Forum Discussion

chrisb_b's avatar
chrisb_b
New Member
20 days ago
Solved

Custom visuals not showing with Custom authentication

I have a PBIX that works fine in PBI Desktop and Report Server (both May 26).  It has a variety of Visualizations: built-in, downloaded from AppSource and one imported from a pbiviz.  It also works w...
custom authentication
Custom Visuals
Power BI Report Server
  • chrisb_b's avatar
    chrisb_b
    17 days ago

    jubinsoni​ 

    For you many thanks for pointing me the right way.  To anyone else stuck in the same hole:

    The answer is to add two more parameters onto the definition of the sqlAuthCookie in webconfig.config thus:

        <authentication mode="Forms">
      <forms loginUrl="logon.aspx" name="sqlAuthCookie" timeout="60" path="/" cookieSameSite="None" requireSSL="true">
      </forms>
    </authentication>

    and to add a line to mark the cookie secure in logon.aspx.cs in AllowInReader thus:

                    if (passwordVerified)
                {
                    HttpCookie cookie = FormsAuthentication.GetAuthCookie(sUserName, false);
                    cookie.Secure = true;

                    FormsAuthentication.RedirectFromLoginPage(
                        sUserName, false);
                }
                else
                {
                    this.BtnLogon.Text = "Failed";
                    Response.Redirect("logon.aspx");
                }

    I hope this saves someone else having to read as much contradictory Microsoft documentation as I had to!

    Chris

jubinsoni's avatar
jubinsoni
Icon for Memorable Member rankMemorable Member
20 days ago

Hi chrisb_b​,

Since built-in visuals render and only the custom ones disappear, my first suspect would be the extra requests custom visuals make. They are loaded separately from the report (the visual package is fetched and then run in a sandboxed iframe), so if those requests are not authenticated by your custom security extension, or are redirected to the logon page, the visual silently renders as blank while the rest of the report works.

How I would confirm it before rolling back:

1. Open the report, F12 > Network, filter on "visual" / "pbiviz" / "resource"
2. Look for requests that return 401, 403 or a 302 to your logon page
   (or HTML instead of JSON/JS)
3. F12 > Console: look for sandbox / CSP / "refused to load" errors

If the network trace shows auth failures for those calls, the fix is on the extension side: make sure the anonymous/forms cookie is accepted for those endpoints too, and that your CheckAccess implementation in the custom security sample grants the read operations for resources/items the report references, not just the report item itself. Changes in the newer release around how visual packages are requested would explain why it worked in May 25 and not May 26.

If instead you see CSP or sandbox errors, compare the rsreportserver.config / web.config between the two builds (an upgrade can reset custom changes), and test one AppSource visual in a brand-new report to rule out the specific .pbix.

Either way, capture the failing request URL and status from the trace; that is exactly what support or the docs team would need, and it tells you whether to fix the extension or wait for a fix.

So my overall approach would be:

F12 network trace: find the failing visual requests (401/302/HTML)
-> Extend custom auth / CheckAccess to cover those endpoints
-> CSP/sandbox errors instead: diff config files between May 25 and May 26
-> Report with the failing URL if the extension is not the cause

AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.