Seeking Some Help On DataSource Security / RLS

[Yash-alternativepath]

I have successfully implemented Row-Level Security (RLS) on a dataset, and it works as expected. However, the issue arises when querying the same table in SQL Lab — RLS is not applied, and all records are returned.

To resolve this, I attempted to create a virtual dataset or table, but when querying the virtual table, I encountered an error: "relation not found".

My goal is to ensure that whatever dataset or virtual dataset the user queries in SQL Lab, they should be able to create new virtual datasets through joins. Importantly, they should only see the data that the RLS or the virtual dataset is applied to.

Any help would be greatly appreciated.

[dosubot[bot]]

Hello @Yash-alternativepath! 👋 I'm Dosu, your friendly bot here to help you solve bugs, answer questions, and navigate the world of contributions. I'm ready to assist you while we wait for a human maintainer. Let's tackle your issues together! 😊

To ensure that Row-Level Security (RLS) is applied when querying datasets in SQL Lab and allow users to create new virtual datasets through joins while only seeing data restricted by RLS or the virtual dataset, you need to follow these steps:

1. Define RLS Filters: Create RowLevelSecurityFilter objects with the necessary clauses and associate them with the relevant tables and roles. This will ensure that RLS is applied based on user roles.

2. Enable RLS in SQL Lab: Make sure the feature flag RLS_IN_SQLLAB is enabled. This allows RLS to be applied in SQL Lab queries. Depending on the database's capabilities, RLS can be inserted by replacing the table with a subquery that includes the RLS or by appending the RLS to the WHERE clause.

3. Apply RLS in SQL Lab: When users query datasets in SQL Lab, the RLS filters will automatically apply based on their roles. The filters are combined using logical operators (AND/OR) as defined in the filter clauses.

4. Create Virtual Datasets: Users can create virtual datasets through joins in SQL Lab. The RLS filters will ensure that they only see data restricted by their roles or the virtual dataset's conditions.

5. Test RLS Application: Test the application of RLS filters by querying the datasets and checking if the expected restrictions are applied.

For more detailed implementation, you can refer to the integration tests and SQL Lab implementation in the Superset repository ^[1][2].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[Yash-alternativepath]

@dosu Even after enabling "RLS_IN_SQLLAB": True, RLS still doesn't seem to be applied, and all data is visible. Could you also guide me on how to query virtual datasets in SQL Lab? it say no relation found

[dosubot[bot]]

In Superset, you can configure access for users to view datasets they have created without granting full database access by using roles. Specifically, you can manage data source access for users with the Gamma role. You can create a new role and assign specific datasets to this role, allowing users with the Gamma role to view only those datasets. This setup allows users to see the objects associated with the tables you have extended to them without needing full database access ^[1].

Additionally, Superset automatically assigns ownership of virtual datasets to the creator, which can help in granting access. This is achieved through a migration script that associates the creator's user ID with the dataset, ensuring that the creator is automatically assigned as the owner ^[2][3].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[Yash-alternativepath]

@dosu That’s exactly the issue I’m facing — the dataset isn’t visible to the user. I’ve verified from the admin side that the virtual dataset was created successfully and the correct user is listed as the owner, but it still doesn’t show up for the owner.

[dosubot[bot]]

There was a known issue in Superset that prevented dataset owners from seeing their own datasets, which was addressed in a change log entry. The fix ensures that dataset owners can view their datasets. You might want to check if your Superset version includes this fix by looking at the change log entry: "Allow dataset owners to see their datasets" (#20135) ^[1]. If your version is older, consider updating to a version that includes this fix.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[Yash-alternativepath]

@dosu i am on version 4.1.2 and this bug even exist in that. so create a bug ticket for it.

[dosubot[bot]]

It seems like this issue requires a deeper look, @rusackas could you please lend your expertise?

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}