Public Role Configuration

Public Role Configuration#

The Public role in Superset is the Flask-AppBuilder (FAB) role automatically assigned to unauthenticated (anonymous) users. Its permission/view pairs (PVMs) determine what anonymous visitors can access — most critically, whether they can view dashboards via permalink URLs.

How the Public Role Gets Its Permissions#

The Public role ships with no permissions by default . The standard way to populate it is the PUBLIC_ROLE_LIKE config key in superset_config.py:

PUBLIC_ROLE_LIKE = "Gamma"

When sync_role_definitions() runs (triggered by superset init), it calls copy_role() with merge=True to copy all PVMs from the named role into Public. The Gamma role is the recommended baseline for anonymous dashboard viewing .

Important: PUBLIC_ROLE_LIKE only copies structural permissions (view access, model CRUD rights). It does not grant access to specific datasets — those must be added to the Public role manually .

PVMs Required for Dashboard Permalink Access#

The full anonymous dashboard permalink flow involves two layers: the browser redirect route (/dashboard/p/<key>/) and the underlying REST APIs. Each layer requires specific PVMs.

The following table lists the PVMs that must be present on the Public role, derived from the Gamma role permissions in STANDARD_ROLES.md:

Permission / View	Why it's needed
`can dashboard permalink` on `Superset`	The `/dashboard/p/<key>/` route is protected by `@has_access`; FAB derives this PVM name from the method name.
`can read` on `DashboardPermalinkRestApi`	The frontend calls `GET /api/v1/dashboard/permalink/<key>` to resolve permalink state; the API's GET method maps to `read` .
`can write` on `DashboardPermalinkRestApi`	Required to create permalinks via `POST /api/v1/dashboard/<pk>/permalink`; not needed for anonymous viewing, but Gamma (and therefore Public via `PUBLIC_ROLE_LIKE`) includes it .
`can read` on `Dashboard`	Authorization checks verify that the requesting user has read access to the target dashboard .
`can read` on `Chart`	The explore/chart access path explicitly verifies `can_read` on `Chart` .
`can read` on `Dataset`	Dataset metadata is fetched during chart rendering; Gamma includes this permission .
`can read` on `Explore`	Required for explore-view rendering of individual charts within a dashboard .
`can read` on `ExplorePermalinkRestApi`	Needed if the permalink resolves through an explore permalink .
`can read` / `can write` on `DashboardFilterStateRestApi`	Needed for filter state persistence (embedded in Gamma; ).
`can read` on `SecurityRestApi`	FAB infrastructure used during auth checks .
`can csrf token` on `Superset`	Required for API calls from the frontend .
Dataset-level data source access	Specific to each dashboard's underlying data; granted manually on the Public role .

All non-datasource entries above are granted to Gamma and therefore propagate to Public when PUBLIC_ROLE_LIKE = "Gamma" is set .

Step-by-Step Setup#

Add to superset_config.py:
```
PUBLIC_ROLE_LIKE = "Gamma"
```
Run superset init (or restart) to sync the role definitions via sync_role_definitions().
Grant dataset access: In the Superset UI under Security → List Roles → Public, add each dataset/data source that anonymous users need to query .
Verify: Navigate to a dashboard permalink URL as a logged-out user.

Key Source Files#

File	Purpose
`superset/config.py`	`PUBLIC_ROLE_LIKE` config key definition and comment
`superset/security/manager.py`	`sync_role_definitions()` and `copy_role()` implementation
`superset/views/core.py`	`dashboard_permalink` view with `@has_access`
`superset/dashboards/permalink/api.py`	`DashboardPermalinkRestApi` — GET/POST permission mappings
`superset/explore/permalink/api.py`	`ExplorePermalinkRestApi` — GET/POST permission mappings
`RESOURCES/STANDARD_ROLES.md`	Full PVM matrix for Admin, Alpha, Gamma, SQL_LAB roles
`docs/docs/security/security.mdx`	Public role documentation and `PUBLIC_ROLE_LIKE` usage