Forum Discussion
RLS problem: not adding permits when a user is assigned to different roles
Hi JoseRamon
That's because the user of type II's security filter is the false() in Table Country and empty in Service.
The false() means that the user has no access, so it would make sense for security that in the absense of an expression to evaluate, it defaults to FALSE preventing someone from accessing the data just because they have no role.
Best Regards
Zhengdong Xu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Thanks for your answer.
Totally agreee that from a security perspective the behaviour you mention would de perfect and makes sense, but according to Microsoft documentation (see link below) RLS roles are additive.
In fact when a user in my case is applied both roles, with filter False() for table "Countries" in one role and filter [Country]="Mexico" in the otrer role, the user sees only "Mexico" row in table "Countries" 🙂
And for that user with no security filter for table "Services" in one role and filter [service]=”A” || [service]=”K” in the other role, user sees absolutely all raws in table "Services" 🙂
So question is: Why that user sees only rows related to "Mexico" and services A and K in table "Invoices" and cannot see "Invoices" rows related to other services of Mexico?🤔
https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance