Option to Disable/Bypass the RLS on active relationship

[abhiram342]

Hi Team - We have tabular model (screenshot below) and enabled RLS on the "DimCustomer" table, which is currently security applying the filter to both the "FactSales" and "FactCompute" tables.

However, we have a requirement to disable RLS between the "DimCustomer" and "FactCompute" tables, while still keeping it enabled for the "FactSales" table.

Upon reviewing the available solutions, I have come across below approaches, but it has certain disadvantages. Please suggest if there any other alternative options

1) Implement RLS on FactTable
   Implement RLS on FactSales Table Only 
   Disadvantage: FactSales is very big , it occupies 70 GB in our data model. I think implementing RLS on Fact will slow down the performance.

2) Clone the Customer Table
   Have two set of Customer Table and enable RLS on One Customer Table.
   Disadvantage: If we want to show Sales and Cores by customerName in single chart then we will end up with customerName from different tables

RLS Code On DimCustomer:
VAR CUSTOMERS =
CALCULATETABLE (
VALUES ( 'DimUser'[SubsidiaryID] ),
'DimUser'[UserAlias] = USERPRINCIPALNAME ()
)
RETURN
'DimCustomer'[CustomerID] IN CUSTOMERS

Thanks,

Abhiram

[OwenAuger · Accepted solution]

Hi Abhiram,

With Option 2, with a clone of DimCustomer, I think it would work fine if you have it set up with:

1. The clone of DimCustomer used for RLS purposes (let's call it DimCustomerRLS) related to just Fact Sales.
2. The original DimCustomer related to both Fact Sales and Fact Compute.

This should allow RLS to fliter Fact Sales via the relationship with DimCustomerRLS, but for visuals you would just use DimCustomer, which would filter both Fact Compute and Fact Sales.

Also, I would recommend hiding DimCustomerRLS.

(Oh and I'm not sure if DimUser is used outside RLS. If so, it might also need to be cloned.)

Would this work for you?

Regards