Forum Discussion

raju8004212's avatar
raju8004212
Frequent Visitor
1 year ago
Solved

Dynamic Row level security

Hi Anonymous  dynamic swithcing of rls is  based on slicer selection rls logic working with out selection if we  include slicer selection  in rls its not wrking  my model is like bu_org ,snap co...
Need Help
  • Anonymous's avatar
    Anonymous
    1 year ago

    Hi raju8004212 ,
    To clarify it isn’t possible to pass slicer values or variables into RLS. Power BI always applies     RLS first (based on user identity), and only afterwards slicers/filters.

    That means a “toggle RLS by slicer” design isn’t supported. The only supported approaches are:

    Dynamic RLS using USERPRINCIPALNAME()  and a security mapping table.

    Report-level toggles (disconnected slicer + measures/filters) to switch between PU/HR views within the user’s authorized data.

    Separate roles/reports if different security contexts are mandatory.

    So the workarounds I shared earlier will help you simulate the toggle experience, but the true RLS logic can’t be driven by slicers.

MohamedFowzan1's avatar
MohamedFowzan1
Icon for Super User rankSuper User
1 year ago

Hi raju8004212 

How about doing this with a disconnected table instead:

Type
PU
HR


Now you can use this as the slicer

For bu_org:

IF (
    SELECTEDVALUE('RLS_Type_Switch'[Type]) = "PU",
    WC_BU_ORG_DH[PU_VALUE] IN 
        CALCULATETABLE(
            VALUES(Union_table[ANCESTOR_KEY]),
            FILTER(
                Union_table,
                UPPER(Union_table[EMAIL_ADDRESS]) = UPPER(USERPRINCIPALNAME())
            )
        ),
    TRUE()
)

 
For Snap_D:

IF (
    SELECTEDVALUE('RLS_Type_Switch'[Type]) = "HR",
    WC_EMPLOYEE_snap_D[ANCESTOR_KEY] IN 
        CALCULATETABLE(
            VALUES(Union_table[ANCESTOR_KEY]),
            FILTER(
                Union_table,
                UPPER(Union_table[EMAIL_ADDRESS]) = UPPER(USERPRINCIPALNAME())
            )
        ),
    TRUE()
)
  • raju8004212's avatar
    raju8004212
    Frequent Visitor
    1 year ago

    Hi MohamedFowzan1 

     

    I'm not able to pass slicer values into rls whether it's a disconnected/ same table that's main problem I tried that as well it's not  working thanks for checking I'm really looking for some help here to identify a way to make it working.

     

     

    • MohamedFowzan1's avatar
      MohamedFowzan1
      Icon for Super User rankSuper User
      1 year ago

      I did some digging, and it looks like there’s no direct way to have a slicer function like that in conjunction with RLS. The only possible approach would be a workaround without using any RLS, but that would be purely for user experience and not enforce any real security.

      In terms of RLS, the proper method is still to define distinct roles and apply the appropriate filters based on user condition essentially assigning users to the roles that match their access requirements.