topic Re: RLS doesn't work with identities from embed token (don't filter the report data) in Developer

RLS doesn't work with identities from embed token (don't filter the report data)

jarek_blaszczyk — Thu, 14 Jun 2018 14:56:51 GMT

Hi,

I use Power BI Embedded for display the report in the web application.
I receive correct embed token passing in the request body identities, like (values are just examples)
{
"accessLevel": "view",
"identities": [{
"username": "my_user@my_company",
"roles": ["my_role"],
"datasets": ["aaaaaaaa-0000-cccc-eeee-77777777777"]
}]
}
The problem is that RLS filtering is not working. The report is diplayed, but contains all data connected to the master account, no to "my_user@my_company" and "my_role".

The client on Power BI desktop uses the same username and role and the data is filtered. Which is the problem?
May I decode in some way the token or analize / verify it?

Re: RLS doesn't work with identities from embed token (don't filter the report data)

TriPax — Fri, 15 Jun 2018 10:29:21 GMT

did you add this role also on the PBI report side?
you need to create some custom role called for example my_role with parameters

[column from your table with email] = username ()

Re: RLS doesn't work with identities from embed token (don't filter the report data)

jarek_blaszczyk — Fri, 15 Jun 2018 13:13:56 GMT

yes, we did it

Re: RLS doesn't work with identities from embed token (don't filter the report data)

TriPax — Fri, 15 Jun 2018 13:48:09 GMT

I'm using it at my app so it's look like that on the raport side

Then in the code I'm using

accessLevel: "view", identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: "exampleuser@company.com, roles: new List<string> { DynamicUser }, datasets: new List<string> { somedatasetid }) }

But I'm using .net app so it should be sth like this if we use hardcoded values

"accessLevel": "View", "identities": [ { "username": "exampleuser@company.com", "roles": [ "DynamicUser" ], "datasets": [ "somedatasetid" ] } ]

Re: RLS doesn't work with identities from embed token (don't filter the report data)

jarek_blaszczyk — Fri, 15 Jun 2018 13:56:34 GMT

thx, I do it exactly as you wrote (using Spring REST API)

Re: RLS doesn't work with identities from embed token (don't filter the report data)

TriPax — Fri, 15 Jun 2018 13:57:51 GMT

it is working ok now?

Re: RLS doesn't work with identities from embed token (don't filter the report data)

jarek_blaszczyk — Fri, 15 Jun 2018 13:59:06 GMT

Re: RLS doesn't work with identities from embed token (don't filter the report data)

TriPax — Fri, 15 Jun 2018 14:08:48 GMT

try to see this report as this sended user - open place when you have Roles button and on the right side we can also try to see report as an different user - if you add this username there report should be filtered

if it's not then format for username is different

if it's ok then we need to go deeper and see what you try to shoot to the server - you can for example download Embed-API-Sample-master application and modify it to use with your filters - then token what is generated can be used with js what show report at the webpage

Re: RLS doesn't work with identities from embed token (don't filter the report data)

jarek_blaszczyk — Fri, 15 Jun 2018 15:06:55 GMT

I think I know where is the problem. In some way there is built bad request using spring RestTemplate. Probably are some issues with formatting the json from object.
When I ues json generated in the postman, working correctly.
I will continue the work on Monday. Anyway thanks a lot for your help.

Re: RLS doesn't work with identities from embed token (don't filter the report data)

jarek_blaszczyk — Mon, 18 Jun 2018 14:02:17 GMT

Solved!
The issue was tha bad key in post json: "identitites" instead of "identities".
That bug was difficult to be discovered as the request gave back the correct response with the report token. But in the request body was taken only accessLevel and identities part has been ignored.