Anonymous Access Configuration#

Superset controls anonymous (unauthenticated) user access through two config keys and the superset init CLI command. The core idea: AUTH_ROLE_PUBLIC tells Flask-AppBuilder which role to assign to anonymous users, and PUBLIC_ROLE_LIKE populates that role's permissions by copying them from an existing built-in role.

Configuration Keys#

Both keys live in superset/config.py:

AUTH_ROLE_PUBLIC is a Flask-AppBuilder convention 1; PUBLIC_ROLE_LIKE is Superset-specific. Setting PUBLIC_ROLE_LIKE without running superset init has no effect — the sync only happens during initialization.

Important: PUBLIC_ROLE_LIKE grants view/action permissions, but explicit dataset grants are still required for anonymous users to query specific data 2.

How Anonymous Users Get Roles#

get_user_roles() in security/manager.py is the decision point: when user.is_anonymous is true, it checks whether AUTH_ROLE_PUBLIC is configured and returns [self.get_public_role()] if so — otherwise returns an empty list, meaning the user has no permissions at all.

How superset init Syncs the Public Role#

The init CLI command runs two operations in sequence:

1. appbuilder.add_permissions(update_perms=True) — registers all FAB view/action permission-view pairs (PVMs) in the database.
2. security_manager.sync_role_definitions() — rebuilds built-in roles and, if PUBLIC_ROLE_LIKE is set, syncs the Public role.

Inside sync_role_definitions():

1. Registers Superset-specific permissions via create_custom_permissions().
2. Rebuilds Admin, Alpha, Gamma, and sql_lab roles.
3. If PUBLIC_ROLE_LIKE is set, calls copy_role(PUBLIC_ROLE_LIKE, auth_role_public, merge=True).
4. Runs create_missing_perms() and clean_perms().

copy_role and the merge=True Behavior#

copy_role() copies all PVMs from the source role to the Public role. The merge=True flag is critical: it preserves any data access permissions (e.g. datasource_access, schema_access) already on the Public role, preventing superset init from wiping custom dataset grants made after initial setup.

Typical Setup for Anonymous Dashboard Access#

1. In superset_config.py:

   ⧉

   AUTH_ROLE_PUBLIC = "Public"
   PUBLIC_ROLE_LIKE = "Gamma"
   

2. Run superset init to sync the Public role's permissions from Gamma.

3. Grant the Public role explicit access to specific datasets via the Superset UI or API.

After each Superset upgrade or permission change, re-run superset init to keep the Public role in sync with the source built-in role.

Key Source Files#