Restrict access to data uploaded by a user to only that one user

[Fremdkoerper]

Hello,

is there a way to restrict access to data uploaded by a user to only that one user? I configured excel/csv-Upload possibility with permissions "Can Upload Database" and "schema access [Upload-DB.schema]". This results in the behavior: Every user can access any data any other user uploads. Is there a possibility to restrict the access only to the one person who did upload the data herself?

[dosubot[bot]]

Hi @Fremdkoerper! I'm Dosu and I'm helping the Apache Superset team.

Not while everyone retains schema access [Upload-DB.schema]: that permission grants access to all datasets in that schema. Making the uploader the dataset owner does not override other users’ schema-level grants. [1] [2]

For private uploads, a practical approach is one upload schema per user, with a custom role granting access only to that user’s schema. Keep can upload on Database, but remove the shared-schema grant and ensure their other roles do not grant broader database, catalog or all-datasource access. Those broader permissions would defeat the isolation. [1]

Also restrict where they can upload, not just what they can read. Superset provides ALLOWED_USER_CSV_SCHEMA_FUNC(database, user) in superset_config.py to calculate allowed upload schemas per user. You can have it return only that user’s pre-created schema. Its result is added to the database’s schemas_allowed_for_file_upload list, so do not leave everyone’s private schemas in that shared list. The upload validator checks the resulting allowlist. [3] [4] [5]

This isolates ordinary users from one another, not from Superset administrators. [6]

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.