Hi all, I’m Editor role on Datahub tool. But, sometimes I got the under error when I edit description of a column. I’m using v0.10.3. Do you have any suggestion for me to investigate the issue, here?

Hi- could you confirm what permission you have with editor role? You should have

Edit descriptions

policy for the specific data entity.

Yeah, the user is assigned Editor role. It is a role has available in Datahub (same as Admin and Reader). I can see on document about description for this role:

Can read and edit all metadata. Cannot take administrative actions.

And this issue occasionally happen. Most of the time I have permission to change the description of the column, a few times I got this error.

That is very strange - does it occur to a specific data source? Could you confirm that there’s no policy that override this?

Most of time, It’s happen on BigQuery Datasource. I only use default role of Datahub on my deployment.

Not that I know of, I’ll forward to this to our product team just in case. (cc. @bulky-soccer-26729 tagging you FYI)

Yeah, any suggestion for me. It can enable debug to help to investigate this issue.

🤔 Okay, not really sure what’s happening here. we’ll get back to you shortly.

Thank @delightful-ram-75848 😆

Hi! Do you have Rest API Authorization enabled or any other non-default auth settings?

Hi @orange-night-91387, This is my config on chart for Auth. The rest of config, I only use default value of chart.

# OIDC auth based on <https://datahubproject.io/docs/authentication/guides/sso/configure-oidc-react>
  oidcAuthentication:
    enabled: true
    provider: google
    clientId: <http://305580188801-8k63np6egb0tt4s39qkv3ir3c4u04f9g.apps.googleusercontent.com|305580188801-8k63np6egb0tt4s39qkv3ir3c4u04f9g.apps.googleusercontent.com>
    clientSecret: SECRET
    # only needed if you would like to store the client secret in secret
    # clientSecretRef:
    #   secretRef: <secret-ref>
    #   secretKey: <secret-key>
    # only needed if provider is `okta`
    # oktaDomain: <http://datahub.dwh.company.co|datahub.dwh.company.co>

    # only needed if provider is `azure`
    # azureTenantId: your-azure-tenant-id
    # if needed, it should set meaningful defaults from provider
    scope: "openid profile email"

    extraEnvs:
    - name: AUTH_JAAS_ENABLED
      value: "false"
    # # AUTH_OIDC
    # - name: AUTH_OIDC_ENABLED
    #   value: "true"
    # - name: AUTH_OIDC_CLIENT_ID
    #   value: "<http://305580188801-8k63np6egb0tt4s39qkv3ir3helmc4u04f9g.apps.googleusercontent.com|305580188801-8k63np6egb0tt4s39qkv3ir3helmc4u04f9g.apps.googleusercontent.com>"
    # - name: AUTH_OIDC_CLIENT_SECRET
    #   value: "SECRET"
    # - name: AUTH_OIDC_DISCOVERY_URI
    #   value: "<https://accounts.google.com/.well-known/openid-configuration>"
    # - name: AUTH_OIDC_BASE_URL
    #   value: "<https://datahub.dwh.company.co>"
    # - name: AUTH_OIDC_SCOPE
    #   value: "openid profile email"
    # - name: AUTH_OIDC_USER_NAME_CLAIM
    #   value: "email"
    # - name: AUTH_OIDC_USER_NAME_CLAIM_REGEX
    #   value: "([^@]+)"