topic Re: Forbidden error - while generating embed token with RLS and DirectQuery (SQL server) in Developer

Forbidden error - while generating embed token with RLS and DirectQuery (SQL server)

Anonymous — Fri, 23 Dec 2022 05:18:07 GMT

* We are trying to generate embed token for a powerbi document which was RLS enabled and DirectQuery based (SQL server).

We are using this below API to generate embed token

POST - https://api.powerbi.com/v1.0/myorg/groups/<groupId>/reports/<reportId>/generatetoken

Payload

{ "accessLevel": "View", "identities": [{ "username": "<email>", "roles": ["Custom Role"], "datasets": ["<id>"] }] }

Response:

1. If the powerbi report using import query with RLS, it provides embed token

2. If the powerbi report using DirectQuery with RLS, it throws 403 forbidden error.

Can you please help us to resolve?

Re: Forbidden error - while generating embed token with RLS and DirectQuery (SQL server)

Anonymous — Fri, 23 Dec 2022 07:41:24 GMT

Hi @Anonymous ,

I suggest you to try refer to this offical blog. There is an example about how to generate embed for direct query report.

For reference:

https://learn.microsoft.com/en-us/rest/api/power-bi/embed-token/generate-token#example-of-generating-an-embed-token-for-a-power-bi-report-with-a-dataset-which-is-connected-with-directquery-to-another-power-bi-dataset.-all-related-dataset-ids-must-be-specified-in-the-request-with-'xmlapermissions'-set-to-'readonly'.-identityblobs-for-all-sso-enabled-data-sources-must-be-provided-in-the-'datasourceidentities'-array

And you may refer to below blogs to learn more details about how to generate embed token.

For reference:

Generate an embed token

Embed a report with cloud-based RLS

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Re: Forbidden error - while generating embed token with RLS and DirectQuery (SQL server)

Anonymous — Fri, 23 Dec 2022 08:07:00 GMT

Hi @Anonymous

Thank you for your reply. In my powerbi document, we are not using azure SQL, we are using our own instance of SQL server.

I got below error

{ "error": { "code": "InvalidRequest", "message": "Datasource identity must contain identity blob" } }

But in the powerbi document, the description of the indentityBlob is like below

`A blob for specifying an identity. Only supported for datasets with a DirectQuery connection to Azure SQL`

In my case i am not using AZURE sql. Can you please help us here?

Re: Forbidden error - while generating embed token with RLS and DirectQuery (SQL server)

Anonymous — Tue, 27 Dec 2022 06:33:08 GMT

Hi @Anonymous

Can you please reply for my issue (my previous reply)?

Re: Forbidden error - while generating embed token with RLS and DirectQuery (SQL server)

AmosHersch — Tue, 27 Dec 2022 07:31:14 GMT

datasourceIdentities is only relevant when you have a data source with sso enabled. If you don't have such then you don't need to provide your data sources in the request. Just leave it empty

Re: Forbidden error - while generating embed token with RLS and DirectQuery (SQL server)

Anonymous — Tue, 27 Dec 2022 08:05:29 GMT

Hi @AmosHersch

Tried the `identityBlob` as empty string, but i got below error again

{ "error": { "code": "InvalidRequest", "message": "Datasource identity must contain identity blob" } }

Re: Forbidden error - while generating embed token with RLS and DirectQuery (SQL server)

AmosHersch — Tue, 27 Dec 2022 08:26:05 GMT

You shouldnt send datasourceIdentities array at all

Re: Forbidden error - while generating embed token with RLS and DirectQuery (SQL server)

Anonymous — Fri, 06 Jan 2023 06:08:15 GMT

Hi @Anonymous

Where can i find the identityBlob? What is Microsoft.PowerBI.ServiceContracts.Api.V1.IdentityBlob?

can you help me how to get identityBlob?

{ "error": { "code": "BadRequest", "message": "Bad Request", "details": [ { "message": "Error converting value \"eyJ__fQ.ey__NH0.kvW__FSjg\" to type 'Microsoft.PowerBI.ServiceContracts.Api.V1.IdentityBlob'. Path 'identities[0].identityBlob', line 30, position 1295.", "target": "request.identities[0].identityBlob" } ] } }