RLS not working for composite model with multiple layers

[jkeizer]

Hi,

I have the following setup in an Embedded workspace:

Datamodel with RLS > Datamodel > Report 

I'm a workspace admin. When trying to access the report in our app using a defined role I get the an error: "Operation returned an invalid status code 'BadRequest'".

The following set-up without the extra datamodel does work: Datamodel with RLS > Report. 

Is there any way to setup RLS for a composite model with multiple levels?

Best,

Joery

[v-yanjiang-msft · Accepted solution]

Hi @jkeizer ,

Please check whether the parameters like report id/dataset id in your code are correct.

I think you can try to post a Rest API to generate a Embed token for the report with RLS.

For refernece:  Embed Token - Generate Token - REST API (Power BI Power BI REST APIs) | Microsoft Docs

Here is a solved post with similar issue like yours, I think you may refer to it to learn more details.

Solved: Re: Power BI send “invalid status code 'Bad Reques... - Microsoft Power BI Community

Best Regards,
Community Support Team _ kalyj

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[jkeizer]

Hi @v-yanjiang-msft ,

I did learn that my initial question wasn't great. To clarify: I have a dataset/report with a direct query connection to another Power BI dataset. That second dataset has the RLS. 

Trying to generate a token it now I either get: 

"Embedding a report with a model which has a Direct Query connection to another model is not supported with V1 embed token" or "Creating embed token with multiple identities is not supported".

Am I doing something wrong or is this not possible (yet)? 

Best,

Joery

[jkeizer]

Nevermind, I got it to work. Thank you for sending me in the right direction.

[Anonymous]

hey @jkeizer, how did you manage to make it work? Apparently facing the same issue here

[jkeizer]

Hi @Anonymous ,

Make sure you add all relevant dataset id's in your token request. We had a model with ~5 linked dataset's and all needed to be included. The identity/role only needs to be set on 1 dataset. If I recall correctly that fixed it for us. We also include "xmlaPermissions": "ReadOnly" for each dataset but I'm not sure if that was necessary.