Forum Discussion
Row Level Security to customized authentication
I have an instance of PBIRS on premises (May 2020). I implemented my own authentication and authorization libraries implementing IAuthenticationExtension and IAuthorizationExtension.
I created a principal name called "everyone" allowing permissions to all users in the CheckAccess methods.
When I go to a report with RLS anyways it doesn't work and I get the following log
Exception of type 'Microsoft.PowerBI.ReportServer.WebApi.ASConnection.RlsNotAuthorizedForModelException' was thrown
Do I have to do something more? Is permission check for RLS different from the other ones?
Yes, checks for RLS are different since those are not server permissions. We don't have in our custom authentication interfaces the ability to determine if a user is part of a group, so group roles are unsupported with custom auth. Feel free to post this int he ideas forum to help the team prioritize the ask: https://ideas.powerbi.com/
Thanks
-Boreki
3 Replies
Yes, checks for RLS are different since those are not server permissions. We don't have in our custom authentication interfaces the ability to determine if a user is part of a group, so group roles are unsupported with custom auth. Feel free to post this int he ideas forum to help the team prioritize the ask: https://ideas.powerbi.com/
Thanks
-Boreki
Anonymous
Even though this is about custom auth, it seems that even with Basic it's not working. When we add a group to a role, a new login window popup comes up when someone in that group opens the report and it doesn't accept the 100% sure valid credentials (user/pwd). Works fine if we add specifically the user himself and not through the group. So can we say currently it's not possible to put groups into RLS roles, only users? If this is not supported, why is this even possible?
Why the docs says that you should be able to do this? https://docs.microsoft.com/en-us/power-bi/report-server/row-level-security-report-server
"Enter the user or group in the text box in the Username format (DOMAIN\user) and select the roles you wish to assign to them. The member has to be within your organization."
Are you sure it's working at all? If yes, any recommendations what could be the problem? What should we look for?
