Access control, administration & portability — found from sitemap — Metabase

Cited by

Facts read from this source

• Impersonation plan availability Report an error

  “Impersonation access is only available on Pro and Enterprise plans (both self-hosted and on Metabase Cloud).”

• Impersonation definition Report an error

  “Impersonation access allows admins to “outsource” View data permissions to roles in your database. Admins can associate user attributes with database-defined roles and their privileges.”

• Impersonation supported databases Report an error

  “For now, impersonation access is only available for the following databases: ClickHouse MySQL PostgreSQL. If you’re using views in PostgreSQL, the row-level security policies on views will only work on Postgres versions 15 and higher. Redshift Snowflake SQL Server Starburst/Trino.”

• Impersonation sql scope Report an error

  “Impersonation sets permissions for questions written in both the SQL editor and the query builder”

• Row column security scope Report an error

  “Row and column security only sets permissions for query builder questions”

• Redshift superuser requirement Report an error

  “For Redshift databases, the user account Metabase uses to connect to your Redshift database must be a superuser, as Metabase will need to be able to run the SET SESSION AUTHORIZATION command, which can only be run by a database superuser.”

• Snowflake secondary roles Report an error

  “For impersonation to work correctly with Snowflake databases, the user account Metabase uses to connect to your Snowflake database must have secondary roles disabled.”

• Impersonation user attribute Report an error

  “The value of the attribute must match the desired database role for every person.”

• Impersonation admins exempt Report an error

  “Connection impersonation doesn’t apply to people in the Metabase Admins group, as their more permissive privileges take precedence.”

• Impersonation single select Report an error

  “When people with impersonated access use the native SQL editor, they will only be able to write queries with a single select statement.”

• Impersonation large literal limit Report an error

  “A query with a very large literal list written directly in the SQL—a VALUES clause, IN list, or ARRAY literal with more than 2,000 rows or items—can’t be validated, so Metabase rejects it rather than run something it can’t check.”

• Impersonation most permissive override Report an error

  “Metabase gives people the most permissive access to data across all of their groups”

• Impersonation all users warning Report an error

  “If your All Users group has more permissive access to this database (for example, “Can view”), you will see a warning, because Metabase gives people the most permissive access to data across all of their groups. You’ll need to block database access for the All Users group before setting up impersonation.”

• Impersonation slack notifications Report an error

  “People in groups with impersonation access cannot create Slack alerts or dashboard subscriptions. Email alerts and subscriptions are still available.”

• Impersonation row level sql Report an error

  “You can use impersonation to give people access to the SQL editor, while restricting their access to data based on a specific database role.”

• Impersonation mechanism Report an error

  “Essentially what Metabase will do is take the user attribute and pass that attribute as a string into a SET ROLE or USE ROLE command for the database before Metabase executes the query.”

• Impersonation verification Report an error

  “Admins will not be able to verify that impersonation is working from their own account, so you should create a test user, add them to the group and set up their user attributes.”

• Impersonation group attribute key Report an error

  “People in one group can have different attribute values, but must have the same attribute key.”

• Impersonation default connection role Report an error

  “Impersonation uses database roles to run queries on your database, but there still needs to be a default role that will be used to run operations like sync, scans, and fingerprinting.”

• Database routing mention Report an error

  “If you want to switch database connections based on who is logged in, check out Database routing.”

Scores citing this record

• The Data Analyst Access control, administration & portability
• The Finance Controller Access control, administration & portability
• The IT Administrator Sharing, scheduled reports & embedding
• The IT Administrator Access control, administration & portability
• The Managing Director Access control, administration & portability
• The SaaS Product Lead Access control, administration & portability
• The Skeptic Access control, administration & portability