AD group name gets changed when adding Row Level Security

SilentM — Fri, 15 Dec 2023 16:00:37 GMT

I have created a dashbaord that is meant to only show the data for the current logged in user. I followed the directions at Row-level security (RLS) in Power BI Report Server - Power BI | Microsoft Learn to set up Row Level Security to accomplish it and it works when I explicitly add a users username as a member on the Report Server.

The issue I am running into is when I try to add one of our AD groups as a member, the name of the group gets an extra space added to it after it is added. I have tried multiple times typing it correctly and have double checked that it is the correct name in AD, but every time I save it the extra space is added. If I try to add the correctly typed group name while the group with an extra space is in the list, it errors out and says that something went wrong. Since the name has the extra space in it, it doesn't show a user their data on the dashboard if they are in the group.

For example, I'll type in the AD group (not the actual group but same structure): "IT-GROUP-Name" and when it saves it is changed to "IT-GROUP- Name". There is an extra space added after the second dash.

Any ideas?

Thank you

Re: AD group name gets changed when adding Row Level Security

sarada — Wed, 08 May 2024 06:11:39 GMT

That is strange!!
Try to use script to add the AD group to RLS. here is powershell script you can use to update it.

$ReportServerUri = "https://<server_name>/PBIReports
#API to get roles and role assignments
$RoleAssignmentsPath = $ReportServerUri + "/api/v2.0/PowerBIReports(Path='<ReportPath>')/DataModelRoleAssignments"
$RolesPath = $ReportServerUri + "/api/v2.0/PowerBIReports(Path='<ReportPath>')/DataModelRoles"

#call API - row level security
$RoleAssignments = Invoke-RestMethod -Uri $RoleAssignmentsPath -ContentType "application/json" -UseDefaultCredentials -Method Get
#call API - RLS role
$Roles = Invoke-RestMethod -Uri $RolesPath -ContentType "application/json" -UseDefaultCredentials -Method Get

#Get roleId
$RoleId = $Roles.value[0].ModelRoleId

$NewRoleAssignments = @( [pscustomobject]@{GroupUserName='<ADGroupName>';DataModelRoles=@($RoleId)} )

$RoleAssignmentsResult = $RoleAssignments.value + $NewRoleAssignments

$RoleAssignmentsjson = $RoleAssignmentsResult | ConvertTo-Json

Invoke-RestMethod -Uri $RoleAssignmentsPath -ContentType "application/json" -Body $RoleAssignmentsjson -UseDefaultCredentials -Method Put

note that in above script if your report is in root folder of PBIRS portal then <ReportPath> is /report_name

hope this fix your issue!

topic AD group name gets changed when adding Row Level Security in Report Server

AD group name gets changed when adding Row Level Security

Re: AD group name gets changed when adding Row Level Security