Is it possible to have multiple tenants in Superset ?

[user1500177]

I have used some ids like say account id , customer id etc for diffrent tenants (and used RLS to filter them out , so that the charts do not show other persons data )

The thing is that i need to know whether is it possible to make sure that SOME charts which do not have any data against that CUSTOMER is actually not suppose to not show that Chart itself , is such a thing possible ?

[dosubot[bot]]

Yes, multi-tenancy is possible in Superset using Row-Level Security (RLS). You can create RLS rules with SQL WHERE clauses like customer_id = 'TENANT_A' and assign them to roles — each tenant's users inherit the appropriate filter, so they only see their own data [1].

For embedded deployments, you can also scope RLS via guest tokens:

{
  "rls": [
    { "clause": "account_id = '123'", "dataset": 42 }
  ]
}

Always include the dataset ID to prevent the clause from being applied globally [2].

Regarding hiding charts with no data for a tenant: Superset does not natively support conditionally hiding a chart when its query returns no results. If RLS filters out all rows for a particular customer, the chart will still appear on the dashboard but display an empty state (e.g., "No results"). There's no built-in "show chart only if data exists" toggle.

Workarounds:

1. Separate dashboards per tenant tier — create dashboard variants that only include the charts relevant to each tenant group.
2. Embedded-layer logic — if you're embedding Superset, your application can query data availability and dynamically control which dashboard/charts to embed.
3. SIP-221 (proposed) — a community proposal for serving different dashboard versions to different tenants via guest tokens, which would help solve this more natively in the future [3].

For now, the most common pattern is to design charts that handle empty data gracefully, or maintain multiple dashboards tailored to different tenant profiles.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[user1500177]

Hi @dosu,

Lets say that there are like 20 dashboards, is there in anyway that it is possible for me to make sure that for specific CUSTOMERS , only specific dashboards are actually shown ? (DASHBOARD RBAC is the only way of doing it by mapping the user to specific role right ? )

I had also enabled the RLS so that anyways one customer cannot see another customers data ; But now the thing is that some specific customer might not need to see some dashboards (as anyways they would not have any data)- so I NEED To make sure for those customers other DASHBOARDS itself are not visible. (If i have to implement such a feature any ideas on where or what i should be changing ? )

Currently what i had :

i have like a readonly role - which i map the users to (DASHBOARD RBAC was enabled and i like made sure that the only 2 or 3 dashboards are visible for that role) - [working : After enabling the DASHBOARD_RBAC what i did was like to , call the api endpoint to update the dashboards properties to append that role to - so that users mapped to the specific role can see that dashboard in the UI ]- but the thing is that this wont satisfy me from now onwards i need it to be like - when a specific customer is coming for him , lets say 3 dashboards are there only they must be shown - is there a way to do this ?

[dosubot[bot]]

Yes, DASHBOARD_RBAC is exactly the right mechanism for this, and it sounds like you're already on the right track. The key is to create per-customer roles rather than a single shared readonly role.

Here's the pattern:

1. Create a role per customer (e.g., customer_123_readonly, customer_456_readonly).
2. Assign each customer's users to their specific role.
3. Assign only the relevant dashboards to each customer's role via the dashboard API (updating the dashboard's roles property to include only that customer's role). When DASHBOARD_RBAC is enabled and a dashboard has roles assigned, only users holding a matching role can see it — and dashboards without that role simply won't appear for those users [1].
4. Combine with RLS — keep your existing RLS rules to enforce data isolation. The nice thing about DASHBOARD_RBAC is that role-holders also bypass per-datasource permission checks for charts on those dashboards, so you don't need to separately grant dataset access [1].

So instead of one readonly role mapped to all dashboards, you'd have:

• customer_A_role → dashboards 1, 2, 3
• customer_B_role → dashboards 1, 5
• customer_C_role → dashboards 2, 3, 7

Each customer only sees the dashboards assigned to their role.

If you need to automate this, you can script it via the REST API — the PUT /api/v1/dashboard/{id} endpoint accepts a roles field where you pass the role IDs. You're already doing something similar, so it's just a matter of creating granular per-customer roles instead of a single shared one.

No code changes to Superset itself are needed — this is achievable purely through configuration with DASHBOARD_RBAC + per-customer roles + RLS.

As @rusackas mentioned, multi-tenancy in open-source Superset is doable but non-trivial. The per-customer role approach works, but managing many roles at scale requires automation (scripting role creation, dashboard-role assignments, and RLS rules). If this becomes burdensome, that's one of the areas where Preset provides more out-of-the-box support.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[rusackas]

It's plausible, but there are a lot of intricacies and risks, and users/etc can be visible. It's possible on open source, but non-trivial. This is one of the early reasons we built Preset, to tackle this kind of thing "out of the box" ;)

[user1500177]

Hi @rusackas ,

My use case ,

We have users who can switch between different organizations. When a user is in a specific organization's context, they should not see reports from other organizations. For example, out of 100 dashboards, 99 might be common (available to all organizations), but 1 dashboard might be highly specific and must only be visible when the user is in "Organization A" context.

Essentially, I want users to see only the reports relevant to their active or selected Customer ID (YES ITS TRUE THAT WITH RLS ONLY THE DATA SPECIFIC to that customer_id use has selected would be visible in those dashboards even if we show he dashboard/ charts - I want there to be some privacy as lets say one user is in Customer A context he/she shouldnt be able to see other customers Reports RIGHT ? ).

I am currently using Superset version 6.0.0. Does the latest stable version (6.1.0 or later) of Superset have a out of the boxe to support this workflow? -IF not is the same thing in preset planned for sometime in the future relases - saw ENABLE_VIEWERS and some new flags which are being dicussed in the upcoming verison (would that be of use for me ? )

We had already implemented like a feature to switch between customer A and customer B context for RLS for the same user ; but all the dashboards are visible to the user now ; is there something in superset which could do this for me

can the groups , dasboard rbac , and adding users to these groups be of use for this purpose ?