Configure Row Level Security with OR condition

[IoanaSluby]

Hi!

I have a main datasource which contains data about worklogs, grouped by month/year/project and employee, with these fields:

- Employee

- Project

- Month 

- Year

- Time in hours 

- Employee division

- Project Division

And one RLS tables with these fields:

- division (which can be either employee division or project division)

- User (email address)

The role that i created is based on the rule that User = USERPRINCIPALNAME()

How could I simulate an or condition so that for a specific user data could be displayed either when employee division = division from RLS or project division = division from RLS?

The relation between tables is many to many, a user can be assigned to multiple divisions.

[Anonymous · Accepted solution]

Hi,

You can apply RLS to the main table (WorkLogs) instead of the RLS table and check like this:

= CONTAINS('RLSTable', 'RLSTable'[User], USERPRINCIPALNAME(), 'RLSTable'[division], 'WorkLogs'[Employee division])

|| CONTAINS('RLSTable', 'RLSTable'[User], USERPRINCIPALNAME(), 'RLSTable'[division], 'WorkLogs'[Project division])

You don't need any relations between the two tables. Caching of RLS will stop working if you have more than about 130 000 rows, but if the table is not too big it will probably work even if you exceed that number.

If performance is not good enough with the above solution, my suggestion is to add some kind of bridge table between the WorkLogs table and RLStable that connects worklog rows with rows in the RLS table.

Best Regards // Ulf

[IoanaSluby]

I think because of the relation (many to many) it gives me an error: A single value value for column Employee division cannot be determined. This can happen when a measure refers to column that contains many values without specifying an aggregation.

[sturlaws]

Hi @IoanaSluby 

how to do this will depend on your data and the desired output. Could you provide some relevant sample data and a mockup of your desired output?

Cheers,
Sturla

[IoanaSluby]

Currently, there is a relation between the RLS table and Project Division (RLS filtering Main datasource) and a role which says that User = USERPRINCIPALNAME().

What i would like to achieve is displaying for User = user1@gmail.com, since he has rights on Commerce division, both the rows where Employee Division = Commerce or where Project Division = Commerce.

[Anonymous]

@IoanaSlubyDid you get the error message when you tried the DAX I posted earlier? It should be on the main data source table, not on the RLS table. And you should remove the relationship.

RLS expression on Main Data source table:

= CONTAINS('RLS Table', 'RLS Table'[User], USERPRINCIPALNAME(), 'RLS Table'[Division], 'Main Data source'[Employee division])

|| CONTAINS('RLS Table', 'RLS Table'[User], USERPRINCIPALNAME(), 'RLS Table'[Division], 'Main Data source'[Project division])

Best Regards // Ulf

[IoanaSluby]

@Anonymous , thank you very much, I tried again and the error does not appear, and tested as role and everything seems to work fine! My main datasource has currently 120 000 rows, but it will keep growing. Doesn't seem an issue at this time but maybe i will reconsider this.

[marwansamara1]

I have exactly the same issue, and I'm not an expert on Power Bi.  Would you please give me specific instructions on where would I put the above expression?

[Anonymous]

Happy to hear it worked! Please remember to mark my answer as accepted solution 🙂