Forum Discussion
Row level security doesn't work when using 'Both' cross filter direction
We have issued a fix for this issue in the latest build 15.0.1102.235. Please upgrade to the latest build available.
Thanks,
Rohit
I'm seeing the same behavior as Anonymous. I've confirmed that the filter he's setup (using USERPRINCIPALNAME()) is correct, but irrelevant to the issue.
Removing the security filter on the relationship between Responsibilities and Cost Centres (and ensuring the proper UPN exists in the Responsibilities table) allows the upload to succeed. I can see the Responsibilities table filtered as expected, but then the other tables naturally aren't filtered.
We have issued a fix for this issue in the latest build 15.0.1102.235. Please upgrade to the latest build available.
Thanks,
Rohit
We are still encountering same error in Power BI Desktop Version: 2.76.5678.782 64-bit (December 2019)
Is this resolved? if yes the how.. please share the step(s).
Thanks
Hi Rohit
I just saw it. I'm busy updating now and will let you know how the test goes.
Thank you for the update.
Success! Thank you for the fix for this and the direct query issue. We were struggling to roll back and was going to restore from backup in order to roll back. Now we've just upgraded with the new patch and all is good (both direct query and security cross filtering).
Kind Regards,
Pieter
I just downloaded and installed the Febuary 2019 Power BI Desktop. I too am having an issue with RSL in my model and for the life of my cannot figure out what is going on. Let me describe the general model layout:
* Fact table (20 million rows) with with a dimension key value.
* Dimension table. Dimension Key is unique (as it should be)
* Security table which lists Users (username@domain) and the Dimension members (dimension key) to which they have access.
* One-to-Many relationship from Dimension table to Fact table, with SINGLE Cross Filter direction
* One-to-Many relationship from Dimension table to Security table, with BOTH Cross Filter direction AND checked the box for "Apply security filter in both directions"
* Security Role defined with the following DAX statement on the Security table: "[UserPrincipalName] = USERNAME()"
In theory, the Security table gets filtered via RLS and the USERNAME() function, and the BOTH Cross Filter direction then filters the Dimension table, which then filters the Fact table.
Now here's the issue: Facts are added (or more likely Dimension members are removed) in such a way that there are orphaned facts that list a Dimension Key that no longer exists. (not my choice for data integrity, but that's the case.)
In THEORY, those orphaned Facts should NOT show up for ANYONE governed by RLS in the Role.
In FACT (no pun intended) the orphaned records show up for EVERYBODY governed by RLS.
I removed Incremental Refresh from the fact table and refreshed it in its entirety, no change.
This is driving me nuts. It's like there is a BUG.
FYI: I moved my RLS DAX Expression to the Dimension table with the following:
CONTAINS (
'Security Table',
'Security Table'[Dimension Key],
USERNAME(),
'Security Table'[Dimension Key],
'Dimension Table'[Dimension Key]
)and that seems to have fixed it. But still, WHY would the Bi-directional filtering not work?
Any ideas would be appreciated.
rpatkar Microsoft had an issue with RLS the other day on their support page under Awareness:
Some customers may experience issues adding users to RLS roles on the RLS Security tab. As a potential workaround, customers can refresh the page and add the user. Engineers are working on a fix and expect it to be deployed to all regions by end-of-day 3/29/19.
RLS began working again on 3/26; however, as of yesterday, some of my users are getting the following message when trying to view a report where we had to check the "Apply security filter in both directions" box for one of our relationships:
“The user belongs to multiple roles that have security filters which isn't supported when one of the roles has filters affecting table with Security Filtering Behavior = Both relationships"
Has this always been the case, or did the “fix” from January come undone when they fixed the RLS on 3/26? Thanks!
hi Jody, can you please provide the link for the support page awareness text you are quoting from? Does it apply to the Service (aka powerbi.com) or the Server (aka PBIRS)? This thread has been about Server related issues. Thanks.
Thank you for the quick response. Here is the link: https://powerbi.microsoft.com/en-us/support/
It is the third item listed. My guess is that it is related to the Web Service, but I am not sure.
Only a precission, perhaps obvious :smileyhappy: It´s needed to update the version of POWER BI REPORT SERVER.
