GitHub user dosubot[bot] added a comment to the discussion: Restriction of User and Role Views to Admins Only
<!-- Greeting --> Hi @jon-coffey! I'm [Dosu](https://go.dosu.dev/dosubot) and Iām helping the superset team. <!-- Answer --> The restriction that only Admin users can view and manage users and roles in Superset is intentional and enforced in both backend and frontend code. The backend defines admin-only menus and permissions for user and role management, overriding granular permission checks, and the frontend conditionally renders management actions based on admin status [source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/manager.py#L128-L2816) [source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/src/pages/UsersList/index.tsx#L119-L522) [source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/src/pages/RolesList/index.tsx#L110-L296). This design prioritizes security and integrity, ensuring only trusted Admins can perform sensitive operations. There are no signs of ongoing work to relax this restriction or restore permission-based access control fo r these views. If you want to propose a change, you would need to update both backend (SupersetSecurityManager, permission sets) and frontend (UsersList, RolesList, route guards) to respect granular permissions. Before starting a PR, it's a good idea to discuss with maintainers to ensure alignment with the project's security model. For organizations needing sub-admin roles, you can implement custom security managers or filters to achieve more granular control, but this requires backend and frontend customization [source](https://github.com/apache/superset/discussions/33877). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/91a59da0-d3d3-4a40-93ff-02981e3cff47?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/91a59da0-d3d3-4a40-93ff-02981e3cff47?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/91a59da0-d3d3-4a40-93ff-02981e3cff47?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/91a59da0-d3d3-4a40-93ff-02981e3cff47?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/91a59da0-d3d3-4a40-93ff-02981e3cff47?feedback_type=hallucination) | [Report š](https://app.dosu.dev/response-feedback/91a59da0-d3d3-4a40-93ff-02981e3cff47?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/91a59da0-d3d3-4a40-93ff-02981e3cff47?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=The%20restriction%20that%20only%20Admin%20users%20can%20view%20and%20manage%20users%20and%20roles%20in%20Superset%20is%20intentional%20and%20enforced%20in%20both%20backend%20and%20frontend%20code.%20The%20backend%20defines%20admin-only%20menus%20and%20permissions%20for%20user%20and%20role%20management%2C%20overriding%20granular%20permission%20checks%2C%20and%20the%20frontend%20conditionally%20renders%20management%20actions%20based%20on%20admin%20status%20%5Bsource%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/manager.py%23L128-L2816%29%20%5Bsource%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/src/pages/UsersList/index.tsx%23L119-L522 %29%20%5Bsource%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/src/pages/RolesList/index.tsx%23L110-L296%29.%20This%20design%20prioritizes%20security%20and%20integrity%2C%20ensuring%20only%20trusted%20Admins%20can%20perform%20sensitive%20operations.%20There%20are%20no%20signs%20of%20ongoing%20work%20to%20relax%20this%20restriction%20or%20restore%20permission-based%20access%20control%20for%20these%20views.%20If%20you%20want%20to%20propose%20a%20change%2C%20you%20would%20need%20to%20update%20both%20backend%20%28SupersetSecurityManager%2C%20permission%20sets%29%20and%20frontend%20%28UsersList%2C%20RolesList%2C%20route%20guards%29%20to%20respect%20granular%20permissions.%20Before%20starting%20a%20PR%2C%20it%27s%20a%20good%20idea%20to%20discuss%20with%20maintainers%20to%20ensure%20alignment%20with%20the%20project%27s%20security%20model.%20For%20organizations%20needing%20sub-admin%20roles%2C%20you%20can%20implement%20custom%20secu rity%20managers%20or%20filters%20to%20achieve%20more%20granular%20control%2C%20but%20this%20requires%20backend%20and%20frontend%20customization%20%5Bsource%5D%28https%3A//github.com/apache/superset/discussions/33877%29.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/37938) GitHub link: https://github.com/apache/superset/discussions/44409#discussioncomment-18489838 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
