rusackas commented on code in PR #42951: URL: https://github.com/apache/superset/pull/42951#discussion_r3746759290
########## docs/admin_docs/security/security.mdx: ########## @@ -198,6 +198,51 @@ Available per-entity overrides are: When an override is set, it replaces `SUBJECTS_RELATED_TYPES` for that picker. When it is `None`, the picker inherits the global default. +#### Looking Up Subjects via API + +Superset exposes a read-only REST API for resolving subjects: + +``` +GET /api/v1/security/subject/ +``` + +The main use case is **id mapping** — given a user, role, or group id, callers (including +extensions) can look up the corresponding subject entity, and vice versa. Access is gated by +the `can_read` permission on the `Subject` resource, which is granted to **Admins only** by +default, since subjects enumerate every user, role, and group on the instance. Non-admins +receive a `403`. Only `GET` (list, get, info) is exposed — there is no create, update, or Review Comment: Good catch — reworded so the `403` is tied to lacking `can_read`, not admin status. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
