grafana - Grant access to dashboard with only one specific variable

Question

I got a dashboard, which contains some variables (in this case: category and URLs):

{
  "templating": {
    "list": [
      {
        "allValue": null,
        "current": {
          "selected": false,
          "text": "default",
          "value": "default"
        },
        "datasource": "Influx-SP",
        "definition": "",
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": null,
        "multi": false,
        "name": "category",
        "options": [],
        "query": "SHOW TAG VALUES WITH KEY = "category"",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "datasource": "Influx-SP",
        "definition": "",
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "group",
        "multi": false,
        "name": "group",
        "options": [],
        "query": "SHOW TAG VALUES WITH KEY = "group" WHERE "category" =~ /$category/",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "selected": false,
          "text": "_",
          "value": "_"
        },
        "datasource": "Influx-SP",
        "definition": "",
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": null,
        "multi": false,
        "name": "page",
        "options": [],
        "query": "SHOW TAG VALUES WITH KEY = "page" WHERE "group" =~ /$group/ AND "category" =~ /$category/",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "selected": false,
          "text": "chrome",
          "value": "chrome"
        },
        "datasource": "Influx-SP",
        "definition": "",
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": null,
        "multi": false,
        "name": "browser",
        "options": [],
        "query": "SHOW TAG VALUES WITH KEY = "browser" WHERE "group" =~ /$group/ AND "page"  =~ /$page/ AND "category" =~ /$category/",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "selected": false,
          "text": "native",
          "value": "native"
        },
        "datasource": "Influx-SP",
        "definition": "",
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": null,
        "multi": false,
        "name": "connectivity",
        "options": [],
        "query": "SHOW TAG VALUES WITH KEY = "connectivity" WHERE "group" =~ /$group/ AND "page"  =~ /$page/ AND "browser" =~ /$browser/ AND "category" =~ /$category/",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 0,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      }
    ]
  }
}

Now I'd like to allow users to see measurements of specific urls. At the moment, the field group shows all URLs and the user can see a list of all urls, no matter if he is supposed to see it or not (of course, this is because the query SHOW TAG VALUES WITH KEY = "group" WHERE "category" =~ /$category/ returns all entries).

So I'd like to get some best practices to solve this issue. Unfortunately the docs did not help me out :-(

question from:https://stackoverflow.com/questions/65847429/grant-access-to-dashboard-with-only-one-specific-variable

Answer 1

Grafana does not provide such functionality. The way we implement such cases is to configure user access per entity in some datasource (e.g. SQL) and then query it to show the user specific category/url/etc.

This configuration could be made based on user's email/login/id, which you can "grab" as a variable only in Grafana v7.1+:

• ${__user.id} is the ID of the current user
• ${__user.login} is the login handle of the current user
• ${__user.email} is the email for the current user

Reference: https://grafana.com/docs/grafana/latest/variables/variable-types/global-variables/#__user