diff --git a/docs/troubleshooting-guide/index.md b/docs/troubleshooting-guide/index.md index 3329a808aa1136dc982792d9deeb3352032a2749..98270ce270d939716ad9ac85f85f0065dabbac83 100644 --- a/docs/troubleshooting-guide/index.md +++ b/docs/troubleshooting-guide/index.md @@ -6,39 +6,48 @@ This page collects resources for getting you unstuck. Problems, their causes, how to detect them, and how to fix them. -### Using Metabase +### Installation -- [People can't log in to Metabase][login]. +- [Running the Metabase JAR][running]. -- [Saving questions or dashboards][proxies]. +- [Running Metabase on Docker][docker]. -- [My dashboard is slow][slow-dashboard]. +- [Using or migrating from an H2 application database][appdb]. -- [My dashboard filters don't work][filters]. +### Authentication -- [My dashboard's linked filters don't work][linked-filters]. +- [Setting up LDAP][ldap]. -### Setup and administration +- [People can't log in to Metabase][login]. -- [Running the Metabase JAR][running]. +### Permissions +- [Fixing permissions issues][permissions]. -- [Running Metabase on Docker][docker]. +- [Managing data sandboxing][sandbox]. + +### Data Sources - [Connecting to data warehouses with Metabase][datawarehouse]. -- [Setting up LDAP][ldap]. +- [I can't see my tables][cant-see-tables]. -- [Metabase isn't sending email][not-sending-email]. +- [Fixing missing or out-of-sync tables and columns][sync-fingerprint-scan]. -- [Using or migrating from an H2 application database][appdb]. +### Questions and dashboards + +- [Saving questions or dashboards][proxies]. + +- [My dashboard is slow][slow-dashboard]. - [The dates and times in my questions and charts are wrong][incorrect-times]. -- [I can't see my tables][cant-see-tables]. +- [My dashboard filters don't work][filters]. -- [Managing data sandboxing][sandbox]. +- [My dashboard's linked filters don't work][linked-filters]. -- [Fixing missing or out-of-sync tables and columns][sync-fingerprint-scan]. +### Email and alerts + +- [Metabase isn't sending email][not-sending-email]. ## Think you found a bug? @@ -91,6 +100,7 @@ Metabase adds new features and squashes bugs with each release. [Upgrading to th [linked-filters]: ./linked-filters.html [login]: ./cant-log-in.html [not-sending-email]: ./cant-send-email.html +[permissions]: ./permissions.html [proxies]: ./proxies.html [releases]: https://github.com/metabase/metabase/releases [running]: ./running.html diff --git a/docs/troubleshooting-guide/permissions.md b/docs/troubleshooting-guide/permissions.md new file mode 100644 index 0000000000000000000000000000000000000000..06f0d0759831accf3876f08fec621ae9d946072e --- /dev/null +++ b/docs/troubleshooting-guide/permissions.md @@ -0,0 +1,63 @@ +# Fixing permissions issues +This troubleshooting guide has you covered if you've [connected your database][connecting-database] to Metabase, set up [groups][groups] for new people, and granted [data permissions][data-permissions] and [collection permissions][setting-collection-permissions] to those groups, but: + + - [A person in multiple groups can access a table that you want to restrict](#a-person-in-multiple-groups-can-access-a-table-that-you-want-to-restrict) + - [A person who needs to access the SQL editor can't](#a-person-who-needs-to-access-the-sql-editor-cant) + - [A person can view collections that reference data you want to restrict](#a-person-can-view-collections-that-reference-data-you-want-to-restrict) + +## A person in multiple groups can access a table that you want to restrict + +**Root cause:** This person is a member of multiple [groups][groups], in which case Metabase grants the *most permissive* level of access across all the groups in which they're a member. + +If they're a member of two groups — one which grants [Unrestricted][unrestricted] access to a database or table and another that grants [No self-service][no-self-service] access — that person will have full unrestricted access. + +**Steps to take:** + +1. In the **People tab** of the **Admin Panel**, take a look at which groups the person is in. +2. Either remove the person from the group with wider permissions, or adjust that group's data permissions to grant them no-self service access to the table you want restricted. + +Remember that everyone is a member of the **All Users** group; this is why we recommend you revoke permissions from the **All users** group, and create new groups to selectively apply permissions to your data sources. + +## A person who needs to access the SQL editor can't + +**Root cause:** The person currently has either **No self-service** or [Granular][granular] access to a database. To give someone access to the [native SQL editor][native-query-editing], you must grant **Unrestricted** access to the database as a whole. + +**Steps to take**: + +1. In the **Admin Panel**'s **Permissions tab**, change the group's permissions to **Unrestricted** at the database level. + +## A person can view collections that reference data you want to restrict + +{% include plans-blockquote.html %} + +**Root cause:** Since Metabase operates with two types of permissions — data permissions and collection permissions — even if you've granted a user group no self-service access to a database or table, they can still view saved questions and dashboards that draw on that database, as long as those questions and dashboards live in a collection they have access to. Unless a user group's access to a given database is set to “block," they’ll be able to view any saved question based on that data if they have access to the collection it’s saved in. + +**Steps to take:** + +1. If you're running [Metabase Pro or Enterprise Edition](https://www.metabase.com/pricing), you can block group access to an entire database. This means that if you've blocked a group's access to a database, members of that group will not ever seen any data from this database, regardless of their permissions at the Collection level. +2. In the **Admin Panel**'s **Permissions tab**, change data permissions for your user group to **Block** and save your changes. +3. Using an incognito window, log in as the person in question to confirm that they can no longer view saved questions or dashboards that include information from the blocked database. + +Keep in mind that if a person belongs to another group that does have data access, that setting will take precedence, and their access will not be blocked. + +## Further reading + +- [Setting permissions in Metabase][admin-permissions]. +- [Collection permissions][collection-permissions]. +- [Permissions track][learn-permissions] in Learn Metabase. +- [Troubleshooting data sandboxing][sandboxing]. + +[admin-permissions]: ../administration-guide/05-setting-permissions.html +[collection-permissions]: ../administration-guide/06-collections.html +[connecting-database]: ../administration-guide/01-managing-databases.html +[data-browser]: /learn/getting-started/data-browser.html +[data-model]: ../administration-guide/03-metadata-editing.html +[data-permissions]: ../administration-guide/data-permissions.html +[granular]: ../administration-guide/data-permissions.html#granular-access +[groups]: ../administration-guide/05-setting-permissions.html#groups +[learn-permissions]: /learn/permissions/index.html +[native-query-editing]: ../administration-guide/data-permissions.html#native-query-editing +[no-self-service]: ../administration-guide/data-permissions.html#no-self-service-access +[sandboxing]: ./sandboxing.html +[setting-collection-permissions]: ../administration-guide/06-collections.html#setting-permissions-for-collections +[unrestricted]: ../administration-guide/data-permissions.html#unrestricted-access