topic Re: Accessing a secure REST API with a dynamic URL in Service

Accessing a secure REST API with a dynamic URL

Anonymous — Tue, 10 Nov 2020 14:05:51 GMT

We have an api that looks a bit like this https://ourapi.com/stores/[STOREID]/customers. We want to secure the api against Azure AD. All our reports users are in our Azure AD. We have a "Role" defined per store and we use that for Row Level security in the report.

I am not very familiar with PowerBI but it looks like I could add the API as a "Web" DataSource and then break the API url down into parts with the STOREID being a seperate part. It looks like I should be able to populate the STOREID part with a parameter.

1. Is it correct to use Web data source and Url parts with parameters?
2. Assuming it is correct to use parameters with a web data source how do I get the report user's defined store into that paramater?
3. When the call to the API is made how do we ensure it is an authenticated call?

Re: Accessing a secure REST API with a dynamic URL

V-lianl-msft — Thu, 12 Nov 2020 06:19:52 GMT

Hi Anonymous ,

To get started, you need to connect to your API from Power BI Desktop to start building your queries.

Users can get data by inputting parameters through template application in service, but RLS cannot be applied in service.

https://docs.microsoft.com/en-us/power-bi/connect-data/service-template-apps-create

Another method is to apply dynamic RLS in a report with the whole dataset.

https://radacad.com/dynamic-row-level-security-with-power-bi-made-simple

Best Regards,
Liang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Re: Accessing a secure REST API with a dynamic URL

Anonymous — Mon, 04 Jan 2021 14:01:08 GMT

Sorry I has taken me so long to reply to this. We are a small team doing multiple jobs.

I need to better understand what I believe are two options you have suggested

1. Apply dynamic RLS in a report with the whole dataset. If I undertsand this correctly this would mean our API would return a reponse with customer data across stores and then we would rely on PowerBI to filter data using RLS. Is that a correct understanding?

2. Create a "template application" that would allow users to change parts of the api service URL via paramaters? IS that a correct understanding?

Assuming I have understood both your suggested options then neither work for us. Option 1 is exposing data to too wide and audience via a REST APi just so we can have the client (PowerBI) "secure" that access with filtering

Option 2 doesn't work either because it is relying on users changing the URL with a template application. I don't know much about template applicatons but it seems like a big change when all I want to do is call a REST api and WITHIN the REST api know the AzureAd identity of the report user. Note I am not trying to apply PowerBI's RLS within our API but I do want to get at the calling user's identity.

Is this not possible?

We need the