Incubator-superset: Give users the rights to change their password

[lilila]

What access should I add to allow users to change their password? I checked, Alpha and Gamma users get an "access denied" when clicking on the Profile Icon (upper right corner next to version info icon).

Only Admin role is allowed to change its password

Make sure these boxes are checked before submitting your issue - thank you!

• [x] I have checked the superset logs for python stacktraces and included it here as text if any
• [x] I have reproduced the issue with at least the latest released version of superset
• [x] I have checked the issue tracker for the same issue and I haven't found one similar

Superset version

0.18.0-alpha.1

Expected results

Actual results

Steps to reproduce

[stevekaeser]

I was able to work around this issue by creating a separate role that has these permissions:

can this form post on ResetMyPasswordView,
can this form get on ResetMyPasswordView,
can this form post on UserInfoEditView,
can this form get on UserInfoEditView,
resetmypassword on UserDBModelView,
can edit on UserDBModelView,
can userinfo on UserDBModelView,
userinfoedit on UserDBModelView

Then I added that role to all the non-admin users which allowed them to view/edit their profile and change their own passwords.

[mistercrunch]

@stevekaeser doesn't can edit on UserDBModelView give them the right to edit everyone else's too?

[guillaumewibaux]

I am not sure but I am afraid there is a mismatch between ResetMyPasswordView and ResetPasswordView. With the defaults Gamma and Alpha roles, it's not possible to access the user info page (profile page) nor see the reset password button on this page. Maybe it's been fixed in later releases but I haven't found any issue on the matter.

I was able to grant access to the profile and reset password pages only by granting permission sthat are more supposed to be admin permissions and yes you can change other user passwords then...
E.g: resetPasswordView (get + post) is necessary to see the rest button on the profile page...

[muraiki]

One workaround is to grant a role only the can this form post on ResetMyPasswordView and can this form get on ResetMyPasswordView permissions, then have the users manually go to your Superset URL + /resetmypassword/form to reset their password.

Using the Network developer tool in Firefox, I verified that only the password (and a CSRF token) is sent in the POST request -- there's no user ID, so this doesn't appear to open a way to reset other users' passwords.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[muraiki]

Please don't close this issue, as I think it makes using Superset more difficult for users.

[Giuzzilla]

It's possible to make them see their own profile + see the password change button + allowing them to change their own password without allowing can edit on UserDBModelView or related to ResetPasswordView, by enabling only these permissions:

can this form post on ResetMyPasswordView,
can this form get on ResetMyPasswordView, 
can userinfo on UserDBModelView, 
resetmypassword on UserDBModelView

Is there anything that I'm missing or a potential security issue with these enabled?

[willbarrett]

@Giuzzilla those permissions should be safe enough to enable.

[andrewmusselman]

I have a role with these permissions but the /resetmypassword/form URL 404s.

can this form post on ResetMyPasswordView,
can this form get on ResetMyPasswordView, 
can userinfo on UserDBModelView, 
resetmypassword on UserDBModelView

Can anyone help get a password reset?