How to Create a Role Restricted to a Specific Database?

[Jayen16]

I just updated the app to version 6.1.0 and explored the Groups feature. However, it still doesn't meet the requirement I need.

I'm looking for a way to create a role that is restricted to a specific database or schema, rather than being limited to a dataset only.

[dosubot[bot]]

Hi @Jayen16! I'm Dosu and I'm helping the Apache Superset team.

Superset supports database-level and schema-level access restrictions through the database_access and schema_access permissions, which can be assigned to custom roles. These are separate from dataset-level (datasource_access) permissions and follow a hierarchy: database_access grants access to everything in that database, while schema_access restricts to a specific schema [1].

To set this up:

1. Ensure permissions exist — Run superset init so that database_access and schema_access permission entries are created for your databases and schemas [2].
2. Create a custom role — Go to Security → List Roles → Add a new record. Give it a name like Finance_DB_Only.
3. Add the permission — In the role's Permissions field, search for:
   • database_access on [YourDatabase].(id:XX) to grant access to the entire database, or
   • schema_access on [YourDatabase].[your_schema] to restrict to a specific schema
4. Assign the role to users — Go to Security → List Users, edit the user, and add the custom role.

Important notes:

• Don't rely on built-in roles (Admin, Alpha, Gamma, sql_lab) for this — object-specific permissions like database_access and schema_access are never assigned to built-in roles during superset init [3].
• If you want users to have SQL Lab access restricted to a specific database, combine database_access with the sql_lab role permissions in your custom role [4].
• If you can't find the expected permissions when searching in the role editor, re-run superset init to synchronize them.

Would you like more details on combining this with SQL Lab access or Row-Level Security for finer-grained control?

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[Jayen16]

I tried entering schema_access on [YourDatabase].[YourSchema], but it doesn't appear as an available option.

[dosubot[bot]]

@Jayen16 schema_access permissions are dataset-driven — they only get created when at least one dataset from that schema is registered in Superset. Superset does not discover schemas directly from the database connection [1].

To make schema_access permissions appear:

1. Go to Datasets → + Dataset and register at least one table/dataset from the schema you want to restrict access to. The schema_access permission is automatically created when the dataset is saved [2].
2. After that, go back to Security → List Roles, edit your custom role, and search for schema_access — you should now see entries like schema_access on [YourDatabase].[YourSchema].

If you'd rather grant access to the entire database instead of a specific schema, you can use database_access permissions instead — those are created automatically for every database connection and should already be available in the dropdown. Just search for database_access on [YourDatabase].

One more thing to watch out for on v6.1.0: there's a known bug where schema names containing underscores are displayed with spaces in the role editor, which can make them hard to find when searching [3]. If your schema name has underscores, try searching with spaces instead.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[Jayen16]

aight, I had to scroll further down the permissions dropdown before it appeared. If you start by searching for it, it won't show up until you've scrolled further down the list.