rls rule

[srijani-smsrc]

so i am embedding a dashboard which has multiple charts from different datasource , i am applying rls rule in dashboard level , but i want only the datasource i specify to apply the rls rule

{
"clause": "RPM_FOR_NAME='COMPANY_NAME'",
"tables": [
"TABLE_NAME"
]
}

this is for superset 5
@dosu

[dosubot[bot]]

Your configuration is correct — specifying a table in the "tables" field of an RLS rule ensures the rule only applies to that specific datasource, not to all charts on the dashboard.

When Superset executes a query for each chart, it checks which RLS rules have that chart's datasource listed in their tables field. Only matching rules get applied [1]. Charts using other datasources that aren't listed in the rule will remain unfiltered by it.

So your rule:

{
  "clause": "RPM_FOR_NAME='COMPANY_NAME'",
  "tables": ["TABLE_NAME"]
}

will only add the WHERE RPM_FOR_NAME='COMPANY_NAME' clause to queries against TABLE_NAME. Other charts on the same dashboard pulling from different datasources won't be affected.

A few things to note:

• The tables field uses table IDs internally (via a many-to-many relationship), so make sure you're selecting the correct datasource when creating the rule through the UI or API [2].
• If you need the same clause applied to multiple (but not all) datasources, you can list multiple tables in that field.
• RLS clauses also support Jinja2 templates if you need dynamic values (e.g., {{ current_username() }}).

If the rule doesn't seem to be working as expected, double-check that the table you selected in the RLS configuration matches the exact datasource used by the chart you want filtered.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[srijani-smsrc]

i am using quest token , and i am embedding the the dashboard as whole , somehow the rls rule applies to all the datasources where the clause in valid

@dosu

[dosubot[bot]]

This is expected behavior with guest tokens. Guest token RLS works differently from the RLS rules configured in the Security menu — it uses a dataset field (not tables) to scope rules to specific datasources.

The key issue: if you don't specify a dataset in your guest token RLS rule, the clause applies to ALL datasources where the column exists [1]. Here's the relevant logic:

def get_guest_rls_filters(self, dataset):
    return [
        rule for rule in guest_user.rls
        if not rule.get("dataset") or str(rule.get("dataset")) == str(dataset.id)
    ]

Rules with dataset set to null or omitted pass the not rule.get("dataset") check and get applied globally.

To fix this, you need to specify the dataset ID in your guest token RLS payload:

{
  "rls": [
    {
      "clause": "RPM_FOR_NAME='COMPANY_NAME'",
      "dataset": 42
    }
  ]
}

Where 42 is the numeric ID of the specific dataset you want the rule applied to. You can find dataset IDs via the Superset API (/api/v1/dataset/) or in the URL when viewing the dataset in the UI.

This will ensure the RLS clause only filters queries against that one dataset, leaving other datasources on the dashboard unaffected [2].

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[FrancescoCastaldi]

In Superset, the guest token Row Level Security payload does not use a "tables" array. Instead, the backend security manager matches RLS rules against the specific dataset using the "dataset" key.

You can inspect the exact matching logic in superset/security/manager.py inside get_guest_rls_filters:

# From superset/security/manager.py
if guest_user := self.get_current_guest_user_if_guest():
    return [
        rule
        for rule in guest_user.rls
        if not rule.get("dataset")
        or str(rule.get("dataset")) == str(dataset.data["id"])
    ]

How to Target a Specific Dataset in the Guest Token

To apply an RLS rule exclusively to one datasource in an embedded dashboard with multiple charts, provide the numeric dataset ID:

{
  "user": {
    "username": "guest_user",
    "first_name": "Guest",
    "last_name": "User"
  },
  "resources": [
    {
      "type": "dashboard",
      "id": "YOUR_DASHBOARD_UUID"
    }
  ],
  "rls": [
    {
      "clause": "RPM_FOR_NAME = 'COMPANY_NAME'",
      "dataset": 42
    }
  ]
}

Key Rules:

1. Replace 42 with the actual integer ID of your dataset (you can find the ID in Superset under Data -> Datasets, listed in the ID column or in the URL /explore/?dataset_id=42).
2. If you omit the "dataset" property from an RLS rule, Superset applies the clause globally to all datasets in the dashboard.
3. If your dashboard has multiple datasources that each need different filters, include multiple rule objects in the "rls" array, each with its corresponding "dataset" ID.