Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(chart): Enable caching per user when user impersonation is enabled #20114

Merged
merged 14 commits into from
Jun 21, 2022
Merged

feat(chart): Enable caching per user when user impersonation is enabled #20114

merged 14 commits into from
Jun 21, 2022

Conversation

Samira-El
Copy link
Contributor

@Samira-El Samira-El commented May 18, 2022

SUMMARY

In order to mitigate sensitive data leaking to less-privileged users when they load a cached dashboard/chart, this PR enables caching per user when a database has impersonation enabled.

In our setup, we delegate permissions to database (Snowflake via OAuth) and we don't want to create and maintain another layer of ACLs in Superset.

Discussion on this on slack.

This is an initial solution, happy to adjust it as per maintainers' feedback.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Peek 2022-05-19 12-20

TESTING INSTRUCTIONS

Run this in a setup where caching is enabled and there is a datasource that allows user impersonation.

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

@Samira-El Samira-El changed the title feat(chart/dashboard): Enable caching per user when impersonation is enabled feat(chart): Enable caching per user when impersonation is enabled May 19, 2022
@Samira-El Samira-El changed the title feat(chart): Enable caching per user when impersonation is enabled feat(chart): Enable caching per user when user impersonation is enabled May 19, 2022
@codecov
Copy link

codecov bot commented May 20, 2022

Codecov Report

Merging #20114 (01f0da1) into master (fa7f144) will decrease coverage by 0.15%.
The diff coverage is 60.00%.

@@            Coverage Diff             @@
##           master   #20114      +/-   ##
==========================================
- Coverage   66.70%   66.55%   -0.16%     
==========================================
  Files        1739     1724      -15     
  Lines       65136    64804     -332     
  Branches     6897     6822      -75     
==========================================
- Hits        43452    43132     -320     
- Misses      19931    19938       +7     
+ Partials     1753     1734      -19     
Flag Coverage Δ
hive 53.71% <60.00%> (+0.01%) ⬆️
mysql 82.28% <60.00%> (+<0.01%) ⬆️
postgres 82.35% <60.00%> (+<0.01%) ⬆️
presto 53.57% <60.00%> (+0.01%) ⬆️
python 82.78% <60.00%> (+<0.01%) ⬆️
sqlite 82.13% <60.00%> (+<0.01%) ⬆️
unit 50.54% <50.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
superset/common/query_context_factory.py 96.42% <ø> (ø)
superset/config.py 91.41% <ø> (ø)
superset/common/query_object.py 94.38% <50.00%> (-0.88%) ⬇️
superset/db_engine_specs/base.py 88.33% <75.00%> (-0.09%) ⬇️
...t-frontend/src/dashboard/containers/SliceAdder.jsx 0.00% <0.00%> (-100.00%) ⬇️
...et-frontend/src/dashboard/actions/sliceEntities.js 16.00% <0.00%> (-37.85%) ⬇️
superset-frontend/src/explore/store.js 58.33% <0.00%> (-33.34%) ⬇️
...rset-frontend/src/components/CachedLabel/index.tsx 50.00% <0.00%> (-33.34%) ⬇️
...nd/plugins/plugin-chart-table/src/controlPanel.tsx 16.66% <0.00%> (-26.82%) ⬇️
...ilters/FiltersConfigModal/FilterTitleContainer.tsx 57.14% <0.00%> (-22.27%) ⬇️
... and 158 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fa7f144...01f0da1. Read the comment docs.

Copy link
Member

@villebro villebro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for taking on this challenge @Samira-El ! I left some thoughts, let me know what you think.

superset/connectors/sqla/models.py Outdated Show resolved Hide resolved
@nytai
Copy link
Member

nytai commented May 20, 2022

Can we also add a config to disable this behavior? We have a use case where we would like user impersonation enabled for query tracing purposes and for access control in SQL Lab, but we would still like to keep a shared cache for charts/dashboards.

@Samira-El
Copy link
Contributor Author

Can we also add a config to disable this behavior? We have a use case where we would like user impersonation enabled for query tracing purposes and for access control in SQL Lab, but we would still like to keep a shared cache for charts/dashboards.

Hi ntai, sure no problem! :)

@pull-request-size pull-request-size bot added size/M and removed size/S labels May 25, 2022
@Samira-El
Copy link
Contributor Author

Bump @villebro @nytai

Copy link
Member

@betodealmeida betodealmeida left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great, sorry for the delay! I've had a ticket to fix this for a few months now, and I just started a PR yesterday. Glad to see this implementation!

I left a suggestion on how to pass the user object without having to query the DB, I think it makes the feature more useful in the future. Other than that, this looks great!

superset/common/query_object.py Outdated Show resolved Hide resolved
@Samira-El
Copy link
Contributor Author

Anything else required to merge this @villebro @nytai @betodealmeida ?

@betodealmeida
Copy link
Member

Taking a look, sorry for the delay!

Copy link
Member

@betodealmeida betodealmeida left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great! I'll merge once the tests finish.

@betodealmeida betodealmeida merged commit 68af598 into apache:master Jun 21, 2022
@villebro villebro added the v2.0 label Jun 21, 2022
@Samira-El Samira-El deleted the cache_per_user branch June 21, 2022 09:12
michael-s-molina pushed a commit that referenced this pull request Jun 23, 2022
…ed (#20114)

* add username to extra cache keys when impersonation is enabled.

* don't put effective_user in extra_cache_key

* get_impersonation_key method in engine_spec class  to construct an impersonation key

* pass datasource when creating query objects

* adding an impersonation key when construction cache key

* add feature flag to control caching per user

* revert changes

* make precommit and pylint happy

* pass a User instance

* remove unnecessary import

(cherry picked from commit 68af598)
@mistercrunch mistercrunch added 🍒 2.0.0 🍒 2.0.1 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 2.1.0 labels Mar 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels size/M v2.0 🍒 2.0.0 🍒 2.0.1 🚢 2.1.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants