Forum Discussion
Problem with dynamic RLS (Many : Many)
Dear all,
I have a problem, applying a RLS with the Username.
I have a project List, from which I would only show a few projects, based on the entries in a user-file.
The data structure looks as follow:
As long as I create a Many : One connection (just one line per Manage in the dimension table), the solution is working fine.
But If I want to show an manager all projects of his OrgUnit, than I get into trouble. Than I get an Many : Many connection.
This type of connection IS working, if I apply an Slicer in the Report and manually select a email, to filter for (than only the projects for this Email are shown).
But as soon, as I use it as an Dynamic-RLS-Connetor (Role -> Filter -> Email = username()), the manager can see all projects in the online-report.
I have no idea, what I should change and why it is working in Power Bi Desktop (in a slicer), but not in the Power Bi Service (when used for RLS).
Any ideas?
Best regards,
Thomas
Hello together,
now coming back with the solution :)
Fist:
The way you all mentioned works. You can use a many:many connection with the RLS, IF you apply the Security-Filter AND IF you just use one of these connections. In case of an access through a many:many connection, just one "Both" filter (with Security) is allowed.
My problem:
As I had to access through 3 times a many:many connection (each Manager-Level), this Solution is not working.
Solution:
I had to build a new file, where each connection is in the same column (a level indicator has to be attached, to differentiate). Than I had to apply an left outer Join to add the emails. By this solution, I get a final table, where each project is connected to the managers multiple times. I can now use this new Table (filtered in both directions and using the security filter) as access-connection.
Steps to do in Power Query:
let Quelle = #"Projects",
Unpivot = Table.UnpivotOtherColumns(Quelle, {"Project"}, "Attribut", "Wert"),
#"Merge Level & Box" = Table.AddColumn(Unpivot, "Combination", each [Attribut] &" / "& [Wert]),
#"Remove Other" = Table.SelectColumns(#"Merge Level & Box",{"Project", "Combination"})
in #"Remove Other"let Quelle = #"User",
#"Hinzugefügte benutzerdefinierte Spalte" = Table.AddColumn(Quelle, "Combination", each if Text.End([OrgBox],1) <> "0" then "L3-Level / " & [OrgBox] else if Text.End([OrgBox],3) <> "0.0" then "L2-Level / " & [OrgBox] else "L1-Level / " & [OrgBox]),
#"Andere entfernte Spalten" = Table.SelectColumns(#"Hinzugefügte benutzerdefinierte Spalte",{"User", "Combination"})
in #"Andere entfernte Spalten"let Quelle = Table.NestedJoin(#"Access-Conection Projects", {"Combination"}, #"Access-Connection User", {"Combination"}, "Access-Connection User", JoinKind.LeftOuter),
#"Connect by LeftOuterJoin" = Table.ExpandTableColumn(Quelle, "Access-Connection User", {"User"}, {"EMail"})
in #"Connect by LeftOuterJoin"I attached the final pbix-File, as it is easier to understand within the file: https://drive.google.com/file/d/1iCS-fbpR4614Xk8IvEPO6zZqStEr17Uh/view?usp=sharing
12 Replies
- RobbeVL
Impactful Individual
Hi there,
Seems like you will need another Unit dimension. (unique Unit values)
Create another dimension between the many to many tables (you will need to set connection to both, in order to filter corrrectly)
Hope this helps
Robbe
- Thomas_Eu
Helper I
Just to clarify:
A) Dimension-Table <-Both-> Only unique Unit ->Single-> Data-Table
B) Dimension-Table ->Single-> Only unique Unit <-Both-> Data-Table
C) Dimension-Table <-Both-> Only unique Unit <-Both-> Data-Table
Old New Question
Which is the correct solution?
- RobbeVL
Impactful Individual
Before you're edit I was going to say, A for sure.
After I would still stick with A :) and tick the box "apply security filter in both directions" (under rel. type)Let me know if this works.
Robbe
- v-juanli-msft
Community Support
Hi Thomas_Eu
Please note the difference:
Within Power BI Desktop, username() returns a user in the format of DOMAIN\User and userprincipalname() returns a user in the format of [email protected].
Also, when publishing to Power BI Service, please assign roles to users as below
I make a simple sample with Power BI Desktop as below:
sample data
Manage role
View role
Best Regards
MaggieCommunity Support Team _ Maggie Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.- Thomas_Eu
Helper I
Hello v-juanli-msft,
your example is my green example (show all projects of an manager). This was working before and is no problem.
My problem is the red example, whrere a manager schould see all projects of his department (we do have more than one Project manager within a department, but all should see all projects). In this case, I cannoct connect by the Manager, but I have to connect by the OrgBox.
If I do so, it works, if I use it as an filter, but it des not work in RLS.
For the moment I used a Workaround and added 30+ Roles and assigned each Manager tio a single role.
- v-juanli-msft
Community Support
Hi Thomas_Eu
You could check this article, it should be useful
https://radacad.com/dynamic-row-level-security-with-manager-level-access-in-power-bi
Best Regards
MaggieCommunity Support Team _ Maggie Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.