Dashboards RBAC. Is there any plans to share dashboards access to specific users or groups?

[bun4uk]

It would be highly beneficial to implement a flexible access control feature in the Redash, similar to the one in Metabase. This would allow to configure access to different dashboards for specific user groups, providing a more convenient and efficient way to manage dashboard permissions.

[bun4uk]

As I see, there was a PR with this functionality earlier, but it was rejected
#2011

[saturnonfire]

That would be helpful 👍

[DregonX2]

If anyone on the Redash team is willing to work on this and get it done, I would be willing to discuss payment for the work - this feature is essential to my use case. It looks like it was rejected in #2011, but that was years ago. Lets re-examine this please!

[abhijeetbold]

Agree... this would be really helpful, instead of giving access on underlying data sources. This would limit unnecessary access as well.

[yoshiokatsuneo]

I think Dashboard-level access control may requires a new access control model that is bit different from current simple data source based model.
Without good model, adding the feature may makes permission feature complex and can be the cause of miss configuration or bug and the security issue.

So, to implement the feature, I think we need to well-designed access control model and UI that is easy to understand, and consistent through out the product.

And, I think we are welcome contributors who lead the design and implementation.

[yoshiokatsuneo]

For now, I think adding another data source limiting the access may work for some cases.
How about ?

[DregonX2]

I'm not sure I fully understand what you are describing. In my case, all my users are pulling their data from the same data sources, but since I work in a federated organization, I need a way to allow users to see only their relevant subset of the data (even though all their data is coming from the same source).
I was hoping to do that by creating different versions of queries that filter the data differently, then only allow each specific group to View its relevant queries and dashboards, I could achieve my goal of showing everyone different slices of the same data from the same sources. Unfortunately, I don't seem to be able to set "Can't view or edit", "Can only view", and "Can view and edit" per user or group as an option on Queries and Dashboards. If I could just do that, I think I'd have the results I need.

[abhijeetbold]

The underlying data source is same, but when a user wants to see a dashboard based on a subset of data from that data source, they can't. The only way right now is to give access to entire data source itself which is too wide. If the user needs to see data in the dashboard of a single table. They are getting access to entire database which is against the principle of least access.

[yoshiokatsuneo]

@abhijeetbold

The only way right now is to give access to entire data source itself which is too wide. If the user needs to see data in the dashboard of a single table.

How about just creating another "Redash data source" ?
For example, you can create multiple Redash data sources for the same MySQL server. Each Redash datasource can have different MySQL users where one MySQL user have permission for full access and another MySQL user have permission to access only one table ?
It might not be the best solution as we need to create different queries for different Data Sources.
But it is somehow working in our organization , and I think it may work for some use cases.

[DregonX2]

@yoshiokatsuneo Your suggestion just pushes access control to somewhere it cannot be in my use case - I need to filter my queries based on a field within the table. I'm in a federated organization, so for example, I would want to display the contents of a table segmented by the result of the 'Member name' field inside the table. The member named John can only see John's data, and the member named Bob can only see Bob's data. I I can't do this using permissions in the database, because I need to give all users access to the field and table in order for them to be able to filter by its content, and in so doing I've already given them access to too much. What I need to do is create a Query that filters only John's data, and another query that filters only Bob's data, then give John access to John's query and Bob access to Bob's. Your suggestion doesn't allow for this.

[yoshiokatsuneo]

@DregonX2

Thank you for your use case.
If the data source is PostgreSQL, you may set low level security policy for each user and create Redash data source for each user.
Or you may create views for each users...
But yes, it depends on the data source, and may not be practical if there are many users...