Forum Discussion

pmdci's avatar
pmdci
Advocate V
8 years ago
Solved

Sending external users as effective user ID

Hello,   I have noticed that a while ago, Microsoft has added the ability to add external users (that is, non-Windows accounts) into roles in SSAS tabular models, as per the screenshot below:   ...
Need Help
  • pmdci's avatar
    pmdci
    8 years ago

    I got it working!!! But I must I had to create a mapping in PowerBI.com. Here is what I did.

     

    1. Created a john_example.com#EXT#@mydomain.com account in my on-prem Active Directory. This would be the shadow account for user [email protected]
    2. In PowerBI.com I went to the data source in settings, and clicked on map user names in the users settings. I then aded a replacement rule to replace @example.com with the shadow account string.

    Boom! it worked :)

     

    Bottom line is that SSAS -- at least on-prem, does NOT support external user IDs. I had to create a shadow account in my Active Directory to which the user gets mapped into.

pmdci's avatar
pmdci
Advocate V
8 years ago

Here is a tought. Perhaps a little far fetched...

 

I wonder if the Power BI gteway automatically forwards external users in the taxonomy of their correspondent shadow account in the AD -- even if not the AD in Azure (that is, an AD on prem). So for example if I log-in as [email protected], it effectively forwards john_example.com#EXT#@mydomain.com. So I have created this account in my local AD and I have added it into a role in a test tabular model. I'll revert back on my tests later on.

 

If it does not, then we'll develop a solution around shadow accounts.

pmdci's avatar
pmdci
Advocate V
8 years ago

I got it working!!! But I must I had to create a mapping in PowerBI.com. Here is what I did.

 

  1. Created a john_example.com#EXT#@mydomain.com account in my on-prem Active Directory. This would be the shadow account for user [email protected]
  2. In PowerBI.com I went to the data source in settings, and clicked on map user names in the users settings. I then aded a replacement rule to replace @example.com with the shadow account string.

Boom! it worked :)

 

Bottom line is that SSAS -- at least on-prem, does NOT support external user IDs. I had to create a shadow account in my Active Directory to which the user gets mapped into.

  • Anonymous's avatar
    Anonymous
    Not applicable
    7 years ago

    Hi - does this only work for Analysis Services? Or can we map external users to SQL Server on-prem, too?

  • NirH_at_BITeam's avatar
    NirH_at_BITeam
    Frequent Visitor
    7 years ago

    Hi,

     

    Where is this mapping users reside. Can't seem to find it.

    Can you pls. be more specific on where to define this mapping.

     

    Thansk!

    NH