Good morning, so I have been looking through the n...
# all-things-deployment
m
Good morning, so I have been looking through the new RBAC features and noticed that, although you can asign users different roles, they can all see all the datasets ingested into Datahub. Is there a possible way to determine who can be able to see certain datasets?? I am asking this because I think it is a key feature and don't know if it is implemented or not. Thanks in advance!!
e
Hi @microscopic-mechanic-13766, you are right that with the current iteration of RBAC, the simplest Role (Reader) can view all datasets
We are planning on building custom roles in the near future
In the meantime, I would recommend you use our Policy system
I know it’s not ideal, but let me know if you have any questions on how to set that up
m
But the policy system doesn't allow you to control what can be seen by other users, right?? I feel like that would be the most important thing I would like to learn to do, because I have looking through it I haven't been able to control that.
e
Actually you can!
For example, if we want to restrict the
View Entity Page
privilege by domain, we can set up a new policy that allows users to only have that privilege for a certain domain
m
I have actually tried that and I have been able to see the domain with a user that wasn't suposed to. I created one domain called "Test" to which I gave all the privileges to a user called userA. (Note that there are no policies but the default ones that can not be disabled and the policy giving userA all the privileges) Then, I tried to access to the "Test" domain with a user called userB, which has the role of reader. This user, was able to access and see all the datasets in said domain. (Note that the owner of the domain and some of the datasets contained in it is userA).