Giving access based on Dashboards instead of Datasources.

[Renganayaki1]

As of now, we can give access based on data sources. If we give permission to one dataset, all the dashboard created using that dataset can be viewed. But what if we need to restrict some of the dashboards here.

We should need the access permission based on Dashboads.

Some of the related Issues, SIP and pull requests i have seen. I have attached all the link below.

1. Need to give just dashboard view access to users in Supreset #5483
2. [SIP-51] Dashboard Level Access #10408
3. feat: filter dashboards by dashboard roles #12407

So, what is the current status on this? Is the "Access based on Dashboards" option implemeted?

If so, What is the steps to achieve that and from where I can find the option?

Someone please conclude this. Thanks.

[amitmiran137]

Hi there.
It is always good to know that others can't wait for that feature ;)

we are working towards the first milestone of implementation in which dashboard access can be enforced bases on roles assigned to ( est. in 2-4 weeks)
but you'll still need to manage the data access in order to allow charts on your dashboard to fetch data

the second milestone is to enable data access to all of the charts within a dashboard just by having a dashboard access
this step is a bit more complex and we still don't have estimates for that but for sure this is something on the short-term roadmap.

hope this concludes everything

Amit

[pl77]

@amitmiran137 This sounds complex. If a person has access to the dashboard it would seem that they pretty much already have access to the data source, do they not? I guess, from my side, if I wanted to prevent users from accessing various columns or records within a table/database I'd just generate a separate materialized view or other temporary table with the permissible data and give the users full access to that instead. Otherwise it feels like I'll be playing an endless game of whack-a-mole trying to plug various holes to prevent users from tweaking their AJAX calls and grabbing the whole illicit data set.

Anyway, I'll be watching this closely as it might minimize some of my data-post-processing efforts if I can set stronger permissions on data subsets.

[Renganayaki1]

Thanks @amitmiran137 for the conclusion. Please let us know once this requirement added.
Rens.

[zuzana-vej]

there are linked merged PRs assuming this request can be closed