GitHub user geovanasullivan created a discussion: 403 Forbidden on embedded
dashboard in production (worked fine in test), missing can read on
CurrentUserRestApi permission?
Hi everyone,
I've embedded a Superset dashboard into our internal site using the guest token
flow, and everything worked correctly in our test environment. However, when
deploying to production, the dashboard fails to load entirely and returns a 403
Forbidden error (the guest token is generated successfully, but the dashboard
itself does not render).
Environment:
Superset version: 6.0.0
FEATURE_FLAGS = {"EMBEDDED_SUPERSET": True} — configured
Guest role: Public (default GUEST_ROLE_NAME)
Service account used to request guest tokens has roles: Gamma + a custom role
with can_grant_guest_token
Logged in as Admin while troubleshooting
What I've already checked/tried:
Confirmed the dashboard's "Embed dashboard" settings include the production
domain in Allowed Domains
Confirmed resources: [{ type: "dashboard", id: DASHBOARD_UUID }] is correctly
passed when generating the guest token
Added datasource access permissions on all underlying datasets to both Public
and Gamma roles
Confirmed the dashboard's "Roles" field (Edit properties) includes both Public
and Gamma
Searched for the permission can read on CurrentUserRestApi, which other threads
mention as critical for embedded dashboards — this permission does not appear
anywhere in the Public/Gamma/Admin permission lists, even though I can see
plenty of other API-related permissions
My question:
Is can read on CurrentUserRestApi expected to exist by default in 6.0.0, or
could it have a different name in this version? If it genuinely doesn't exist
in 6.0.0, could that be causing this 403, or should I be looking elsewhere?
Any guidance would be greatly appreciated. Thanks!
GitHub link: https://github.com/apache/superset/discussions/42547
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
