Permission Control

[luckyliush]

Is it possible to restrict users to access only specified information, such as a database or a data table?
I used policies to restrict user permissions, but it did not achieve the desired effect. Although users cannot access certain databases, they can still see their existence on the web page.

[Prajwal214]

@luckyliush You can create a policy based on the tags and assign to the users to view data asset
https://docs.open-metadata.org/v1.4.x/how-to-guides/admin-guide/roles-policies/authorization#building-blocks-of-authorization-rules

[luckyliush]

Thank you for your reply
I configured the system according to the official website link you provided, but it did not achieve the expected effect.
First of all, I expect that accounts with different permissions should see different numbers of data tables on the tables page of data assets.
For example, can the function now be achieved that the admin account can see all tables of data assets, and accounts with less permissions cannot see all tables, rather than just being unable to access them but still being able to see them on the web page?

[Prajwal214]

To restrict users based on tags, you can create policies that control visibility and access to tables with specific tags.

1. Policy for Admin Users:

         "name": "AllowAdminView",
         "resource": "Table",
         "operation": "View",
         "effect": "Allow"

2. Policy for Non-Admin Users:

         "name": "DenyNonAdminViewSensitiveTags",
         "resource": "Table",
         "operation": "View",
         "condition": matchAnyTag:"tag.Sensitive"
         "effect": "Deny"

3. Assign Policies:

• Assign the AdminViewPolicy to the admin role.
• Assign the RestrictedViewPolicy to non-admin roles.
  This setup ensures that non-admin users will not be able to see tables tagged with "Sensitive", effectively hiding them from the tables page. Make Sure you are proving correct FQN for the tag in the policy.

[luckyliush]

Thank you for your reply. I have configured the policy according to your instructions and added the policy to a role. I assigned the role to a non-admin user, but the user can still see all the tables on the table page of the data asset, although he cannot access them. I have added the PII.Sensitive tag to some tables, hoping not to see them. Is there something wrong with my configuration?

[Prajwal214]

Can you verify the permission call, what all rules are applied to the user.

[Prajwal214]

Currently we don't hide the data asset from the User in Explore Tab, Search based RBAC will be part of OM v1.6 release.