topic Re: Need help implementing row-level security (RLS) with embedded analytics in Developer

Need help implementing row-level security (RLS) with embedded analytics

datavigilante — Thu, 14 Sep 2017 18:13:58 GMT

Hello all,

It looks like Microsoft just added some functionality to the GenerateToken API so that you can pass additional context for RLS as a part of your embed token:

https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-embedded-rls/

Does anyone happen to have a simple working example of this that they can share? I just want to pass one user, role and dataset, but I don't know how to determine the dataset ID.

Sorry, if this is a dumb question, but how do I determine what the id is for the dataset of my report?

thanks!

David

Re: Need help implementing row-level security (RLS) with embedded analytics

craigduffy — Thu, 14 Sep 2017 19:41:58 GMT

I had the same question. Just figured it out: Similar to getting the group Id. In your power bi portal, click on the app workspace. Then select the Datasets tab on top. Select the dataset that matches your report (or view Settings) then copy the guid from the url after /datasets/. Copy that to your code and that should do it.

Re: Need help implementing row-level security (RLS) with embedded analytics

datavigilante — Thu, 14 Sep 2017 20:01:54 GMT

That's awesome, thanks Craig.

If you have it working, would you mind sharing your GenerateToken API syntax?

I'm having trouble getting the code provided for the PowerBIEmbedded_AppOwnsData sample to work:

var generateTokenRequestParameters = new GenerateTokenRequest("View", null, identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: "username", roles: new List<string> { "roleA", "roleB" }, datasets: new List<string> { "datasetId" }) });

var tokenResponse = await client.Reports.GenerateTokenInGroupAsync("groupId", "reportId", generateTokenRequestParameters);

Like I said, I will only have one role and dataset. Also, I don't understand why groupID and reportID are in quotes.

thanks,

David

Re: Need help implementing row-level security (RLS) with embedded analytics

datavigilante — Mon, 18 Sep 2017 12:57:18 GMT

I think that where I am getting stuck is how to define the EffectiveIdentity object. In my code below, there is a squiggly line under it:

var generateTokenRequestParameters = new GenerateTokenRequest(
                    accessLevel:  "View", 
                    allowSaveAs: null, 
                    identities: new List<EffectiveIdentity> { new EffectiveIdentity(
                        username: "20", 
                        roles: new List<string> { "User" }, 
                        datasets: new List<string> { "07cf5f83-033d-4265-a9a0-5ba476cde601" }) });
var tokenResponse = await client.Reports.GenerateTokenInGroupAsync(GroupId, "a10024dd-907e-4c1c-baed-e12e0a896d6b", generateTokenRequestParameters);

thanks,

David

Re: Need help implementing row-level security (RLS) with embedded analytics

craigduffy — Sun, 01 Oct 2017 06:26:42 GMT

Sorry I didn't get notice earlier of your post. Here is my code that works:

var generateTokenRequestParameters = new GenerateTokenRequest(accessLevel: "view", identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: userId, roles: new List<string> { role }, datasets: new List<string> { DatasetId }) });

                var tokenResponse = await client.Reports.GenerateTokenInGroupAsync(GroupId, report.Id, generateTokenRequestParameters);

Obviously userId, role, DatasetId and GroupId are string variables. Make sure your role is setup in the Power BI workbook.