Forum Discussion

Thomas_Eu's avatar
Thomas_Eu
Icon for Helper I rankHelper I
7 years ago
Solved

Problem with dynamic RLS (Many : Many)

Dear all,

 

I have a problem, applying a RLS with the Username.

 

I have a project List, from which I would only show a few projects, based on the entries in a user-file.

 

The data structure looks as follow:

 

As long as I create a Many : One connection (just one line per Manage in the dimension table), the solution is working fine.

 

But If I want to show an manager all projects of his OrgUnit, than I get into trouble. Than I get an Many : Many connection.

 

This type of connection IS working, if I apply an Slicer in the Report and manually select a email, to filter for (than only the projects for this Email are shown). 

 

But as soon, as I use it as an Dynamic-RLS-Connetor (Role -> Filter -> Email = username()), the manager can see all projects in the online-report.

 

I have no idea, what I should change and why it is working in Power Bi Desktop (in a slicer), but not in the Power Bi Service (when used for RLS).

 

Any ideas?

 

 

Best regards,

Thomas

  • Hello together,

     

    now coming back with the solution :)

     

    Fist:

    The way you all mentioned works. You can use a many:many connection with the RLS, IF you apply the Security-Filter AND IF you just use one of these connections. In case of an access through a many:many connection, just one "Both" filter (with Security) is allowed.

     

    My problem:

    As I had to access through 3 times a many:many connection (each Manager-Level), this Solution is not working.

     

    Solution:

    I had to build a new file, where each connection is in the same column (a level indicator has to be attached, to differentiate). Than I had to apply an left outer Join to add the emails. By this solution, I get a final table, where each project is connected to the managers multiple times. I can now use this new Table (filtered in both directions and using the security filter) as access-connection.

     

    Steps to do in Power Query:

     

    let Quelle = #"Projects",
    Unpivot = Table.UnpivotOtherColumns(Quelle, {"Project"}, "Attribut", "Wert"),
    #"Merge Level & Box" = Table.AddColumn(Unpivot, "Combination", each [Attribut] &" / "& [Wert]),
    #"Remove Other" = Table.SelectColumns(#"Merge Level & Box",{"Project", "Combination"})
    in #"Remove Other"

     

    let Quelle = #"User",
    #"Hinzugefügte benutzerdefinierte Spalte" = Table.AddColumn(Quelle, "Combination", each if Text.End([OrgBox],1) <> "0" then "L3-Level / " & [OrgBox] else if Text.End([OrgBox],3) <> "0.0" then "L2-Level / " & [OrgBox] else "L1-Level / " & [OrgBox]),
    #"Andere entfernte Spalten" = Table.SelectColumns(#"Hinzugefügte benutzerdefinierte Spalte",{"User", "Combination"})
    in #"Andere entfernte Spalten"

     

    let Quelle = Table.NestedJoin(#"Access-Conection Projects", {"Combination"}, #"Access-Connection User", {"Combination"}, "Access-Connection User", JoinKind.LeftOuter),
    #"Connect by LeftOuterJoin" = Table.ExpandTableColumn(Quelle, "Access-Connection User", {"User"}, {"EMail"})
    in #"Connect by LeftOuterJoin"

     

    I attached the final pbix-File, as it is easier to understand within the file: https://drive.google.com/file/d/1iCS-fbpR4614Xk8IvEPO6zZqStEr17Uh/view?usp=sharing

     

12 Replies

  • RobbeVL's avatar
    RobbeVL
    Icon for Impactful Individual rankImpactful Individual

    Hi there,

     

    Seems like you will need another Unit dimension. (unique Unit values)

    Create another dimension between the many to many tables (you will need to set connection to both, in order to filter corrrectly)

     

    Hope this helps

    Robbe

    • Thomas_Eu's avatar
      Thomas_Eu
      Icon for Helper I rankHelper I

      Just to clarify: 

       

      A) Dimension-Table <-Both-> Only unique Unit ->Single-> Data-Table

      B) Dimension-Table ->Single-> Only unique Unit <-Both-> Data-Table

      C) Dimension-Table <-Both-> Only unique Unit <-Both-> Data-Table

       

      Old New Question

       

      Which is the correct solution?

      • RobbeVL's avatar
        RobbeVL
        Icon for Impactful Individual rankImpactful Individual

        Before you're edit I was going to say, A for sure.
        After I would still stick with A :)  and tick the box "apply security filter in both directions" (under rel. type)

         

        Let me know if this works.

         

        Robbe

  • v-juanli-msft's avatar
    v-juanli-msft
    Icon for Community Support rankCommunity Support

    Hi Thomas_Eu 

    Please note the difference:

    Within Power BI Desktop, username() returns a user in the format of DOMAIN\User and userprincipalname() returns a user in the format of [email protected].

     

    Also, when publishing to Power BI Service, please assign roles to users as below

    https://docs.microsoft.com/en-us/power-bi/service-admin-rls#validating-the-role-within-the-power-bi-service

     

    I make a simple sample with Power BI Desktop as below:

    sample data

    Manage role

    View role

    Best Regards
    Maggie

     

    Community Support Team _ Maggie Li
    If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

    • Thomas_Eu's avatar
      Thomas_Eu
      Icon for Helper I rankHelper I

      Hello