topic Dynamic Row Based Security in Report Server

Dynamic Row Based Security

Anonymous — Tue, 10 Oct 2017 14:50:32 GMT

I have been following THIS article on how to setup row based security using passed through credentials.

I have two identical (duplicates) tables: Employee, and EmployeeSecurity that consist of the following columns:

ContactID
SupervisorID
EmployeeNumber
FirstName
MiddleName
LastName
ActiveDirectoryUserName

I have a relationship setup between EmployeeSecurity.SupervisorID to Employee.ContactID.

I currently have a Role setup on the tabulear model that contains these to tables or dimensions with read access.

The Row Filter I am using could probably use some fixing but I'm not sure where:

=Employee[SupervisorID]=LOOKUPVALUE(EmployeeSecurity[SupervisorID],EmployeeSecurity[ActiveDirectoryUserName],USERNAME())

I am trying to make it so employees can see their supervisors, and/or supervisors can see their employees. I'm hoping someone sees either what is wrong with my DAX or maybe I'm going about settin up the relationship incorrectly.

This is just for functionality practice to prove Dynamic Row Based Security will work for us.

Re: Dynamic Row Based Security

v-yulgu-msft — Thu, 12 Oct 2017 08:22:56 GMT

Hi Anonymous,

According to above tutorial, your DAX filter formula should be:

 =Employee[SupervisorID]=LOOKUPVALUE(EmployeeSecurity[SupervisorID],EmployeeSecurity[ActiveDirectoryUserName],USERNAME(), EmployeeSecurity[SupervisorID], Employee[SupervisorID])

Regards,
Yuliana Gu

Re: Dynamic Row Based Security

Anonymous — Thu, 12 Oct 2017 15:09:58 GMT

Thanks for the response v-yulgu-msft.

I'm wondering if the problem might be a few things together. Possibly the created relationship with filter direction and a poor understanding of the LOOKUPVALUE DAX.

With the changes you suggested the user received no data. I altered the DAX to:

=Employee[ContactID]=LOOKUPVALUE(EmployeeSecurity[ContactID],EmployeeSecurity[ActiveDirectoryUserName],USERNAME(), EmployeeSecurity[SupervisorID], Employee[SupervisorID])

And now the user sees SOME data but not his/her own records.

Does anyone have experiance with this, and if so do you have any documentation, examples I can look at?