Blank Pages for Users, Groups, Roles when copy Permissions

[OliverW87]

Bug description

I would like to implement a new Role to manage Users & Groups. After testing restricted to just required permission I got a blank page for "List Users" or "List Groups". So for some tests I just go to "List Roles" Copy the Admin Role to a new one named "User Manager" and not remove a permission.

When I assign a user to this new Role and User logged in also see a blank Page at "List Users" or "List Groups"...

Screenshots/recordings

No response

Superset version

6.0.0

Python version

3.10

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

Hi @OliverW87! I'm Dosu and I’m helping the superset team.

This is a known limitation — user, role, and group management views in Superset are hardcoded to require the Admin role specifically, not just the Admin role's permissions. Simply copying Admin permissions to a new role won't work because the backend checks for isAdmin status rather than individual granular permissions like can_list_users or can_list_roles [1] [2].

This was discussed in detail in #37938, where a maintainer confirmed the restriction is intentional and enforced in both backend and frontend code. The frontend conditionally renders management pages based on admin status, which is why you see blank pages — the permission checks pass at the API level but the UI doesn't render.

Additionally, if you're using MySQL/MariaDB, there's a separate database case-sensitivity bug that can also cause blank security pages. You can check and fix it with [3]:

UPDATE ab_view_menu SET name='Security' WHERE name='security';

Also make sure FAB_ADD_SECURITY_API = True is set in your config and run superset init afterward [4].

To achieve what you want (a non-admin "User Manager" role), a code change would be needed to replace the isAdmin checks with permission-based checks in both the backend (SupersetSecurityManager) and frontend (UsersList, RolesList, route guards). This was suggested as a potential PR in #37938 [1].

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}