Skip to content

[auto-build] manual-backport-of-docs -> release-x.56.x #396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
14 changes: 7 additions & 7 deletions _docs/v0.56/permissions/row-and-column-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ redirect_from:

{% include plans-blockquote.html feature="Row and column security" %}

Row and column security lets you give granular permissions to rows and columns for different groups of people. You can change what data a group [can view](./data#can-view-data-permission), as well as what data a group [can query](./data#create-queries-permissions) with the query builder.
Row and column security lets you give granular permissions for different groups of people. You can change what data a group [can view](./data#can-view-data-permission), as well as what data a group [can query](./data#create-queries-permissions) with the query builder.

You can use row and column security to set up [self-service analytics](/learn/metabase-basics/embedding/multi-tenant-self-service-analytics), so that each of your customers can only view the rows that match their customer ID. For example, if you have an Accounts table with information about your customers, you can add permissions to the table so that each customer only sees the data relevant to them.

Expand All @@ -38,7 +38,7 @@ You can define up to one row and column security policy for each table/group com
Row and column security show specific data to each person based on their [user attributes](../people-and-groups/managing#adding-a-user-attribute). You can:

- [Restrict **rows**](#row-level-security-filter-by-a-column-in-the-table)
- [Restrict **columns**](#custom-row-and-column-security-use-a-saved-question-to-create-a-custom-view-of-a-table) (as well as rows) for specific people.
- [Restrict **columns** and rows](#custom-row-and-column-security-use-a-saved-question-to-create-a-custom-view-of-a-table) for specific people.

| Goal | Row (filter by a column in the table) | Custom (use a saved SQL question) |
| ---------------------------------------------- | ------------------------------------- | --------------------------------- |
Expand All @@ -56,9 +56,9 @@ For example, you can filter the Accounts table for a group so that:
- A person with the user attribute value "Basic" will see rows where `Plan = "Basic"` (rows where the Plan column matches the value "Basic").
- A person with the user attribute value "Premium" will see the rows where `Plan = "Premium"` (rows where the Plan column matches the value "Premium").

### Custom row and column security: use a saved question to create a custom "view" of a table
### Custom row and column security: use a SQL question to create a custom "view" of a table

To **restrict rows _and_ columns**, you can use a saved question to filter the table. When someone views that table, they'll instead see the question's results, not the raw table.
To **restrict rows _and_ columns**, you can use a SQL question to filter the table. When someone views that table, they'll instead see the question's results, not the raw table.

For example, say your original Accounts table includes the columns: `ID`, `Email`, `Plan`, and `Created At`. If you want to hide the Email column, you can create a "Restricted Accounts" SQL question with the columns: `ID`, `Plan`, and `Created At`.

Expand All @@ -75,7 +75,7 @@ You can use a question to filter tables to:

Row security displays a filtered table, in place of an original table, to a specific group. How Metabase filters that table depends on the value in each person's user attribute.

For example, you can set up a row security so that:
For example, you can set up a row-level security so that:

- Someone with the user attribute with key of "plan" and a value of "Basic" will see a version of the Accounts table with a filter for `Plan = "Basic"` (that is, only the rows where the Plan column matches the value "Basic").
- Someone with a "plan" user attribute set to "Premium" will see a different version of the Accounts table with the filter `Plan = "Premium"` applied.
Expand Down Expand Up @@ -244,7 +244,7 @@ To prevent the Email column from being exposed via a SQL question:

### Public sharing

Row and column security permissions don't apply to public questions or public dashboards. If somone in an unsecured group person creates a public link using an original table, the original table will be displayed to anyone who has the public link URL.
Row and column security permissions don't apply to public questions or public dashboards. If somone in an unsecured group creates a public link using an original table, the original table will be displayed to anyone who has the public link URL.

To prevent this from happening, you'll have to [disable public sharing](../embedding/public-links) for your Metabase.

Expand All @@ -256,7 +256,7 @@ Row and column security is limited to questions built with the [query builder](.

### Groups with native query permissions (access to the SQL editor) can bypass row and column security

You can't set up [query builder and native](./data#create-queries-permissions) for groups with row and column security.
You can't set up [native query persmissons](./data#create-queries-permissions) for groups with row and column security.

To enforce row-level permissions with the native query editor, check out [impersonation](./impersonation).

Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
14 changes: 7 additions & 7 deletions _site/docs/v0.56/permissions/row-and-column-security.html
Original file line number Diff line number Diff line change
Expand Up @@ -4861,7 +4861,7 @@ <h1 id="row-and-column-security">Row and column security</h1>
</div>
</div>

<p>Row and column security lets you give granular permissions to rows and columns for different groups of people. You can change what data a group <a href="./data#can-view-data-permission">can view</a>, as well as what data a group <a href="./data#create-queries-permissions">can query</a> with the query builder.</p>
<p>Row and column security lets you give granular permissions for different groups of people. You can change what data a group <a href="./data#can-view-data-permission">can view</a>, as well as what data a group <a href="./data#create-queries-permissions">can query</a> with the query builder.</p>

<p>You can use row and column security to set up <a href="/learn/metabase-basics/embedding/multi-tenant-self-service-analytics">self-service analytics</a>, so that each of your customers can only view the rows that match their customer ID. For example, if you have an Accounts table with information about your customers, you can add permissions to the table so that each customer only sees the data relevant to them.</p>

Expand All @@ -4886,7 +4886,7 @@ <h2 id="types-of-row-and-column-security">Types of row and column security</h2>

<ul>
<li><a href="#row-level-security-filter-by-a-column-in-the-table">Restrict <strong>rows</strong></a></li>
<li><a href="#custom-row-and-column-security-use-a-saved-question-to-create-a-custom-view-of-a-table">Restrict <strong>columns</strong></a> (as well as rows) for specific people.</li>
<li><a href="#custom-row-and-column-security-use-a-saved-question-to-create-a-custom-view-of-a-table">Restrict <strong>columns</strong> and rows</a> for specific people.</li>
</ul>

<table>
Expand Down Expand Up @@ -4932,9 +4932,9 @@ <h3 id="row-level-security-filter-by-a-column-in-the-table">Row-level security:
<li>A person with the user attribute value “Premium” will see the rows where <code class="language-plaintext highlighter-rouge">Plan = "Premium"</code> (rows where the Plan column matches the value “Premium”).</li>
</ul>

<h3 id="custom-row-and-column-security-use-a-saved-question-to-create-a-custom-view-of-a-table">Custom row and column security: use a saved question to create a custom “view” of a table</h3>
<h3 id="custom-row-and-column-security-use-a-sql-question-to-create-a-custom-view-of-a-table">Custom row and column security: use a SQL question to create a custom “view” of a table</h3>

<p>To <strong>restrict rows <em>and</em> columns</strong>, you can use a saved question to filter the table. When someone views that table, they’ll instead see the question’s results, not the raw table.</p>
<p>To <strong>restrict rows <em>and</em> columns</strong>, you can use a SQL question to filter the table. When someone views that table, they’ll instead see the question’s results, not the raw table.</p>

<p>For example, say your original Accounts table includes the columns: <code class="language-plaintext highlighter-rouge">ID</code>, <code class="language-plaintext highlighter-rouge">Email</code>, <code class="language-plaintext highlighter-rouge">Plan</code>, and <code class="language-plaintext highlighter-rouge">Created At</code>. If you want to hide the Email column, you can create a “Restricted Accounts” SQL question with the columns: <code class="language-plaintext highlighter-rouge">ID</code>, <code class="language-plaintext highlighter-rouge">Plan</code>, and <code class="language-plaintext highlighter-rouge">Created At</code>.</p>

Expand All @@ -4955,7 +4955,7 @@ <h2 id="prerequisites-for-row-security">Prerequisites for row security</h2>

<p>Row security displays a filtered table, in place of an original table, to a specific group. How Metabase filters that table depends on the value in each person’s user attribute.</p>

<p>For example, you can set up a row security so that:</p>
<p>For example, you can set up a row-level security so that:</p>

<ul>
<li>Someone with the user attribute with key of “plan” and a value of “Basic” will see a version of the Accounts table with a filter for <code class="language-plaintext highlighter-rouge">Plan = "Basic"</code> (that is, only the rows where the Plan column matches the value “Basic”).</li>
Expand Down Expand Up @@ -5149,7 +5149,7 @@ <h3 id="you-cannot-secure-the-rows-or-columns-of-sql-results">You cannot secure

<h3 id="public-sharing">Public sharing</h3>

<p>Row and column security permissions don’t apply to public questions or public dashboards. If somone in an unsecured group person creates a public link using an original table, the original table will be displayed to anyone who has the public link URL.</p>
<p>Row and column security permissions don’t apply to public questions or public dashboards. If somone in an unsecured group creates a public link using an original table, the original table will be displayed to anyone who has the public link URL.</p>

<p>To prevent this from happening, you’ll have to <a href="../embedding/public-links">disable public sharing</a> for your Metabase.</p>

Expand All @@ -5161,7 +5161,7 @@ <h2 id="limitations">Limitations</h2>

<h3 id="groups-with-native-query-permissions-access-to-the-sql-editor-can-bypass-row-and-column-security">Groups with native query permissions (access to the SQL editor) can bypass row and column security</h3>

<p>You can’t set up <a href="./data#create-queries-permissions">query builder and native</a> for groups with row and column security.</p>
<p>You can’t set up <a href="./data#create-queries-permissions">native query persmissons</a> for groups with row and column security.</p>

<p>To enforce row-level permissions with the native query editor, check out <a href="./impersonation">impersonation</a>.</p>

Expand Down