION_COOKIE_HTTPONLY = False

ENABLE_PROXY_FIX = True

WTF_CSRF_ENABLED = False
OVERRIDE_HTTP_HEADERS = {'X-Frame-Options': 'ALLOWALL'}
SCREENSHOT_LOCATE_WAIT = 1000
SCREENSHOT_LOAD_WAIT = 1600
ENABLE_ALERTS = True

WEBDRIVER_TYPE = "firefox"
WEBDRIVER_BASEURL = "http://myurl:80"
WEBDRIVER_BASEURL_USER_FRIENDLY = WEBDRIVER_BASEURL
WEBDRIVER_OPTION_ARGS = [
        "--force-device-scale-factor=2.0",
        "--high-dpi-support=2.0",
        "--headless",
        "--disable-gpu",
        "--disable-dev-shm-usage",
        "--no-sandbox",
        "--disable-setuid-sandbox",
        "--disable-extensions",
        ]

ALERT_REPORTS_NOTIFICATION_DRY_RUN = False
THUMBNAIL_SELENIUM_USER = "Admin"
THUMBNAIL_CACHE_CONFIG: CacheConfig = {
    'CACHE_TYPE': 'RedisCache',
    'CACHE_DEFAULT_TIMEOUT': CACHE_DEFAULT_TIMEOUT,
    'CACHE_KEY_PREFIX': 'thumbnail_',
    'CACHE_REDIS_URL': f'redis://{REDIS_HOST}:{REDIS_PORT}/6'
}
SQLLAB_CTAS_NO_LIMIT = True
TALISMAN_ENABLED = False
HTML_SANITIZATION = False
ENABLE_PROXY_FIX = True

[dosubot[bot]]

To allow the Public role in Superset to generate screenshots via code without losing the ability to access dashboards without logging in, you should set the PUBLIC_ROLE_LIKE configuration to "Gamma" in your superset_config.py file. This will grant the Public role the same set of permissions as the Gamma role, which includes access to view dashboards.

PUBLIC_ROLE_LIKE = "Gamma"

Additionally, you need to explicitly grant access to the specific datasets required for generating screenshots by editing the Public role and adding the public data sources manually.

Here are the steps to manually add public data sources to the Public role:

1. Navigate to the Security menu.
2. Select List Roles.
3. Edit the Public role.
4. In the Permissions dropdown, select the data sources you want to associate with the Public role.

This process allows you to explicitly grant access to specific datasets for the Public role ^[1].

Be aware that there are some limitations and security concerns with setting PUBLIC_ROLE_LIKE to Gamma. While it allows anonymous users to view dashboards, it requires careful management of data source permissions to mitigate security risks ^[1].

To continue talking to Dosu, mention @dosu.

[aprendizlaura]

@dosu I already had this configuration added, but it still doesn’t work.
With PUBLIC_ROLE_LIKE = "Gamma", if I set:
AUTH_ROLE_PUBLIC = 'Public', then I can perform the first task, which is sharing my dashboard and viewing it without logging into Superset.
AUTH_ROLE_PUBLIC = 'admin', then I can take screenshots.
I can't find the middle ground between the two.

[dosubot[bot]]

To achieve both goals—sharing dashboards publicly and generating screenshots via code—without compromising either functionality, you need to ensure the Public role has the necessary permissions for both tasks. Here are the steps to configure this:

1. Enable Public Access to Dashboards:

   • Ensure the DASHBOARD_RBAC feature flag is enabled in superset_config.py.

   FEATURE_FLAGS = {
       'DASHBOARD_RBAC': True,
   }

2. Set Public Role Permissions:

   • Ensure AUTH_ROLE_PUBLIC is set to 'Public' in superset_config.py.

   AUTH_ROLE_PUBLIC = 'Public'

3. Grant Necessary Permissions to Public Role:

   • Manually add the required permissions to the Public role to allow screenshot generation. These permissions include access to the charts and dashboards, as well as the ability to execute the screenshot tasks.

   Here are the specific permissions you need to add to the Public role:

   • can_csv on Superset
   • can_dashboard on Superset
   • can_explore on Superset
   • can_share_chart on Superset
   • can_share_dashboard on Superset
   • can_explore_json on Superset
   • can_userinfo on UserDBModelView
   • can_view_chart_as_table on Dashboard
   • can_view_query on Dashboard

4. Enable Thumbnails Feature:

   • Enable the THUMBNAILS feature flag in superset_config.py.

   FEATURE_FLAGS.update({
       'THUMBNAILS': True,
   })

5. Configure Thumbnail Execution:

   • Set the THUMBNAIL_EXECUTE_AS to use the SELENIUM user.

   THUMBNAIL_EXECUTE_AS = [ExecutorType.SELENIUM]

6. Explicitly Grant Access to Specific Datasets:

   • Navigate to the Security menu, select "List Roles", edit the Public role, and add the specific datasets required for generating screenshots.

By following these steps, you should be able to configure the Public role to both share dashboards publicly and generate screenshots via code without requiring a login ^[1][2][3].

To continue talking to Dosu, mention @dosu.

[aprendizlaura]

@dosu If I set #THUMBNAIL_EXECUTE_AS = [ExecutorType.SELENIUM] in my configuration file, I get a "502 Bad Gateway" error. Where could this be coming from?

[dosubot[bot]]

The "502 Bad Gateway" error when setting THUMBNAIL_EXECUTE_AS = [ExecutorType.SELENIUM] in your configuration file is likely due to the THUMBNAILS feature flag being disabled. By default, the THUMBNAILS feature flag is set to False.

To resolve this issue, enable the THUMBNAILS feature flag in your superset_config.py file:

FEATURE_FLAGS = {
    "THUMBNAILS": True,
    "THUMBNAILS_SQLA_LISTENERS": True,
}

Additionally, ensure you have a cache system and Celery workers configured, as all thumbnails are stored in the cache and processed asynchronously by the workers. Here is an example configuration for using Redis as the cache and setting up Celery:

from flask import Flask
from s3cache.s3cache import S3Cache

class CeleryConfig(object):
    broker_url = "redis://localhost:6379/0"
    imports = (
        "superset.sql_lab",
        "superset.tasks.thumbnails",
    )
    result_backend = "redis://localhost:6379/0"
    worker_prefetch_multiplier = 10
    task_acks_late = True

CELERY_CONFIG = CeleryConfig

def init_thumbnail_cache(app: Flask) -> S3Cache:
    return S3Cache("bucket_name", 'thumbs_cache/')

THUMBNAIL_CACHE_CONFIG = init_thumbnail_cache
THUMBNAIL_SELENIUM_USER = "Admin"

By ensuring the THUMBNAILS feature flag is enabled and the necessary cache and Celery configurations are in place, you should be able to prevent the "502 Bad Gateway" error ^[1][2].

To continue talking to Dosu, mention @dosu.

[aprendizlaura]

@dosu I just updated my configuration file in my post, what should I change to achieve my goals?

[dosubot[bot]]

To achieve both sharing dashboards publicly and generating screenshots via code in Superset, you need to ensure the necessary configurations and permissions are set up correctly. Here are the steps to update your configuration file and permissions:

1. Enable Public Access to Dashboards:

   • Ensure the DASHBOARD_RBAC feature flag is enabled in superset_config.py.

   FEATURE_FLAGS = {
       'DASHBOARD_RBAC': True,
       'THUMBNAILS': True,
       'THUMBNAILS_SQLA_LISTENERS': True,
       'EMBEDDED_SUPERSET': True,
       # other feature flags...
   }

2. Set Public Role Permissions:

   • Ensure AUTH_ROLE_PUBLIC is set to 'Public' in superset_config.py.

   AUTH_ROLE_PUBLIC = 'Public'

3. Grant Necessary Permissions to Public Role:

   • Manually add the required permissions to the Public role to allow screenshot generation. These permissions include access to the charts and dashboards, as well as the ability to execute the screenshot tasks.

   Here are the specific permissions you need to add to the Public role:

   • can_csv on Superset
   • can_dashboard on Superset
   • can_explore on Superset
   • can_share_chart on Superset
   • can_share_dashboard on Superset
   • can_explore_json on Superset
   • can_userinfo on UserDBModelView
   • can_view_chart_as_table on Dashboard
   • can_view_query on Dashboard

4. Configure Thumbnail Execution:

   • Set the THUMBNAIL_SELENIUM_USER and THUMBNAIL_EXECUTE_AS configurations to ensure proper execution of thumbnail generation:

   THUMBNAIL_SELENIUM_USER = "Admin"
   THUMBNAIL_EXECUTE_AS = [ExecutorType.SELENIUM]

5. Ensure Celery and Cache Configuration:

   • Ensure you have a cache system and Celery workers configured, as all thumbnails are stored in the cache and processed asynchronously by the workers. Here is an example configuration for using Redis as the cache and setting up Celery:

   class CeleryConfig:
       broker_url = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_CELERY_DB}"
       imports = (
           "superset.sql_lab",
           "superset.tasks.thumbnails",
       )
       result_backend = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_RESULTS_DB}"
       worker_prefetch_multiplier = 10
       task_acks_late = True
       beat_schedule = {
           "reports.scheduler": {
               "task": "reports.scheduler",
               "schedule": crontab(minute="*", hour="*"),
           },
           "reports.prune_log": {
               "task": "reports.prune_log",
               "schedule": crontab(minute=10, hour=0),
           },
       }
   
   CELERY_CONFIG = CeleryConfig
   
   THUMBNAIL_CACHE_CONFIG = {
       'CACHE_TYPE': 'RedisCache',
       'CACHE_DEFAULT_TIMEOUT': CACHE_DEFAULT_TIMEOUT,
       'CACHE_KEY_PREFIX': 'thumbnail_',
       'CACHE_REDIS_URL': f'redis://{REDIS_HOST}:{REDIS_PORT}/6'
   }

6. Explicitly Grant Access to Specific Datasets:

   • Navigate to the Security menu, select "List Roles", edit the Public role, and add the specific datasets required for generating screenshots.

By following these steps, you should be able to configure the Public role to both share dashboards publicly and generate screenshots via code without requiring a login ^[1][2][3].

To continue talking to Dosu, mention @dosu.

[aprendizlaura]

@dosu I already had this configuration added, but it still doesn’t work.

[dosubot[bot]]

To resolve the issue, ensure the following configurations and permissions are correctly set:

1. Feature Flags:

   • Ensure THUMBNAILS and DASHBOARD_RBAC are enabled.

   FEATURE_FLAGS = {
       'THUMBNAILS': True,
       'DASHBOARD_RBAC': True,
       # other feature flags...
   }

2. Public Role Configuration:

   • Set AUTH_ROLE_PUBLIC to 'Public'.

   AUTH_ROLE_PUBLIC = 'Public'

3. Public Role Permissions:

   • Add necessary permissions to the Public role:
     • can_csv on Superset
     • can_dashboard on Superset
     • can_explore on Superset
     • can_share_chart on Superset
     • can_share_dashboard on Superset
     • can_explore_json on Superset
     • can_userinfo on UserDBModelView
     • can_view_chart_as_table on Dashboard
     • can_view_query on Dashboard

4. Thumbnail Configuration:

   • Ensure THUMBNAIL_SELENIUM_USER is set correctly.

   THUMBNAIL_SELENIUM_USER = "Admin"

5. Celery and Cache Setup:

   • Ensure Celery and cache are configured properly for thumbnail processing.

6. Dataset Access:

   • Explicitly grant access to required datasets for the Public role.

These steps should help you achieve both public dashboard access and screenshot generation.

To continue talking to Dosu, mention @dosu.

[aprendizlaura]

@dosu my current permissions for the public role are as follows:

• can read on Chart
• can read on Dashboard
• can read on DashboardPermalinkRestApi
• can delete on FilterSets
• can list on FilterSets
• can add on FilterSets
• can edit on FilterSets
• can show on DynamicPlugin
• can list on DynamicPlugin
• can time range on Api
• can dashboard on Superset
• can explore json on Superset
• can dashboard permalink on Superset
• all datasource access on all_datasource_access
• can csv on Superset
• can explore on Superset
• can share chart on Superset
• can share dashboard on Superset
• can userinfo on UserDBModelView
  On the other hand, the permissions can_view_chart_as_table on Dashboard and can_view_query on Dashboard do not exist.

[dosubot[bot]]

To resolve the issue with generating screenshots while maintaining public access, ensure the following:

1. Verify Permissions:

   • Your current permissions for the Public role seem comprehensive. However, ensure that the THUMBNAIL_SELENIUM_USER has access to all necessary resources.

2. Check Feature Flags:

   • Ensure THUMBNAILS and DASHBOARD_RBAC are enabled in your configuration.

   FEATURE_FLAGS = {
       'THUMBNAILS': True,
       'DASHBOARD_RBAC': True,
       # other feature flags...
   }

3. Thumbnail Configuration:

   • Ensure THUMBNAIL_SELENIUM_USER is set correctly and has the necessary permissions.

   THUMBNAIL_SELENIUM_USER = "Admin"

4. Celery and Cache Setup:

   • Confirm that Celery and cache are configured properly for thumbnail processing.

5. Dataset Access:

   • Explicitly grant access to required datasets for the Public role.

If the permissions can_view_chart_as_table and can_view_query do not exist, focus on ensuring that the Public role and the Selenium user have access to the necessary datasets and dashboards. This should help in achieving both public dashboard access and screenshot generation.

To continue talking to Dosu, mention @dosu.